balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com Open in urlscan Pro
2a00:1450:4001:80e::2014  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/	24 KB 6 KB	82ms 37ms	Document text/html	2a00:1450:4001:80e::2014 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Frontend / Resource Hash a535ae7b3df3d00952e50018b27b825d6299ef220754cdbed47c1a503e8a801b Request headers :method GET :authority balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html content-encoding gzip x-cloud-trace-context a537c383e0bfa2c7f41943554cfebdc2;o=1 vary Accept-Encoding date Thu, 25 Feb 2021 11:04:39 GMT server Google Frontend cache-control private content-length 6064 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/	57 KB 10 KB	14ms 14ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css Requested by Host: balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com URL: https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Feb 2021 11:04:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"max_age":604800,"report_to":"cf-nel"} age 1246620 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 10301 cf-request-id 087a75d14400002bdd7fae5000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:08 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e60-e4d2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=e1ASMYFcdhQm64gxX4VpoyFZhZwhOfY6pBHLgLUufWfMoXlgsY91JArQs%2Fdqz955hg9fQwVNaNPV1kShNz1Bf6gpea%2BMUfa%2FRrECtiAleYKkN7vsQ%2BGLlHn3twXR6ILTeg%3D%3D"}],"max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6270f2620a912bdd-FRA expires Tue, 15 Feb 2022 11:04:40 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	9ms 8ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com URL: https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Feb 2021 09:25:44 GMT content-encoding gzip x-content-type-options nosniff age 5936 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 25 Feb 2022 09:25:44 GMT
GET H2	200	jyliqfL.png i.imgur.com/	8 KB 9 KB	75ms 24ms	Image image/png	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/jyliqfL.png Requested by Host: balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com URL: https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash fcaccc8cab487d6a977872f28a31fde5b0449723f815b5f33063b1a2bfc2ebba Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Feb 2021 11:04:40 GMT x-content-type-options nosniff age 25393 x-cache HIT, HIT content-length 8585 x-served-by cache-bwi5131-BWI, cache-hhn4062-HHN last-modified Wed, 22 Apr 2020 13:04:52 GMT server cat factory 1.0 x-timer S1614251080.082381,VS0,VE1 etag "743f1754343e230f3b59b78b98fcae54" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 2, 1
GET H2	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/	78 KB 78 KB	24ms 11ms	Font application/octet-stream	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin https://balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 25 Feb 2021 11:04:40 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3516652 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 79444 cf-request-id 087a75d18000004e31b7075000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:10:08 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e60-13654" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NFA1u2R9J2Q8Q%2FG3ns7IEFSxYwj6YtcZsg0DpPk54h1%2FtwLmunIQrwXDFJ5R6QJSUVrv8Qyt9jRkDi%2BYfbMYJN3pUpbbmRWjiA65fdTeBgE8%2Fcw2QzmnFpCP%2F1jIExTSdA%3D%3D"}]} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6270f2626dc24e31-FRA expires Tue, 15 Feb 2022 11:04:40 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1&1 Ionos (Telecommunication)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| count string| hash string| em string| ps undefined| check object| pwdInput function| sendmails

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
balvcjixgbfzbejr-dot-app-auth-limitedly.oa.r.appspot.com
cdnjs.cloudflare.com
i.imgur.com
151.101.112.193
2606:4700::6810:125e
2606:4700::6810:135e
2a00:1450:4001:80e::2014
2a00:1450:4001:80f::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
a535ae7b3df3d00952e50018b27b825d6299ef220754cdbed47c1a503e8a801b
fcaccc8cab487d6a977872f28a31fde5b0449723f815b5f33063b1a2bfc2ebba