ghnrryfd.umb.market
Open in
urlscan Pro
172.67.73.61
Malicious Activity!
Public Scan
Submission: On February 04 via manual from SE — Scanned from SE
Summary
TLS certificate: Issued by GTS CA 1P5 on December 31st 2023. Valid for: 3 months.
This is the only time ghnrryfd.umb.market was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 172.67.73.61 172.67.73.61 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 172.67.69.26 172.67.69.26 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2.19.126.223 2.19.126.223 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
10 | 3 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-126-223.deploy.static.akamaitechnologies.com
community.akamai.steamstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
umb.market
ghnrryfd.umb.market |
252 KB |
2 |
umbrella.day
apishop.umbrella.day |
2 KB |
1 |
steamstatic.com
community.akamai.steamstatic.com — Cisco Umbrella Rank: 38587 |
2 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
7 | ghnrryfd.umb.market |
ghnrryfd.umb.market
|
2 | apishop.umbrella.day |
ghnrryfd.umb.market
|
1 | community.akamai.steamstatic.com | |
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
steamcommunity.com |
mail.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
umb.market GTS CA 1P5 |
2023-12-31 - 2024-03-30 |
3 months | crt.sh |
umbrella.day GTS CA 1P5 |
2023-12-15 - 2024-03-14 |
3 months | crt.sh |
cdn.akamai.steamstatic.com R3 |
2024-01-25 - 2024-04-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ghnrryfd.umb.market/
Frame ID: 8AD18366BC8900E356EA297A1350EBCF
Requests: 9 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: https://steamcommunity.com/
Search URL Search Domain Scan URL
Title: рвыапыва
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ghnrryfd.umb.market/ |
619 B 758 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.3b64a0ae.css
ghnrryfd.umb.market/static/css/ |
97 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
ghnrryfd.umb.market/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.0c6927bf.js
ghnrryfd.umb.market/static/js/ |
534 KB 152 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
shop
apishop.umbrella.day/ |
1 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
shop
apishop.umbrella.day/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
225.49e8e1cd.chunk.css
ghnrryfd.umb.market/static/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
225.6b50fdac.chunk.js
ghnrryfd.umb.market/static/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_steam.svg
community.akamai.steamstatic.com/public/shared/images/header/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Roboto-Regular.160d7a6ac26376e5e977.ttf
ghnrryfd.umb.market/static/media/ |
127 KB 68 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| __cfQR boolean| __cfRLUnblockHandlers object| webpackChunkshop object| pidCryptUtil0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apishop.umbrella.day
community.akamai.steamstatic.com
ghnrryfd.umb.market
172.67.69.26
172.67.73.61
2.19.126.223
19079730f2e875946de87e9a0c016becdb1a11e618c87feb9795bbe5dd180c15
3e3bc26f4e5546ddf7dd5d16e3568e06b7f30125a920fc29099c13b0ed324821
3f59433fd6945ed127c0c93046ef1161c81ac5bc2daa395729a86a05c9211d8f
40adfc0cf463947c2b164b3b879023b0424708761ab772e79ea8e63b018f7433
7277cfb805def6410f317129b8e1f78bdd47d1a4e24c233077d06e88a36e57ae
798561b6d48549363ca3cc27bfb614dc1869000c14028c8a165e437258b9eab0
c3a7c646a1305017f22423030cb5a12acc9f96b64013dcef7aeb80567b542cbb
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
e45a38ddbab2762fc4ed3296cd83cc0b72ce3001ea5b0929a516eae9186fa852