0076dd.us-south.cf.appdomain.cloud Open in urlscan Pro
169.47.124.23 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dba-gmbh.de/kasa/?lmknjhbgvfd6789oihjh=VE1PLVNEQ0BkYnMuY29t
Effective URL:
https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488...
Submission: On April 15 via api (April 15th 2020, 8:30:14 am UTC) from SG

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 169.47.124.23, located in Ashburn, United States and belongs to SOFTLAYER, US. The main domain is 0076dd.us-south.cf.appdomain.cloud.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on September 24th 2019. Valid for: a year.

This is the only time 0076dd.us-south.cf.appdomain.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	5.35.225.166 5.35.225.166	20773 (GODADDY) (GODADDY)
8	169.47.124.23 169.47.124.23	36351 (SOFTLAYER) (SOFTLAYER)
8	2

1 5.35.225.166 (Germany) 1 redirects

ASN20773 (GODADDY, DE)
PTR: wp159.webpack.hosteurope.de

dba-gmbh.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 169.47.124.23 (Ashburn, United States)

ASN36351 (SOFTLAYER, US)
PTR: 17.7c.2fa9.ip4.static.sl-reverse.com

0k938.us-south.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0076dd.us-south.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	appdomain.cloud 0k938.us-south.cf.appdomain.cloud 0076dd.us-south.cf.appdomain.cloud	390 KB
1	dba-gmbh.de 1 redirects dba-gmbh.de	255 B
8	2

	Domain	Requested by
7	0076dd.us-south.cf.appdomain.cloud	0k938.us-south.cf.appdomain.cloud 0076dd.us-south.cf.appdomain.cloud
1	0k938.us-south.cf.appdomain.cloud
1	dba-gmbh.de	1 redirects
8	3

This site contains no links.

Subject Issuer	Validity	Valid
*.us-south.cf.appdomain.cloud DigiCert SHA2 Secure Server CA	`2019-09-24` - `2020-09-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0--
Frame ID: EF797286F8C60FBD032FA4EC324B9781
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://dba-gmbh.de/kasa/?lmknjhbgvfd6789oihjh=VE1PLVNEQ0BkYnMuY29t HTTP 302
https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Page URL
https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&30... Page URL

Detected technologies

Ruby (Programming Languages) Expand

Overall confidence: 50%
Detected patterns

meta csrf-param /^authenticity_token$/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 50%
Detected patterns

meta csrf-param /^authenticity_token$/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

390 kB
Transfer

1205 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dba-gmbh.de/kasa/?lmknjhbgvfd6789oihjh=VE1PLVNEQ0BkYnMuY29t HTTP 302
https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Page URL
https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://dba-gmbh.de/kasa/?lmknjhbgvfd6789oihjh=VE1PLVNEQ0BkYnMuY29t HTTP 302
https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998--

8 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response 0k938.us-south.cf.appdomain.cloud/ Redirect Chain https://dba-gmbh.de/kasa/?lmknjhbgvfd6789oihjh=VE1PLVNEQ0BkYnMuY29t https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998--	6 KB 1 KB	1289ms 892ms	Document text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash `ca2440cd484f81dcdfd44832035d601260af802ddd454c0718c103971df75b3e` Request headers Host 0k938.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 15 Apr 2020 08:29:37 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 2a9437b75e96c5f13c63bbff Redirect headers Date Wed, 15 Apr 2020 08:29:36 GMT Content-Type text/html Content-Length 0 Connection keep-alive Server Apache Location https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998--
GET H/1.1	200 OK	Primary Request / Show response 0076dd.us-south.cf.appdomain.cloud/	874 KB 389 KB	559ms 169ms	Document text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Requested by Host: 0k938.us-south.cf.appdomain.cloud URL: https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash `04144ff30af747cd8f1d514555e22255070895829188eddba00cb3f76ad047f9` Request headers Host 0076dd.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0k938.us-south.cf.appdomain.cloud/?85245-9435-4adc-b37f-f760d=VE1PLVNEQ0BkYnMuY29t&33=9998-- Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 15 Apr 2020 08:29:40 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 291d64505e96c5f4003661b7
GET DATA	200 OK	truncated /	233 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `79557239867cd4db115bdb3d1d77c08ae076ce61c0b8a2b5244c52425d4035fe` Request headers Referer https://0076dd.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4269a9e0715f76ceb9acc55edbf2dca6109288671ea65eef592a1e92ccf1def2` Request headers Referer https://0076dd.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	60 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3c9a5b43b3cb27aafbe95f48742fbd9e4f9d2717540d29cd40c193d09b1a8de` Request headers Referer https://0076dd.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	FreightSans-Pro-Medium-688ccadb090cbe2e1fabae9933cd09d9fd9d0613099b04c8dda35afdae6f51ad.woff 0076dd.us-south.cf.appdomain.cloud/assets/freightsans/	0 0	133ms 133ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/freightsans/FreightSans-Pro-Medium-688ccadb090cbe2e1fabae9933cd09d9fd9d0613099b04c8dda35afdae6f51ad.woff Requested by Host: 0076dd.us-south.cf.appdomain.cloud URL: https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f500366a07 Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	FaktProWeb-Normal-8468a6ca1e0907b839ebc6e8899b4dd39b386b7cfa33743da1ffb30a68c924f6.woff 0076dd.us-south.cf.appdomain.cloud/assets/faktpro/	0 0	264ms 130ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/faktpro/FaktProWeb-Normal-8468a6ca1e0907b839ebc6e8899b4dd39b386b7cfa33743da1ffb30a68c924f6.woff Requested by Host: 0076dd.us-south.cf.appdomain.cloud URL: https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f5c8fb0a53 Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated /	637 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d2641dd643fe50a338957b04b0eb666df5bf4ec2f459d94549f470ac7b7a6c17` Request headers Referer https://0076dd.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	806 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `10602ce0673f667ee2aecb3a6778293618771f22bed2140cf05e1a3105500e0d` Request headers Referer https://0076dd.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	FaktProWeb-Medium-fd3bbe8c665638bbd898d20dbf232f1bac9d2b11c31eefc006370f43ee8f1994.woff 0076dd.us-south.cf.appdomain.cloud/assets/faktpro/	0 0	363ms 151ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/faktpro/FaktProWeb-Medium-fd3bbe8c665638bbd898d20dbf232f1bac9d2b11c31eefc006370f43ee8f1994.woff Requested by Host: 0076dd.us-south.cf.appdomain.cloud URL: https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f5e050d79f Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	FaktCyrWeb-Normal-0038c5aa5c3243bb2995139e9aeb9519f62f098d0e0f7fab6c8b655a292d857d.woff 0076dd.us-south.cf.appdomain.cloud/assets/faktpro/	0 0	157ms 156ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/faktpro/FaktCyrWeb-Normal-0038c5aa5c3243bb2995139e9aeb9519f62f098d0e0f7fab6c8b655a292d857d.woff Requested by Host: 0076dd.us-south.cf.appdomain.cloud URL: https://0076dd.us-south.cf.appdomain.cloud/?3095030sh048jdkkd9n488503095030sh048jdkkd9n488_defaultID=TMO-SDC@dbs.com&3095030sh048jdkkd9n488rMz-Bka2prZWtjaZpbHNm=5030Nu0-- Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f5e050d7bf Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	FaktGrkWeb-Normal-9e5daf8f10b7da71bbd3309ebb7c95657cf2e585986d1512700d1c1bec005507.woff 0076dd.us-south.cf.appdomain.cloud/assets/faktpro/	0 0	136ms 135ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/faktpro/FaktGrkWeb-Normal-9e5daf8f10b7da71bbd3309ebb7c95657cf2e585986d1512700d1c1bec005507.woff Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f5e050d95f Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	FaktGrkWeb-Medium-8eb863415ca103c7f90b369e54e6be4786c90c30a06ce32f3dca803206bf74dd.woff 0076dd.us-south.cf.appdomain.cloud/assets/faktpro/	0 0	177ms 177ms	Font text/html	169.47.124.23 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://0076dd.us-south.cf.appdomain.cloud/assets/faktpro/FaktGrkWeb-Medium-8eb863415ca103c7f90b369e54e6be4786c90c30a06ce32f3dca803206bf74dd.woff Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.23 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 17.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://0076dd.us-south.cf.appdomain.cloud/ Origin https://0076dd.us-south.cf.appdomain.cloud Response headers X-Backside-Transport FAIL FAIL Date Wed, 15 Apr 2020 08:29:41 GMT X-Global-Transaction-ID 291d64505e96c5f586d5c661 Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0076dd.us-south.cf.appdomain.cloud
0k938.us-south.cf.appdomain.cloud
dba-gmbh.de
169.47.124.23
5.35.225.166
04144ff30af747cd8f1d514555e22255070895829188eddba00cb3f76ad047f9
10602ce0673f667ee2aecb3a6778293618771f22bed2140cf05e1a3105500e0d
4269a9e0715f76ceb9acc55edbf2dca6109288671ea65eef592a1e92ccf1def2
79557239867cd4db115bdb3d1d77c08ae076ce61c0b8a2b5244c52425d4035fe
c3c9a5b43b3cb27aafbe95f48742fbd9e4f9d2717540d29cd40c193d09b1a8de
ca2440cd484f81dcdfd44832035d601260af802ddd454c0718c103971df75b3e
d2641dd643fe50a338957b04b0eb666df5bf4ec2f459d94549f470ac7b7a6c17

0076dd.us-south.cf.appdomain.cloud Open in urlscan Pro 169.47.124.23 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

390 kBTransfer

1205 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

Indicators

0076dd.us-south.cf.appdomain.cloud Open in urlscan Pro
169.47.124.23 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

390 kB
Transfer

1205 kB
Size

0
Cookies

8 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!