tk35yj.csb.app Open in urlscan Pro
172.64.148.87 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://a.rs6.net/1/pc?ep=0670a29be4ddeb5aL_edUmqFQwssHa62FmKYQ9dO3e0he0_lbWseGwhPNkRQCQIpaX01CQ22iUi65Ma4T1cUk5Kz...
Effective URL:
https://tk35yj.csb.app/
Submission Tags: falconsandbox
Submission: On July 18 via api (July 18th 2024, 9:18:11 am UTC) from US — Scanned from US

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 172.64.148.87, located in San Francisco, United States and belongs to CLOUDFLARENET, US. The main domain is tk35yj.csb.app.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 30th 2023. Valid for: a year.

This is the only time tk35yj.csb.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.18.43.28 104.18.43.28	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	172.64.148.87 172.64.148.87	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.64.154.107 172.64.154.107	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c08::5f	15169 (GOOGLE) (GOOGLE)
14	4

1 104.18.43.28 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.rs6.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.64.148.87 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

tk35yj.csb.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.64.154.107 (None, )

ASN13335 (CLOUDFLARENET, US)

codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::5f (Washington, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	csb.app tk35yj.csb.app	841 KB
4	codesandbox.io codesandbox.io — Cisco Umbrella Rank: 209528	48 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 641	30 KB
1	rs6.net 1 redirects a.rs6.net — Cisco Umbrella Rank: 471768	378 B
14	4

	Domain	Requested by
9	tk35yj.csb.app	tk35yj.csb.app
4	codesandbox.io	tk35yj.csb.app codesandbox.io
1	ajax.googleapis.com	tk35yj.csb.app
1	a.rs6.net	1 redirects
14	4

This site contains no links.

Subject Issuer	Validity	Valid
csb.app Cloudflare Inc ECC CA-3	`2023-12-30` - `2024-12-29`	a year	crt.sh
codesandbox.io E6	`2024-06-22` - `2024-09-20`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tk35yj.csb.app/
Frame ID: 540AE1040D039AB2D5096F49F76B4916
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

On Demand Delivery

Page URL History Show full URLs

https://a.rs6.net/1/pc?ep=0670a29be4ddeb5aL_edUmqFQwssHa62FmKYQ9dO3e0he0_lbWseGwhPNkRQCQIpaX01... HTTP 302
https://tk35yj.csb.app/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

919 kB
Transfer

3424 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://a.rs6.net/1/pc?ep=0670a29be4ddeb5aL_edUmqFQwssHa62FmKYQ9dO3e0he0_lbWseGwhPNkRQCQIpaX01CQ22iUi65Ma4T1cUk5KzB2S_M84gTn7CHB0UxIr3kYue65scjhwzoCf3RYyz_o-MHYKrnnsfqi8BjY9NDk-jUaKYsD4gG5U1lA&c HTTP 302
https://tk35yj.csb.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
tk35yj.csb.app/
Redirect Chain

https://a.rs6.net/1/pc?ep=0670a29be4ddeb5aL_edUmqFQwssHa62FmKYQ9dO3e0he0_lbWseGwhPNkRQCQIpaX01CQ22iUi65Ma4T1cUk5KzB2S_M84gTn7CHB0UxIr3kYue65scjhwzoCf3RYyz_o-MHYKrnnsfqi8BjY9NDk-jUaKYsD4gG5U1lA&c
https://tk35yj.csb.app/

349 KB
95 KB

362ms
272ms

Document
text/html

172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 8a5161e74a27a675-MIA
content-encoding: br
content-type: text/html
date: Thu, 18 Jul 2024 09:18:06 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google
x-request-id: F-NECI5IYewPcB-ci3Uk

Redirect headers

cache-control: private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie"
cf-cache-status: DYNAMIC
cf-ray: 8a5161e49ea40a16-MIA
content-length: 0
date: Thu, 18 Jul 2024 09:18:05 GMT
location: https://tk35yj.csb.app/
pragma: no-cache
server: cloudflare
x-cnection: close

GET
H3 200 sse-hooks.e15ace8ccace5398a721ffec81f121de.js Show response
codesandbox.io/public/sse-hooks/ 173 KB
44 KB 126ms
44ms Script
application/javascript 172.64.154.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/public/sse-hooks/sse-hooks.e15ace8ccace5398a721ffec81f121de.js
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f29e78a311a90e0626d288df54ac6e17101b8a5c3a176acf3f34202fe1ddaa4

Request headers

Referer: https://tk35yj.csb.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
content-encoding: gzip
via: 1.1 google
cf-cache-status: HIT
age: 1288222
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 03 Jul 2024 11:23:22 GMT
server: cloudflare
etag: W/"668534aa-2b210"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 8a5161e99db4747b-MIA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 banner.d9cb10a38.js Show response
codesandbox.io/static/js/ 4 KB
2 KB 191ms
109ms Script
application/javascript 172.64.154.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/banner.d9cb10a38.js
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74850bad3411bc2540a6928159967088a555cb990e9569065a878e9e8a864830

Request headers

Referer: https://tk35yj.csb.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
content-encoding: gzip
via: 1.1 google
cf-cache-status: HIT
age: 12242437
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 22 Nov 2023 10:23:27 GMT
server: cloudflare
etag: W/"655dd69f-efa"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 8a5161e99db5747b-MIA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 177ms
57ms Script
text/javascript 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tk35yj.csb.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 17 Jul 2024 23:29:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35332
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 17 Jul 2025 23:29:14 GMT

GET
H3 200 watermark-button.eeb14a97b.js Show response
codesandbox.io/static/js/ 3 KB
2 KB 80ms
46ms Script
application/javascript 172.64.154.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/watermark-button.eeb14a97b.js
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c9937bb6f9d154f49699393da35aaa6d5fb9218daa1ec4cba7b4ee097d0d65b

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
content-encoding: gzip
via: 1.1 google
cf-cache-status: HIT
age: 8137
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 11 Jul 2024 15:18:03 GMT
server: cloudflare
etag: W/"668ff7ab-ac1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 8a5161ea6e002594-MIA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 phishing Show response
codesandbox.io/api/v1/sandboxes/tk35yj/ 33 B
437 B 192ms
182ms Fetch
application/json 172.64.154.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/api/v1/sandboxes/tk35yj/phishing
Requested by: Host: codesandbox.io
URL: https://codesandbox.io/static/js/banner.d9cb10a38.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.154.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d91020394c232a07e303c0caff12346b174a759ed94de8bb0eac6c8b60e2660

Request headers

Referer: https://tk35yj.csb.app/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ea6e012594-MIA
alt-svc: h3=":443"; ma=86400
content-length: 33
x-request-id: F-NECKcfQA6mr-yclgBE

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 593618d973776f0cd4c6047898f4448ec35f2ab616a7bb2001dd10681cb36bbc

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cbed74d96a71bf95ec3a3a824f0ddd43f1f100a751b2266e7c5a4b657ce39408

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13bf462519d3748be67c4f4f8a4aa6ea0c7935a65e6607f0886d3a19a87b2f90

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 Delivery_W_Rg.woff2
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 351ms
351ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Rg.woff2
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:06 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ea8b32a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECLCrnonE69SYfz8F

GET
H3 200 Delivery_W_CdLt.woff2
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 389ms
389ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdLt.woff2
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:06 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ea8b33a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECLEOFF6dsaGYfz9F

GET
H3 200 Delivery_W_Bd.woff2
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 400ms
399ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Bd.woff2
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:06 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ea8b34a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECLFv4hsLs794qPiG

GET
H3 200 Delivery_W_CdBlk.woff2
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 370ms
370ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdBlk.woff2
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:06 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:06 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ea8b35a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECLCZgAgh67KUwvHl

GET
H3 200 Delivery_W_Rg.woff
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 252ms
251ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Rg.woff
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:07 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ed5c3ca675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECMW_rnY3Lx2clgLk

GET
H3 200 Delivery_W_CdLt.woff
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 261ms
261ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdLt.woff
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:07 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ed7c4ba675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECMbyIkZCYf6d9hiD

GET
H3 200 Delivery_W_Bd.woff
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 324ms
324ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Bd.woff
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:07 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161ed9c54a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECMfeOdB9mUymc9Vj

GET
H3 200 Delivery_W_CdBlk.woff
tk35yj.csb.app/css/fonts/delivery/ 349 KB
93 KB 253ms
252ms Font
text/html 172.64.148.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdBlk.woff
Requested by: Host: tk35yj.csb.app
URL: https://tk35yj.csb.app/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.148.87 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

Request headers

Referer: https://tk35yj.csb.app/
Origin: https://tk35yj.csb.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 09:18:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Jul 2024 09:18:07 GMT
server: cloudflare
vary: Accept-Encoding, origin
content-type: text/html
access-control-allow-origin: https://tk35yj.csb.app
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 8a5161edac56a675-MIA
alt-svc: h3=":443"; ma=86400
x-request-id: F-NECMjM5ZXrh86xhFmB

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rs6.net/	1969-12-31 23:59:59	Name: ctcttav Value: c9923859-5f13-4661-9f68-de665831d1df
a.rs6.net/	1970-01-20 22:09:37	Name: __cflb Value: 0H28ujRJdkkewMJzrjqasyHymYxQJkNcMsTsYheU988
.codesandbox.io/	1969-12-31 23:59:59	Name: _cfuvid Value: CmxZ.lfusTTcIijFKXLaUmEK.77fT86xsltfTdKtbbI-1721294286345-0.0.1.1-604800000

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Rg.woff2
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdLt.woff2
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Bd.woff2
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdBlk.woff2
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Rg.woff
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdLt.woff
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_CdBlk.woff
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: Failed to decode downloaded font: https://tk35yj.csb.app/css/fonts/delivery/Delivery_W_Bd.woff
other	warning	URL: https://tk35yj.csb.app/#%5B%5B-Email-%5D%5D Message: OTS parsing error: invalid sfntVersion: 538983539

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.rs6.net
ajax.googleapis.com
codesandbox.io
tk35yj.csb.app
104.18.43.28
172.64.148.87
172.64.154.107
2607:f8b0:4004:c08::5f
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13bf462519d3748be67c4f4f8a4aa6ea0c7935a65e6607f0886d3a19a87b2f90
1c9937bb6f9d154f49699393da35aaa6d5fb9218daa1ec4cba7b4ee097d0d65b
2d91020394c232a07e303c0caff12346b174a759ed94de8bb0eac6c8b60e2660
2f29e78a311a90e0626d288df54ac6e17101b8a5c3a176acf3f34202fe1ddaa4
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
593618d973776f0cd4c6047898f4448ec35f2ab616a7bb2001dd10681cb36bbc
74850bad3411bc2540a6928159967088a555cb990e9569065a878e9e8a864830
cbed74d96a71bf95ec3a3a824f0ddd43f1f100a751b2266e7c5a4b657ce39408
fec7d711bfcf491e607ddb13a65a42f578636680e3dadcf35351b85337088898

tk35yj.csb.app Open in urlscan Pro 172.64.148.87 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

919 kBTransfer

3424 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

3 Cookies

17 Console Messages

Indicators

tk35yj.csb.app Open in urlscan Pro
172.64.148.87 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

919 kB
Transfer

3424 kB
Size

3
Cookies

14 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!