yrtuyiuoi.w3spaces.com Open in urlscan Pro
2600:9000:21f3:6a00:b:df74:43c0:93a1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Page URL
2. https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response 16l1t.codesandbox.io/	899 B 842 B	101ms 54ms	Document text/html	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash be60d214b1fd01b05b60f2e9b9f5ff6b0129d89b5eaf859e1629c3bc6a6dac7f Request headers :method GET :authority 16l1t.codesandbox.io :scheme https :path /?dg=aforbes@flyht.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 01:21:42 GMT content-type text/html vary Accept-Encoding cache-control private, max-age=0, no-cache, no-store x-request-id FosReQB3FqEQKkubwgIC set-cookie signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly via 1.1 google alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-request-id 0ad80e80440000d6f5e4392000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 6639e6ad3b1ad6f5-FRA content-encoding br
GET H2	200	sse-hooks.f648b14c15c640a14a557113a991cb8d.js Show response codesandbox.io/public/sse-hooks/	172 KB 41 KB	36ms 27ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js Requested by Host: 16l1t.codesandbox.io URL: https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73 Request headers Referer https://16l1t.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 01:21:42 GMT via 1.1 google cf-cache-status HIT age 5255266 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ad80e808a0000d6f51b3d5000000001 last-modified Thu, 22 Apr 2021 14:00:04 GMT server cloudflare etag W/"60818164-2aeac" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6639e6adab81d6f5-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	banner.be879265d.js Show response codesandbox.io/static/js/	4 KB 2 KB	28ms 19ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/banner.be879265d.js Requested by Host: 16l1t.codesandbox.io URL: https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60 Request headers Referer https://16l1t.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 01:21:42 GMT via 1.1 google cf-cache-status HIT age 4945880 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ad80e808a0000d6f5fa918000000001 last-modified Mon, 26 Apr 2021 19:22:26 GMT server cloudflare etag W/"608712f2-f3a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6639e6adab82d6f5-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	watermark-button.be960f43b.js codesandbox.io/static/js/	3 KB 2 KB	45ms 21ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/watermark-button.be960f43b.js Requested by Host: 16l1t.codesandbox.io URL: https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Origin https://16l1t.codesandbox.io Referer https://16l1t.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 01:21:42 GMT via 1.1 google cf-cache-status HIT age 46931 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ad80e80980000dfcf72bed000000001 last-modified Tue, 22 Jun 2021 11:16:24 GMT server cloudflare etag W/"60d1c688-ae8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 6639e6adca1ddfcf-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET		beacon.min.js static.cloudflareinsights.com/	0 0
GET		phishing codesandbox.io/api/v1/sandboxes/16l1t/	0 0
GET H2	200	Primary Request / Show response yrtuyiuoi.w3spaces.com/	399 KB 400 KB	41ms 21ms	Document text/html	2600:9000:21f3:6a00:b:df74:43c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com Requested by Host: 16l1t.codesandbox.io URL: https://16l1t.codesandbox.io/?dg=aforbes@flyht.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:6a00:b:df74:43c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ef2c46758e4b66903d34bb106b129bb0550938bcda21620f09cf95de4389b995 Request headers :method GET :authority yrtuyiuoi.w3spaces.com :scheme https :path /?dg=aforbes@flyht.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://16l1t.codesandbox.io/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://16l1t.codesandbox.io/ Response headers content-type text/html content-length 408757 x-amz-id-2 KUa9BZUwOoZCnxhabQfyfuuozy1Hbx6v43e83RYPEHlU4YJPf+oYwqLx5YBrn7u1HcWgwY70r0w= x-amz-request-id JZA3RDSK83387526 last-modified Tue, 22 Jun 2021 15:15:55 GMT accept-ranges bytes server AmazonS3 date Wed, 23 Jun 2021 01:21:38 GMT etag "bf8cbae7e219d001aa14a50442c555f3" vary Accept-Encoding x-cache Hit from cloudfront via 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id 2l1Rby6FsYvxjF9G9tM4onlUGZ9Z7HzzTwp0X7awyfL6ZwX-xa6lwQ== age 5
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	9 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	call.php Show response pineal314.com/loggs/40/	670 B 902 B	1015ms 715ms	XHR application/json	69.49.234.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://pineal314.com/loggs/40/call.php?u=aforbes@flyht.com Requested by Host: yrtuyiuoi.w3spaces.com URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.234.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-234-241.unifiedlayer.com Software Apache / Resource Hash b2f60f70c49d8f828731ea2d75a12a87a520cd4c2fd63b7fdd49d839d58203d6 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://yrtuyiuoi.w3spaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Wed, 23 Jun 2021 01:21:41 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type application/json
GET H/1.1	200 OK	clearbit.php Show response pineal314.com/loggs/40/	9 KB 10 KB	284ms 284ms	XHR application/json	69.49.234.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://pineal314.com/loggs/40/clearbit.php?d=flyht.com Requested by Host: yrtuyiuoi.w3spaces.com URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.234.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-234-241.unifiedlayer.com Software Apache / Resource Hash 13d8e60b267de594dd1a4962ffb295ad470c1a1561dd8d31be83ebcef067af86 Request headers Accept text/plain, */*; q=0.01 Referer https://yrtuyiuoi.w3spaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Wed, 23 Jun 2021 01:21:42 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Transfer-Encoding chunked Content-Type application/json
GET H/1.1	200 OK	clearbit.php pineal314.com/loggs/40/	9 KB 10 KB	492ms 195ms	Image application/json	69.49.234.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://pineal314.com/loggs/40/clearbit.php?d=flyht.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.234.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-234-241.unifiedlayer.com Software Apache / Resource Hash fc5e8322ededab2a2f02d416b76acb368bbcdb22634f8952ee32c2fada5a4acd Request headers Referer https://yrtuyiuoi.w3spaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Wed, 23 Jun 2021 01:21:42 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type application/json

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

static.cloudflareinsights.com

URL

https://static.cloudflareinsights.com/beacon.min.js

Domain

codesandbox.io

URL

https://codesandbox.io/api/v1/sandboxes/16l1t/phishing

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://16l1t.codesandbox.io/?dg=aforbes@flyht.com(Line 10) Message: aforbes@flyht.com
console-api	log	URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com(Line 10726) Message: PARAM CAME===>> aforbes@flyht.com
console-api	log	URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com(Line 10735) Message: PARAM CAME 2===>> aforbes@flyht.com
console-api	log	URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com(Line 10903) Message: domain ===> flyht.com
console-api	log	URL: https://yrtuyiuoi.w3spaces.com/?dg=aforbes@flyht.com(Line 10766) Message: PARAM CAME 3===>> aforbes@flyht.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

16l1t.codesandbox.io
codesandbox.io
pineal314.com
static.cloudflareinsights.com
yrtuyiuoi.w3spaces.com
codesandbox.io
static.cloudflareinsights.com
2600:9000:21f3:6a00:b:df74:43c0:93a1
2606:4700::6812:17cf
69.49.234.241
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
13d8e60b267de594dd1a4962ffb295ad470c1a1561dd8d31be83ebcef067af86
185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55
b2f60f70c49d8f828731ea2d75a12a87a520cd4c2fd63b7fdd49d839d58203d6
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
be60d214b1fd01b05b60f2e9b9f5ff6b0129d89b5eaf859e1629c3bc6a6dac7f
ef2c46758e4b66903d34bb106b129bb0550938bcda21620f09cf95de4389b995
fc5e8322ededab2a2f02d416b76acb368bbcdb22634f8952ee32c2fada5a4acd