cabezasflotantes.club

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 192.254.185.69, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is cabezasflotantes.club.
TLS certificate: Issued by R3 on March 18th 2024. Valid for: 3 months.

This is the only time cabezasflotantes.club was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
6	192.254.185.69 192.254.185.69	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1 1	2606:4700:20:... 2606:4700:20::681a:49b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2

6 192.254.185.69 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-254-185-69.unifiedlayer.com

cabezasflotantes.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:49b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.jqueryscript.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

jquery.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cabezasflotantes.club cabezasflotantes.club	58 KB
1	jquery.app jquery.app — Cisco Umbrella Rank: 225447	1 KB
1	jqueryscript.net 1 redirects www.jqueryscript.net — Cisco Umbrella Rank: 144127	493 B
7	3

	Domain	Requested by
6	cabezasflotantes.club	cabezasflotantes.club
1	jquery.app	cabezasflotantes.club
1	www.jqueryscript.net	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
cabezasflotantes.club R3	`2024-03-18` - `2024-06-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html
Frame ID: BDD3EBD64A32C7D95A786B10398FA850
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Accéder à mes comptes en ligne

Page URL History Show full URLs

http://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html HTTP 307
https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Page URL

Page Statistics

7
Requests

86 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

60 kB
Transfer

69 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html HTTP 307
https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.jqueryscript.net/css/jquerysctipttop.css HTTP 302
https://jquery.app/jqueryscripttop.css

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Connexion.html Show response cabezasflotantes.club/sup-mai/sup-mai/Dir/ Redirect Chain http://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html	4 KB 1 KB	1105ms 414ms	Document text/html	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software nginx/1.21.6 / Resource Hash `967d1e40eba2b611ba5785dd86c6949766cbaa0051d12f417909a20abf301228` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 1228 content-type text/html date Mon, 25 Mar 2024 11:21:54 GMT last-modified Sun, 24 Dec 2023 06:32:38 GMT server nginx/1.21.6 vary Accept-Encoding x-server-cache false Redirect headers Location https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Non-Authoritative-Reason HttpsUpgrades
GET H3	200	jqueryscripttop.css jquery.app/ Redirect Chain https://www.jqueryscript.net/css/jquerysctipttop.css https://jquery.app/jqueryscripttop.css	1 KB 1 KB	141ms 48ms	Stylesheet text/css	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jquery.app/jqueryscripttop.css Requested by Host: cabezasflotantes.club URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Protocol H3 Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a4573ab1815cf119fdefabbc380b7785501f1c7499159a2756854dc6082ad3c9` Request headers accept-language de-DE,de;q=0.9 Referer https://cabezasflotantes.club/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers x-fastly-request-id 778a823012408bca6f55417c595b9143bc55e235 date Mon, 25 Mar 2024 11:21:55 GMT via 1.1 varnish content-encoding br expires Tue, 05 Mar 2024 02:41:52 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 547 x-cache HIT x-proxy-cache HIT alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230027-FRA last-modified Tue, 05 Mar 2024 02:31:47 GMT server cloudflare x-github-request-id 90C8:0E1A:6C41117:6E50375:65E684E0 x-timer S1711130904.981318,VS0,VE2 etag W/"65e68413-5e4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=90SpfgJpnoiWCRlGh884ADBSEjNme9xTHLb0FGLj86Ny15jrIuyYAd0fMD65qnj0FFjiEfqqLUVpKDoNP8ZLnQNNW9RDhY8vhxaHmwJFzaawN%2B4L%2Fq9nxXefbhNU"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=14400 cf-ray 869e85284997bb61-FRA x-cache-hits 1 Redirect headers date Mon, 25 Mar 2024 11:21:55 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cr%2F%2FMN35109z6aGq93VP4E6zimfExlZmrj8IeutiboWX5uuYKKWK921lTiKY7%2F%2FxO9Z%2F9lGeCPgBnZCweDTMsAfEd0SW2xIi2TPhiJXVzPlyS4ewL%2Bke3Xc2N3UAcuCCi%2BPIUbOMWDtwXTdpgrjMag2x"}],"group":"cf-nel","max_age":604800} location https://jquery.app/jqueryscripttop.css cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 869e85276d7c0859-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET H2	200	image.css cabezasflotantes.club/sup-mai/sup-mai/Dir/files/	9 KB 3 KB	190ms 190ms	Stylesheet text/css	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css Requested by Host: cabezasflotantes.club URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software Apache / Resource Hash `c5ae5e3c57049849d2ad9a2a93c6a627849680e4a8c6662367ca732632fca90f` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 25 Mar 2024 11:21:54 GMT content-encoding gzip last-modified Sun, 24 Dec 2023 06:32:38 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2688
GET H2	200	back.PNG cabezasflotantes.club/sup-mai/sup-mai/Dir/files/	37 KB 37 KB	420ms 420ms	Image image/png	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/back.PNG Requested by Host: cabezasflotantes.club URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software nginx/1.21.6 / Resource Hash `7f752438291e281d4351434ef92bd2c7699d73530b5aa272e5ca37e4e6ba4a66` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 25 Mar 2024 11:21:55 GMT last-modified Sun, 24 Dec 2023 06:32:38 GMT server nginx/1.21.6 accept-ranges bytes content-length 37681 x-server-cache false content-type image/png
GET H2	200	indiquer.PNG cabezasflotantes.club/sup-mai/sup-mai/Dir/files/	14 KB 15 KB	419ms 419ms	Image image/png	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/indiquer.PNG Requested by Host: cabezasflotantes.club URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software nginx/1.21.6 / Resource Hash `69e964fbc7987cbef8e5c3d461820a31e178de2dfe4fbc66879cd294aecca072` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 25 Mar 2024 11:21:55 GMT last-modified Sun, 24 Dec 2023 06:32:38 GMT server nginx/1.21.6 accept-ranges bytes content-length 14825 x-server-cache false content-type image/png
GET H2	200	comment.PNG cabezasflotantes.club/sup-mai/sup-mai/Dir/files/	3 KB 3 KB	601ms 601ms	Image image/png	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/comment.PNG Requested by Host: cabezasflotantes.club URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software nginx/1.21.6 / Resource Hash `324f173a65affdc2506935ac2f7b61ca136877a8f3116e92a294fd2259c26b41` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/image.css accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 25 Mar 2024 11:21:55 GMT last-modified Sun, 24 Dec 2023 06:32:38 GMT server nginx/1.21.6 accept-ranges bytes content-length 2747 x-server-cache false content-type image/png
GET H2	200	favicon.ico cabezasflotantes.club/sup-mai/sup-mai/Dir/files/	165 B 265 B	265ms 264ms	Other image/x-icon	192.254.185.69 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://cabezasflotantes.club/sup-mai/sup-mai/Dir/files/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.185.69 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-185-69.unifiedlayer.com Software nginx/1.21.6 / Resource Hash `61c063768271f151d43dece97df0bbb7c7544678ebc3bc4cb32203979abfd7f4` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 25 Mar 2024 11:21:56 GMT last-modified Sun, 24 Dec 2023 06:32:38 GMT server nginx/1.21.6 x-server-cache false content-type image/x-icon cache-control max-age=604800 accept-ranges bytes content-length 165 expires Mon, 01 Apr 2024 11:21:56 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| showHide

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://cabezasflotantes.club/sup-mai/sup-mai/Dir/Connexion.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cabezasflotantes.club
jquery.app
www.jqueryscript.net
188.114.97.3
192.254.185.69
2606:4700:20::681a:49b
324f173a65affdc2506935ac2f7b61ca136877a8f3116e92a294fd2259c26b41
61c063768271f151d43dece97df0bbb7c7544678ebc3bc4cb32203979abfd7f4
69e964fbc7987cbef8e5c3d461820a31e178de2dfe4fbc66879cd294aecca072
7f752438291e281d4351434ef92bd2c7699d73530b5aa272e5ca37e4e6ba4a66
967d1e40eba2b611ba5785dd86c6949766cbaa0051d12f417909a20abf301228
a4573ab1815cf119fdefabbc380b7785501f1c7499159a2756854dc6082ad3c9
c5ae5e3c57049849d2ad9a2a93c6a627849680e4a8c6662367ca732632fca90f

cabezasflotantes.club Open in urlscan Pro 192.254.185.69 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

86 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

60 kBTransfer

69 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

cabezasflotantes.club Open in urlscan Pro
192.254.185.69 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

60 kB
Transfer

69 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!