carousellprotect.shop Open in urlscan Pro
2606:4700:3030::6815:30ad  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 5524394 Show response carousellprotect.shop/bank/	179 KB 23 KB	529ms 484ms	Document text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 73ccd0035e4d63477f31fede1ccbf5e00be8a2cbd941b815b4e01e935f8a89e3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 77b25965f8e0694f-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 17 Dec 2022 20:18:40 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzm33MUd9wPiakR8ZTbz7uNgQzUHf3TFRxK2rxLh0XqM5LVIC2PSh8Y%2FLpV7VK8fxuzZQXRpAAkjh%2B84xIROcykmmt%2B4lqhrqaKczMWUebvjs%2Bmb%2BVsK50A0kFqFlEi5vMPJjBVo%2FZy48sYMwW%2FRzwu19v8%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	695 B 965 B	106ms 42ms	Stylesheet text/css	2a00:1450:400d:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 9b372451011be8221ecc9c1cf7b596f34131ad62e783c970379903d20bcb5cf0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Sat, 17 Dec 2022 20:18:40 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sat, 17 Dec 2022 20:18:40 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 17 Dec 2022 20:18:40 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.4.1/	86 KB 31 KB	102ms 21ms	Script text/javascript	2a00:1450:400d:80a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80a::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 18:31:07 GMT content-encoding gzip x-content-type-options nosniff age 6453 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30774 x-xss-protection 0 last-modified Mon, 13 May 2019 14:37:17 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 17 Dec 2023 18:31:07 GMT
GET H2	200	jquery.maskedinput.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/	10 KB 3 KB	58ms 36ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/jquery.maskedinput.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 174460 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 2306 last-modified Mon, 04 May 2020 16:11:47 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec3-284d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nz71jCxUcUE2uDN57%2B8UUSYF2%2FOAiVsZVbAWQQq7y2Z8V3Jd%2FHiNGYC10duPWU8m5pxCp1S1t0jcE83CmlQ9%2B5NIUqHhsGngYngEto8RwCkpWLuL2xapkCl8rwwGf5rWM%2FhmgROjrB9XEfo3FNfYL42v"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 77b2596929d19066-FRA expires Thu, 07 Dec 2023 20:18:40 GMT
GET H2	500	3-31dee1aa40.js carousellprotect.shop/bank/check_banks_files/	0 0	135ms 134ms	Script text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/bank/check_banks_files/3-31dee1aa40.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://carousellprotect.shop/bank/5524394? Origin https://carousellprotect.shop accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H8FkChTXWVzBw2ofJw%2Fwnndhsi9wq5RFiSTuwZcSntVuFWDzr0EwcYDDtPweflW5IaZDiitZRZo1741BNlfplg3YnYjS%2FwZp0MAJO%2Ba8lGm5D0Rti%2BaabEy3KFv0P%2B98Yz3bv1uKtehgCi%2F0J1mUByyji5o%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b259690fad694f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	500	1-31dee1aa40.js carousellprotect.shop/bank/check_banks_files/	0 0	138ms 137ms	Script text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/bank/check_banks_files/1-31dee1aa40.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://carousellprotect.shop/bank/5524394? Origin https://carousellprotect.shop accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cVCiALAGvjUq8o0MriL2PvzNNYjkkjmMVP8NKXjn9X6szXRKvXERSiji5SGPXzfrU3y6vQ3CsR6wYv35FyVk3s0Fy8eEdDda48JeAsWYxjCSjSyMGiz7fpTxpucg1Zec3Ldf0jM46Mp1cj6qoWUwEf3q4SY%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b259690fb1694f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	500	2-31dee1aa40.js carousellprotect.shop/bank/check_banks_files/	0 0	162ms 161ms	Script text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/bank/check_banks_files/2-31dee1aa40.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://carousellprotect.shop/bank/5524394? Origin https://carousellprotect.shop accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aFRANY8IAHJaRBl7q9F9rxhxHGMM%2Bo3dmQ8jklR79p5lT%2FwcChrnFKWM%2FLSW%2B4GSfllpqWnVzdoR9lPwR9RnsihoeopzNOHXoDZA64WsiDFovucv6%2FWODbSBlme60JSSxsiNHkM2u90SjFTIngjiYBM8vYA%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b259690fb5694f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	desktoplogo.png internet-banking.dbs.com.sg/IB/dbs/images/	5 KB 6 KB	450ms 230ms	Image image/webp	104.18.7.118 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://internet-banking.dbs.com.sg/IB/dbs/images/desktoplogo.png Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.18.7.118 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8fde3b7e7614c23b342d70797d7c1597b6955639d3422040d800051101c842fb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 91029 cf-polished origFmt=png, origSize=11903 cf-cache-ttl 604800 cf-forward-origin-host origin2-internet-banking.dbs.com.sg content-disposition inline; filename="desktoplogo.webp" content-length 5592 x-xss-protection 1; mode=block pragma public last-modified Tue, 06 Dec 2022 10:12:54 GMT cf-bgj imgq:100,h2pri server cloudflare etag W/"11903-1670321574000" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/webp access-control-allow-origin https://internet-banking.dbs.com.sg/ cache-control max-age=604800,public cf-forward-uri-path https://internet-banking.dbs.com.sg/IB/dbs/images/desktoplogo.png accept-ranges bytes cf-ray 77b2596b68365b4a-FRA
GET H/1.1	200 OK	UOB_Logo.svg www.uobgroup.com/assets/iwov-resources/assets/BrandAssets/	3 KB 3 KB	1319ms 204ms	Image image/svg+xml	122.152.164.133 ASN-TELSTRA-GLOBA...
General Check archive.org Show headers Download Go to Show image Full URL https://www.uobgroup.com/assets/iwov-resources/assets/BrandAssets/UOB_Logo.svg Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 122.152.164.133 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK), Reverse DNS ip-122-152-164-133.asianetcom.net Software / Resource Hash 139bed79c5409437b22b737603686cebc1fd627796f09cb02208f4b2bec8da39 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.uob.com.sg *.uobgroup.com *.uobgroup.com.sg http://uob.eltropy.com https://uob.eltropy.com http://findahomeloan.co https://www.edgeprop.sg https://sleek.sg Strict-Transport-Security max-age=35000000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1 Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Sat, 17 Dec 2022 20:18:41 GMT Strict-Transport-Security max-age=35000000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' *.uob.com.sg *.uobgroup.com *.uobgroup.com.sg http://uob.eltropy.com https://uob.eltropy.com http://findahomeloan.co https://www.edgeprop.sg https://sleek.sg Last-Modified Wed, 07 Sep 2022 03:35:38 GMT X-Permitted-Cross-Domain-Policies none X-Frame-Options SAMEORIGIN Content-Type image/svg+xml Cache-Control max-age=1209600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 2619 X-XSS-Protection 1
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	1579ms 1509ms	Script application/javascript	2001:4de0:ac18::1:a:1b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT content-encoding gzip last-modified Fri, 12 Aug 2022 13:47:02 GMT server nginx etag W/"62f659d6-15851" vary Accept-Encoding x-hw 1671308320.dop011.fr8.t,1671308320.cds153.fr8.hn,1671308320.cds236.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H3	200	5524394 Show response carousellprotect.shop/chat/ Frame D8DA	57 KB 12 KB	90ms 90ms	Document text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/chat/5524394 Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e996bbc17303701514234ceebfcfb542470fc673a12eea8ec007d30a35877d0f Request headers Referer https://carousellprotect.shop/bank/5524394? Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 77b2596a1ad78fd6-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 17 Dec 2022 20:18:40 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zaj%2BYHGj94X1Y23E0LXwMENDp0RxBvX46VkeIAeMbAneTpw7pIZYm9tJ02T86zI%2FfMwccNM1WuXswRCJvcD6ng%2Bm28YEjES%2Fi05Zat1p60EqytVY9RZLFxm%2BpaOl8wQkoc6r8gCYQys9jQCODuJq5g188nU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	kJF1BvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oDMzByHX9rA6RzaxHMPdY43zj-jCxv3fzvRNU22ZXGJpEpjC_1v-p_4MrImHCIJIZrDCvHOej.woff2 fonts.gstatic.com/s/materialsymbolsoutlined/v75/	214 KB 215 KB	96ms 21ms	Font font/woff2	2a00:1450:400d:80c::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/materialsymbolsoutlined/v75/kJF1BvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oDMzByHX9rA6RzaxHMPdY43zj-jCxv3fzvRNU22ZXGJpEpjC_1v-p_4MrImHCIJIZrDCvHOej.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80c::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0bae88b602dc9e53eb07c63ce1070476d2bd16b87b21e3a4baa8f8e5dbe1cd34 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://carousellprotect.shop accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 15 Dec 2022 01:41:41 GMT x-content-type-options nosniff age 239819 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 219164 x-xss-protection 0 last-modified Wed, 07 Dec 2022 17:31:23 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 15 Dec 2023 01:41:41 GMT
GET H3	404	Roboto-Regular-18d44f79b3.ttf carousellprotect.shop/	0 0	123ms 123ms	Font text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/Roboto-Regular-18d44f79b3.ttf Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/bank/5524394? Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://carousellprotect.shop/bank/5524394? Origin https://carousellprotect.shop accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mxq78ZI7jr56HI%2BBSur0XdbvTTXtipUf%2BfWXLPvhnK8avt3VTY3ajoyyHMmojgOqNB0Ok5SeSp%2FwT0hB2%2FlyU0FhQjihb3E1PmsK%2Fk%2BXNZTyqtcmmOgbSyqTKFUtbGF4Tz%2FxlIj0mUrbesqIW6LXbPmh6XE%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 77b2596a2af98fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/ Frame D8DA	86 KB 30 KB	1495ms 1495ms	Script application/javascript	2001:4de0:ac18::1:a:1b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: carousellprotect.shop URL: https://carousellprotect.shop/chat/5524394 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language de-DE,de;q=0.9 Referer https://carousellprotect.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:40 GMT content-encoding gzip last-modified Fri, 12 Aug 2022 13:47:02 GMT server nginx etag W/"62f659d6-15851" vary Accept-Encoding x-hw 1671308320.dop011.fr8.t,1671308320.cds153.fr8.hn,1671308320.cds236.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H3	200	chat.php Show response carousellprotect.shop/ Frame D8DA	426 B 643 B	77ms 77ms	XHR text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/chat.php?api=true&chat_id=5524394&getMessages=true Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2497e104a92ff08ab6d96a4346d670e22b22d574471357738edb773f7eec1573 Request headers Accept */* Referer https://carousellprotect.shop/chat/5524394 X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:42 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JO6xvtVXkcR2fTqG2er6wE7cLuuQoxdnIz04sbmFRv8XnYDNMTX40auEMWWUVZJUerUtYS3oLezbAX3G8NeXdWYPm6xmg0MxjOVtea6Z0i6NQwXP9Htq%2BcT0L%2FmQWfhGqaXivAL1ZP6rmST1ju6bxBqYKUM%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b259746f848fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	newMsg.php Show response carousellprotect.shop/	5 B 456 B	123ms 122ms	XHR text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/newMsg.php?page_id=5524394&page=bank Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa Request headers Accept */* Referer https://carousellprotect.shop/bank/5524394? X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:43 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qs5v1o9yrgBU%2B9GXW%2B6mi88%2Fj%2FrimQqN%2FZUmru7E84drFHaFuGpnU9YWwHa3dwjfScOE6oLcUaKYr8YzQ6Y6ZbkTCpkFkt1ymhYd456lyf7RpDdUThggQPgZ%2B%2FJrXCTw5umJDtdkbVFuW8%2BRo31txawH%2F0Y%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b2597aac6a8fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	newMsg.php Show response carousellprotect.shop/	5 B 460 B	136ms 135ms	XHR text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/newMsg.php?page_id=5524394&page=bank Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa Request headers Accept */* Referer https://carousellprotect.shop/bank/5524394? X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:44 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ejHENbFEW%2FYujxfaIt6CgNjx%2F%2BEnoBlC4ugoE4RMorIcZXIIYykVaYEpUTTFu1XMDqSdkWp1E%2Btz0U5iLRH%2B9D59wYIoQ4%2F%2BClmV0CR8Eou8d4lIr2TZSk%2FR8%2BwyQUo0Gc8jIta9V%2Fqd%2BdVZxrnV9Xmnob4%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b25980e9408fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	newMsg.php Show response carousellprotect.shop/	5 B 450 B	98ms 97ms	XHR text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/newMsg.php?page_id=5524394&page=bank Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa Request headers Accept */* Referer https://carousellprotect.shop/bank/5524394? X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:45 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gq7%2BZfrrQvmNnEjdniFDAciNC1N2lJ%2BucNFoybeacv2YeN%2F46EDmFGMccP6h7rfj7Brqz3idNMacvUihV9x47qCvMYXsT2v4GelheOd1Iia95MfEcGTDckFyko9Aos9gkp21DZh%2FgKaP58DzM%2Ff%2BRjKIkuM%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b259872c678fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	newMsg.php Show response carousellprotect.shop/	5 B 454 B	93ms 92ms	XHR text/html	2606:4700:3030::6815:30ad CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://carousellprotect.shop/newMsg.php?page_id=5524394&page=bank Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.4.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:30ad , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa Request headers Accept */* Referer https://carousellprotect.shop/bank/5524394? X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sat, 17 Dec 2022 20:18:46 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K0%2BaLaIBoPloORf8OkJMjv0FMTClmTqTXkuzHYoz6zBeyORhRzkEpT%2F6daig%2FOfOsr7ThFL8uQVlLj5VPX4xpDmB5r2Uq0qev7CFWyC5iIlWZLG1%2BxapgMiXNdJC%2Fegpy%2BTOQxxm1n3YnWjJzRRykQZZtjY%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 77b2598d68818fd6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DBS Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange function| $ function| jQuery function| selectbank function| init function| updateStatus function| openForm function| closeForm string| currentStatus

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://carousellprotect.shop/bank/check_banks_files/3-31dee1aa40.js Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://carousellprotect.shop/bank/check_banks_files/1-31dee1aa40.js Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://carousellprotect.shop/bank/check_banks_files/2-31dee1aa40.js Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://carousellprotect.shop/Roboto-Regular-18d44f79b3.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
carousellprotect.shop
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
internet-banking.dbs.com.sg
www.uobgroup.com
104.18.7.118
122.152.164.133
2001:4de0:ac18::1:a:1b
2606:4700:3030::6815:30ad
2606:4700::6811:190e
2a00:1450:400d:80a::200a
2a00:1450:400d:80c::2003
2a00:1450:400d:80c::200a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0bae88b602dc9e53eb07c63ce1070476d2bd16b87b21e3a4baa8f8e5dbe1cd34
139bed79c5409437b22b737603686cebc1fd627796f09cb02208f4b2bec8da39
2497e104a92ff08ab6d96a4346d670e22b22d574471357738edb773f7eec1573
73ccd0035e4d63477f31fede1ccbf5e00be8a2cbd941b815b4e01e935f8a89e3
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
8fde3b7e7614c23b342d70797d7c1597b6955639d3422040d800051101c842fb
9b372451011be8221ecc9c1cf7b596f34131ad62e783c970379903d20bcb5cf0
e996bbc17303701514234ceebfcfb542470fc673a12eea8ec007d30a35877d0f
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa