![](/screenshots/5b7831be-6a7c-4ae3-b665-52d9b0012dcb.png)
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co
Open in
urlscan Pro
65.9.63.79
Malicious Activity!
Public Scan
Submission: On May 21 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Amazon on January 5th 2022. Valid for: a year.
This is the only time tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 65.9.63.79 65.9.63.79 | 16509 (AMAZON-02) (AMAZON-02) | |
13 | 18.205.205.44 18.205.205.44 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 18.66.248.120 18.66.248.120 | 16509 (AMAZON-02) (AMAZON-02) | |
19 | 4 |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-63-79.fra56.r.cloudfront.net
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-205-44.compute-1.amazonaws.com
happy-sly-century.glitch.me |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-120.dus51.r.cloudfront.net
backgrounds.wetransfer.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
glitch.me
happy-sly-century.glitch.me |
1 MB |
4 |
fleek.co
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co |
45 KB |
1 |
wetransfer.net
backgrounds.wetransfer.net — Cisco Umbrella Rank: 21384 |
273 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
19 | 4 |
Domain | Requested by | |
---|---|---|
13 | happy-sly-century.glitch.me |
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co
happy-sly-century.glitch.me |
4 | tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co |
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co
|
1 | backgrounds.wetransfer.net |
happy-sly-century.glitch.me
|
0 | fdcgdnkidjaadafnichfpabhfomcebme Failed |
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co
|
19 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ic.fleek.co Amazon |
2022-01-05 - 2023-02-03 |
a year | crt.sh |
glitch.com Amazon |
2022-02-01 - 2023-03-02 |
a year | crt.sh |
wetransfer.net Amazon |
2021-07-13 - 2022-08-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co/
Frame ID: FB89B3BBE532FFE32DEC1AAF5A17834E
Requests: 8 HTTP requests in this frame
Frame:
https://happy-sly-century.glitch.me/bg.html
Frame ID: C5C57C7FF9578076AF269E0C0F68B8F3
Requests: 27 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co/ |
123 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.js
happy-sly-century.glitch.me/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js.download
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co/ |
123 KB 11 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bWqOLA69nu2fsMi45LjA.js.download
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co/ |
123 KB 11 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js.download
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co/ |
123 KB 11 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
webrtc-patch.js
fdcgdnkidjaadafnichfpabhfomcebme/scripts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-bd95c1c273b3b6f2c6b24f2eaeeaef30be54981e5727d3ac981a5e003b93d6a6.css
happy-sly-century.glitch.me/ |
391 KB 392 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.js
happy-sly-century.glitch.me/ |
76 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.html
happy-sly-century.glitch.me/ Frame C5C5 |
348 KB 349 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.js
happy-sly-century.glitch.me/ Frame C5C5 |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallpaper-toolbox-2.3.0.css
happy-sly-century.glitch.me/ Frame C5C5 |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
happy-sly-century.glitch.me/ Frame C5C5 |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
moatad.js
happy-sly-century.glitch.me/ Frame C5C5 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.js
happy-sly-century.glitch.me/ Frame C5C5 |
76 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uaest.js
happy-sly-century.glitch.me/ Frame C5C5 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallpaper-api-2.4.0.js
happy-sly-century.glitch.me/ Frame C5C5 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallpaper-toolbox-2.3.0.js
happy-sly-century.glitch.me/ Frame C5C5 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.js
happy-sly-century.glitch.me/ Frame C5C5 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
152 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
20 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C5C5 |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
backgrounds.wetransfer.net/macallan/2011/ctp2_tw_v7/assets/images/ Frame C5C5 |
272 KB 273 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- fdcgdnkidjaadafnichfpabhfomcebme
- URL
- chrome-extension://fdcgdnkidjaadafnichfpabhfomcebme/scripts/webrtc-patch.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| mail undefined| t undefined| params undefined| lst undefined| p undefined| $ function| jQuery string| ajaxurl string| image_save_msg string| no_menu_msg string| smessage function| disableEnterKey function| wccp_free_iscontenteditable function| disable_copy function| disable_copy_ie function| reEnable function| disableSelection function| onlongtouch undefined| timer number| touchduration string| elemtype function| touchstart function| touchend function| wccp_pro_is_passive function| nocontext undefined| timeout_result function| show_wpcp_message function| hide_message object| maxwellScreenReaderText object| lazySizes object| addComment object| wp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
backgrounds.wetransfer.net
fdcgdnkidjaadafnichfpabhfomcebme
happy-sly-century.glitch.me
tbhez-gqaaa-aaaad-qbujq-cai.ic.fleek.co
fdcgdnkidjaadafnichfpabhfomcebme
18.205.205.44
18.66.248.120
65.9.63.79
24b959bc96843399ff2d0ad468df3e4411b8c8bd03e751704a3abadf5df9189a
28f386e075042f322b3bfb14059200196c3727ccd73e1fe73bf06c1493ee25bc
2b8efd1f4cf30769824adbfab79744e0a024e9fab4b12334779066be4fb595ca
4dda196613c6279e0bf3993dddeb025adea6e52a5d9b1d573b33f1fa7916597a
4ecaaf85b46702b111526a8e0998101cc28a827e110b145588147ed463011add
562f454ad3d992f265310c49029a35fd9f3e130fa46ae3bcab32d415dfcf6750
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
630d7a5fa567adb73f889d057a5e4992bdce192474ecdd642166dbf2fe89a2b0
634e84bb50d3384a00662df1e6b96c1f5074f772f3f3a9fa4a497346df27b4b2
77bc1d4dccbd11fc21ca891758ad0e48de93b9b3ecef043d173ae887997307eb
78b19f552dc7d5f3bfbff6d532b50c1f9994d3fb47b30232510f9f101ebbbe1d
7a32a6e4c5e81f0d51cb97466aa442a2342f5ab5c62ff62c3094296fabdda734
84a516ac28723f623ac50cefe23cda258cc6c508c2454d85c190e63c5fe6b799
9108f1274306dc3a296837bbf6920bc2974d6d1226385d7f27c72f019e00ad38
925f5eff1d76979081b4581c371a7ef34cff0f993de74114434918f265ab503a
a29b26572c308749c385e618b33c69725540314774aa376eac508c09e6e265c2
a8bc12d9dad38f7abfc571f1d73d3f40b563ae0f8e8faf4c84d0720b404fdd37
ab512a0a4010487d5b11cd3d12969471f7f90238188d65998c0ede44431cb5b9
ac786c11b891ad6416a84e28446154f07f12b69c5c50d434f675bc2a7e98dfc3
ba6454eaee00dff055c64d52d827a2a527e294ca2fb713f0b92b1646ef32579c
c74f27e2b348e289d7a5c9f7f81c0b214c577698c5b90433ebf8c6d6afef7ea1
c8ecd393991cc0e84c63edcd4fc4f4acc6d24d2c6432b21e90119bdb53d6dd79
e80fbe7999d512d3791b72cf67ff0601eea8139ed266dd0e1b3b70fd637403f5
ee39f450d91f5cd102f9b7ced517f610eb1e81b43aad410466214ae414d5b7a2