frailcoralclient.codesandbox.repl.co Open in urlscan Pro
35.186.245.55  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://s5coi.codesandbox.io/ Page URL
2. https://frailcoralclient.codesandbox.repl.co/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response s5coi.codesandbox.io/	943 B 849 B	77ms 55ms	Document text/html	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash caabf23106849f833fd0e882160d1c875cb8c56426ec381c4fae28cae8afd65a Request headers :method GET :authority s5coi.codesandbox.io :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT content-type text/html vary Accept-Encoding cache-control private, max-age=0, no-cache, no-store x-request-id Fomzo0g2EBazFIESh_lH set-cookie signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly via 1.1 google alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-request-id 0ac1213f1100004a9e70b66000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 661537de8c784a9e-FRA content-encoding br
GET H2	200	sse-hooks.f648b14c15c640a14a557113a991cb8d.js Show response codesandbox.io/public/sse-hooks/	172 KB 41 KB	43ms 39ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js Requested by Host: s5coi.codesandbox.io URL: https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73 Request headers Referer https://s5coi.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT via 1.1 google cf-cache-status HIT age 4870618 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ac1213f6200004a9e403fc000000001 last-modified Thu, 22 Apr 2021 14:00:04 GMT server cloudflare etag W/"60818164-2aeac" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 661537df0db64a9e-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	banner.be879265d.js Show response codesandbox.io/static/js/	4 KB 2 KB	28ms 24ms	Script application/javascript	2606:4700::6812:16cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/banner.be879265d.js Requested by Host: s5coi.codesandbox.io URL: https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:16cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60 Request headers Referer https://s5coi.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT via 1.1 google cf-cache-status HIT age 4561232 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ac1213f6200004a9e5d271000000001 last-modified Mon, 26 Apr 2021 19:22:26 GMT server cloudflare etag W/"608712f2-f3a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 661537df0db84a9e-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	watermark-button.be960f43b.js codesandbox.io/static/js/	3 KB 2 KB	89ms 56ms	Script application/javascript	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/static/js/watermark-button.be960f43b.js Requested by Host: s5coi.codesandbox.io URL: https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Origin https://s5coi.codesandbox.io Referer https://s5coi.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT via 1.1 google cf-cache-status HIT age 21648 content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0ac1213f7e000064f78c11d000000001 last-modified Thu, 17 Jun 2021 15:30:35 GMT server cloudflare etag W/"60cb6a9b-ae8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 cf-ray 661537df2f6964f7-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	beacon.min.js static.cloudflareinsights.com/	13 KB 0	37ms 36ms	Script text/javascript	2606:4700::6810:5e41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js Requested by Host: s5coi.codesandbox.io URL: https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://s5coi.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT content-encoding gzip last-modified Fri, 28 May 2021 17:24:20 GMT server cloudflare etag W/"5753bdd2-d310-49fa-bd2b-065a8e512116" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin cf-ray 661537df7ec94e2b-FRA cf-request-id 0ac1213fc000004e2b9503c000000001
GET H3-29	200	phishing codesandbox.io/api/v1/sandboxes/s5coi/	33 B 521 B	320ms 291ms	Fetch application/json	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/api/v1/sandboxes/s5coi/phishing Requested by Host: codesandbox.io URL: https://codesandbox.io/static/js/banner.be879265d.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://s5coi.codesandbox.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 18 Jun 2021 14:30:54 GMT via 1.1 google cf-cache-status DYNAMIC server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin content-type application/json; charset=utf-8 access-control-allow-origin https://s5coi.codesandbox.io cache-control private, max-age=0, no-cache, no-store access-control-allow-credentials true cf-ray 661537dfdd754e6e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 33 cf-request-id 0ac1213ff700004e6ec21c7000000001 x-request-id Fomzo1bNSPZwU6k5FUZC
GET H2	200	Primary Request / Show response frailcoralclient.codesandbox.repl.co/	399 KB 400 KB	311ms 164ms	Document text/html	35.186.245.55 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://frailcoralclient.codesandbox.repl.co/ Requested by Host: s5coi.codesandbox.io URL: https://s5coi.codesandbox.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.245.55 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 55.245.186.35.bc.googleusercontent.com Software / Resource Hash ef2c46758e4b66903d34bb106b129bb0550938bcda21620f09cf95de4389b995 Security Headers Name Value Strict-Transport-Security max-age=7771761; includeSubDomains Request headers :method GET :authority frailcoralclient.codesandbox.repl.co :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://s5coi.codesandbox.io/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://s5coi.codesandbox.io/ Response headers access-control-allow-origin * content-type text/html; charset=utf-8 expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" replit-cluster global strict-transport-security max-age=7771761; includeSubDomains content-length 408757 date Fri, 18 Jun 2021 14:30:54 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	9 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/jpeg
GET H/1.1	200 OK	call.php Show response pineal314.com/loggs/40/	579 B 811 B	714ms 401ms	XHR application/json	69.49.234.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://pineal314.com/loggs/40/call.php?u=null Requested by Host: frailcoralclient.codesandbox.repl.co URL: https://frailcoralclient.codesandbox.repl.co/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.49.234.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 69-49-234-241.unifiedlayer.com Software Apache / Resource Hash 161692108fc5ef94f9480985e7362d939d6ad961f40b6700c8402fb22dfab907 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://frailcoralclient.codesandbox.repl.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 18 Jun 2021 14:30:55 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type application/json

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s5coi.codesandbox.io/(Line 10) Message: null
console-api	log	URL: https://frailcoralclient.codesandbox.repl.co/(Line 10726) Message: PARAM CAME===>> null

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

codesandbox.io
frailcoralclient.codesandbox.repl.co
pineal314.com
s5coi.codesandbox.io
static.cloudflareinsights.com
2606:4700::6810:5e41
2606:4700::6812:16cf
2606:4700::6812:17cf
35.186.245.55
69.49.234.241
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
161692108fc5ef94f9480985e7362d939d6ad961f40b6700c8402fb22dfab907
185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
caabf23106849f833fd0e882160d1c875cb8c56426ec381c4fae28cae8afd65a
ef2c46758e4b66903d34bb106b129bb0550938bcda21620f09cf95de4389b995