![](/screenshots/6d7fde50-a8b1-4f60-a558-fcaebb7c23da.png)
rack-space-a32937.owamser.workers.dev
Open in
urlscan Pro
172.67.182.110
Malicious Activity!
Public Scan
Submission: On June 30 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 16th 2024. Valid for: 3 months.
This is the only time rack-space-a32937.owamser.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rackspace (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 172.67.182.110 172.67.182.110 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4802:7a0... 2001:4802:7a01:10::4 | 27357 (RACKSPACE) (RACKSPACE) | |
4 | 2001:4802:7a0... 2001:4802:7a01:10::7 | 27357 (RACKSPACE) (RACKSPACE) | |
2 | 142.250.185.98 142.250.185.98 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.186.130 142.250.186.130 | 15169 (GOOGLE) (GOOGLE) | |
12 | 6 |
ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
www.googleadservices.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
googleads.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
rackspace.com
apps.rackspace.com — Cisco Umbrella Rank: 166671 cp.rackspace.com — Cisco Umbrella Rank: 754863 |
41 KB |
2 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 133 |
22 KB |
2 |
workers.dev
rack-space-a32937.owamser.workers.dev |
13 KB |
1 |
doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 70 |
64 B |
0 |
ajax.goog
Failed
ajax.goog Failed |
|
0 |
sitepoint.com
Failed
www.sitepoint.com Failed |
|
12 | 6 |
Domain | Requested by | |
---|---|---|
4 | cp.rackspace.com |
rack-space-a32937.owamser.workers.dev
|
2 | www.googleadservices.com |
rack-space-a32937.owamser.workers.dev
www.googleadservices.com |
2 | rack-space-a32937.owamser.workers.dev | |
1 | googleads.g.doubleclick.net |
rack-space-a32937.owamser.workers.dev
|
1 | apps.rackspace.com |
rack-space-a32937.owamser.workers.dev
|
0 | ajax.goog Failed |
rack-space-a32937.owamser.workers.dev
|
0 | www.sitepoint.com Failed |
rack-space-a32937.owamser.workers.dev
|
12 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rackspace.com |
cp.rackspace.com |
apps.rackspace.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
owamser.workers.dev GTS CA 1P5 |
2024-05-16 - 2024-08-14 |
3 months | crt.sh |
apps.rackspace.com Thawte EV RSA CA G2 |
2023-08-08 - 2024-08-17 |
a year | crt.sh |
cp.rackspace.com Thawte TLS RSA CA G1 |
2023-07-05 - 2024-07-18 |
a year | crt.sh |
*.googleadservices.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
*.g.doubleclick.net WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://rack-space-a32937.owamser.workers.dev/
Frame ID: BFAA0CC0241159D6ACD2FB0B3C4B8670
Requests: 12 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Control Panel
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Hosted Email
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Website Terms
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
rack-space-a32937.owamser.workers.dev/ |
45 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.min.js
ajax.goog//leapis.com/ajax/libs/jquery/1.10.2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
apps.rackspace.com/a/js/ |
29 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
43 B 313 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
conversion.js
www.googleadservices.com/pagead/ |
57 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
43 B 117 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.googleadservices.com/pagead/conversion/1040066332/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_20141002.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plus-anytime_anywhere-190x294.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/ |
42 B 64 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
rack-space-a32937.owamser.workers.dev/ |
45 KB 6 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.sitepoint.com
- URL
- https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
- Domain
- ajax.goog
- URL
- https://ajax.goog//leapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rackspace (Online)57 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage boolean| _wm_redirect function| onFormSubmit object| Webmail object| $Login object| $TEAEncrypt object| google_conversion_id object| google_conversion_language object| google_conversion_format object| google_conversion_color object| google_conversion_label object| google_conversion_value object| google_tag_data function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_currency object| google_conversion_domain object| google_disable_viewthrough object| google_gtag_event_data object| google_remarketing_only object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| google_custom_params object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.goog
apps.rackspace.com
cp.rackspace.com
googleads.g.doubleclick.net
rack-space-a32937.owamser.workers.dev
www.googleadservices.com
www.sitepoint.com
ajax.goog
www.sitepoint.com
142.250.185.98
142.250.186.130
172.67.182.110
2001:4802:7a01:10::4
2001:4802:7a01:10::7
254954afb10634ad2eead14d873510c39a68c15d3bf54bf958655962cb7e1450
2894fa1d1ebe2f99a165317c3c46ea23a7de28590a1c3965508acaf802e9c9a8
678c7bdfa334cc04afdfdbb1e3e7ebf98ecce178135ab46d4d6791bf70cf6028
747ff7f94853b142dde09cc0f0bf7f41ce189e78a3f7d580bedc938bf5f0fa67
db18ad437ed30b29a15bb4a394df2f29cd5073ccab904b6ed5e2cf870530dc62
e1884583e1b8e69b3cce26fd647fd8b8e4110aec60e1456e1e4fa0fff4e12169
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f167dfd881b45166119fce39b1fa639e925f80e4e7391e3cbe83f843490b7b19