![](/screenshots/5180cc80-fc22-476c-874e-dded3a497974.png)
detailed-article-reflection.top
Open in
urlscan Pro
104.21.7.241
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On April 23 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on April 23rd 2024. Valid for: 3 months.
This is the only time detailed-article-reflection.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 104.21.7.241 104.21.7.241 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 104.16.85.20 104.16.85.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.2.137 151.101.2.137 | 54113 (FASTLY) (FASTLY) | |
2 | 104.26.8.44 104.26.8.44 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 34.117.186.192 34.117.186.192 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
14 | 6 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.186.117.34.bc.googleusercontent.com
ipinfo.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
detailed-article-reflection.top
detailed-article-reflection.top |
97 KB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 320 |
43 KB |
2 |
ipapi.co
ipapi.co — Cisco Umbrella Rank: 16703 |
374 B |
1 |
ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 7609 |
603 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 767 |
30 KB |
0 |
1646415.com
Failed
1646415.com Failed |
|
14 | 6 |
Domain | Requested by | |
---|---|---|
6 | detailed-article-reflection.top |
detailed-article-reflection.top
|
3 | cdn.jsdelivr.net |
detailed-article-reflection.top
|
2 | ipapi.co |
code.jquery.com
|
1 | ipinfo.io |
code.jquery.com
|
1 | code.jquery.com |
detailed-article-reflection.top
|
0 | 1646415.com Failed |
code.jquery.com
|
14 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.facebook.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
detailed-article-reflection.top GTS CA 1P5 |
2024-04-23 - 2024-07-22 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
ipapi.co E1 |
2024-03-09 - 2024-06-07 |
3 months | crt.sh |
ipinfo.io R3 |
2024-04-19 - 2024-07-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://detailed-article-reflection.top/
Frame ID: 5DBE8FA0D6C1DBB952A07165637FD3EE
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/5180cc80-fc22-476c-874e-dded3a497974.png)
Page Title
MetaDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Meta Privacy Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
detailed-article-reflection.top/ |
57 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ |
152 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
detailed-article-reflection.top/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
newlogo.png
detailed-article-reflection.top/images/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-icon-circle-28.jpg
detailed-article-reflection.top/images/ |
63 KB 63 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
newlogo1.png
detailed-article-reflection.top/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.cookie.js
cdn.jsdelivr.net/npm/jquery.cookie@1.4.1/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/ |
57 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
ip
ipapi.co/ |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ip
ipapi.co/ |
14 B 374 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
modun_post.php
1646415.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
json
ipinfo.io// |
301 B 603 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
detailed-article-reflection.top/images/ |
5 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 1646415.com
- URL
- https://1646415.com/modun_post.php
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap string| sessid string| ip string| country function| getsttindex function| updatepass function| AddSess function| checkCountry function| getIP function| GetSess function| showLoadingCircle function| hideLoadingCircle function| update function| sendpass function| sendPasword1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
detailed-article-reflection.top/ | Name: PHPSESSID Value: c15behrcv0qpeb06apsiigg5rd |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1646415.com
cdn.jsdelivr.net
code.jquery.com
detailed-article-reflection.top
ipapi.co
ipinfo.io
1646415.com
104.16.85.20
104.21.7.241
104.26.8.44
151.101.2.137
34.117.186.192
096988abc603ffc3519d70d6dcb0475bb60b72f2e490c804f03fbf111074deab
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
695e30d44626b75e6ad33011cc4fe8d3f782af9716df139bb53ee0e65f67431b
726be1e116ab2ab6670d94751d0568c157a75f4e625989793fa8e9b77800caa0
9f8efec04e67ebd4a66e06669031dae2934f9b8272a2610a67993a35e46fdfbe
aaa86cdda9f28d804051f776971d84e2e44f063d1fccb799cb25ca90e8e4a68a
ab31d8c4a96ce7422c48db2eaadf4489ee02cb81f26a7645d392eb5c612569e6
b5f049cd8c198126f1bbbf9152357d27c5cac5f498665fcac784540ff42edab1
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
c636a92a12eb33629e6dcadc67e49651ac54e8f3b18a03c805668505f05c885a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e