Submitted URL: https://tinyurl.com/47zbxmzk
Effective URL: https://www.netcracker.com/phishing-campaign.html
Submission: On June 19 via manual from IN — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 12 HTTP transactions. The main IP is 198.49.86.144, located in United States and belongs to NETCRACKER, US. The main domain is www.netcracker.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 22nd 2022. Valid for: a year.
This is the only time www.netcracker.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:10:... 13335 (CLOUDFLAR...)
10 198.49.86.144 26716 (NETCRACKER)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 13.210.61.248 16509 (AMAZON-02)
12 4
Apex Domain
Subdomains
Transfer
10 netcracker.com
www.netcracker.com
461 KB
1 amazonaws.com
awo0vrpjg3.execute-api.ap-southeast-2.amazonaws.com
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 771
30 KB
1 tinyurl.com
tinyurl.com — Cisco Umbrella Rank: 17588
537 B
12 4
Domain Requested by
10 www.netcracker.com www.netcracker.com
1 awo0vrpjg3.execute-api.ap-southeast-2.amazonaws.com code.jquery.com
1 code.jquery.com www.netcracker.com
1 tinyurl.com 1 redirects
12 4
Subject Issuer Validity Valid
www.netcracker.com
DigiCert TLS RSA SHA256 2020 CA1
2022-06-22 -
2023-07-23
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2022-08-03 -
2023-07-14
a year crt.sh
*.execute-api.ap-southeast-2.amazonaws.com
Amazon RSA 2048 M02
2023-02-10 -
2023-09-21
7 months crt.sh

This page contains 1 frames:

Primary Page: https://www.netcracker.com/phishing-campaign.html
Frame ID: 79866BE0528DBB3EDB09D1C6C4D9EF16
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Netcracker - Oops! You’ve been phished!

Page URL History Show full URLs

  1. https://tinyurl.com/47zbxmzk HTTP 301
    https://www.netcracker.com/phishing-campaign.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

492 kB
Transfer

1151 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://tinyurl.com/47zbxmzk HTTP 301
    https://www.netcracker.com/phishing-campaign.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request phishing-campaign.html
www.netcracker.com/
Redirect Chain
  • https://tinyurl.com/47zbxmzk
  • https://www.netcracker.com/phishing-campaign.html
71 KB
15 KB
Document
General
Full URL
https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
bf1d0074d83009e5b3fc6e1b361f48dccd753590aa1e8a93ff1977131ff7d773
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 19 Jun 2023 09:00:22 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=15
NC-Internal
yes
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
content-length
14254

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, public, s-max-age=900, stale-if-error: 86400
cf-cache-status
DYNAMIC
cf-ray
7d9a94c52a1d1c13-FRA
content-type
text/html; charset=UTF-8
date
Mon, 19 Jun 2023 09:00:21 GMT
location
https://www.netcracker.com/phishing-campaign.html
referrer-policy
unsafe-url
server
cloudflare
x-content-type-options
nosniff
x-tinyurl-redirect
eyJpdiI6ImhDNGo5b0g1NkMzZVRxa1FpRzNkV2c9PSIsInZhbHVlIjoiZTduWDhuRDdCVU9IeFNoZGlCV0NxVjZjTGRPRVltOG1rMnVuS2hEVytrUkthRnNLSlI2dkp6bGZaZGxkWE55Y29SRjZIRTM4V01ZaGYrdnJWUnJYb2c9PSIsIm1hYyI6ImUzMWEyODg3ZjZlMTdkNjg1OWU4NmM0OThiYTA2YjAxZGY5OTBmYmE3MjQyY2QxNjRiZDk2MjZjOWMxNTFmOTciLCJ0YWciOiIifQ==
x-xss-protection
1; mode=block
phishing-2.jpg
www.netcracker.com/assets/uploads/Badge/
52 KB
52 KB
Image
General
Full URL
https://www.netcracker.com/assets/uploads/Badge/phishing-2.jpg
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
3148c8528edf3c604ab067fbc4f64636142997e949de97d83cc58b3d42e123d7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Mon, 24 Oct 2022 06:45:44 GMT
Server
nginx
ETag
"63563498-d004"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
53252
example_1.png
www.netcracker.com/assets/uploads/Badge/
95 KB
96 KB
Image
General
Full URL
https://www.netcracker.com/assets/uploads/Badge/example_1.png
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
0547761cc5dd2c72f638ad8da5ee1d1ae9008dab36311c852b4ca1989d96929d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Thu, 08 Jun 2023 16:59:48 GMT
Server
nginx
ETag
"64820904-17d19"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
97561
example_2_2.png
www.netcracker.com/assets/uploads/Badge/
105 KB
105 KB
Image
General
Full URL
https://www.netcracker.com/assets/uploads/Badge/example_2_2.png
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
1f3f44b65466eab09e5d1fbb14920e34aa74559a58b894416f57421b66ef4721
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Fri, 09 Jun 2023 08:13:26 GMT
Server
nginx
ETag
"6482df26-1a3a9"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
107433
example_3.png
www.netcracker.com/assets/uploads/Badge/
75 KB
75 KB
Image
General
Full URL
https://www.netcracker.com/assets/uploads/Badge/example_3.png
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
8e8359287cdd10e3a976e0578b39919daebbf26e4e786a60b28b6875267d951f
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Thu, 08 Jun 2023 16:59:47 GMT
Server
nginx
ETag
"64820903-12a62"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
76386
jquery-3.6.0.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 19 Jun 2023 09:00:22 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 10:50:39 GMT
server
nginx
etag
W/"620cd6ff-15d9d"
vary
Accept-Encoding
x-hw
1687165222.dop236.am5.t,1687165222.cds117.am5.hn,1687165222.cds004.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
logo-white-n.svg
www.netcracker.com/assets/templates/v.3.0/img/
978 B
1 KB
Image
General
Full URL
https://www.netcracker.com/assets/templates/v.3.0/img/logo-white-n.svg
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
3f4f8ab5bf392ee69b0f431ec7230824b42c66e1783669f998c0ff01c63c3ffd
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Fri, 26 May 2023 09:20:08 GMT
Server
nginx
ETag
"647079c8-3d2"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
978
styles.css
www.netcracker.com/assets/templates/v.3.0/css/
613 KB
81 KB
Stylesheet
General
Full URL
https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/phishing-campaign.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
5d9f06de561eb75b4eb7593764e61370177fd623bcedfe078a8a0715a6f31c91
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/phishing-campaign.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:22 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Thu, 08 Jun 2023 11:07:07 GMT
Server
nginx
ETag
W/"6481b65b-9933e"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Keep-Alive
timeout=15
content-length
82590
netcracker-logo.svg
www.netcracker.com/assets/templates/v.3.0/img/
22 KB
6 KB
Image
General
Full URL
https://www.netcracker.com/assets/templates/v.3.0/img/netcracker-logo.svg
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
5eadb450890994abf325b1465ba99d599e8b990c6d8d21705224ab68c76e0798
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:23 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Thu, 01 Jun 2023 10:21:00 GMT
Server
nginx
ETag
W/"6478710c-5811"
Vary
Accept-Encoding
Content-Type
image/svg+xml
Connection
keep-alive
Keep-Alive
timeout=15
content-length
6116
truncated
/
685 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6772e2a2fccfdb77b7267865b754e888e82c399caf22754129ea6f913b9b0b0c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
223 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2cf8dad357884b2546724ca1f4e00679df7240f226c513aea71da527399000dd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/svg+xml
gibson.woff2
www.netcracker.com/assets/templates/v.3.0/fonts/gibson/600/
15 KB
15 KB
Font
General
Full URL
https://www.netcracker.com/assets/templates/v.3.0/fonts/gibson/600/gibson.woff2
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
ff7e0fd77fb3fef5305e56030f6060540f8f2d5e42ec6cddb3abba9238334160
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Referer
https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Origin
https://www.netcracker.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:23 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Tue, 21 Feb 2017 10:31:36 GMT
Server
nginx
ETag
"58ac1708-3a7c"
Content-Type
application/font-woff2
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
14972
gibson.woff2
www.netcracker.com/assets/templates/v.3.0/fonts/gibson/normal/
15 KB
15 KB
Font
General
Full URL
https://www.netcracker.com/assets/templates/v.3.0/fonts/gibson/normal/gibson.woff2
Requested by
Host: www.netcracker.com
URL: https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.49.86.144 , United States, ASN26716 (NETCRACKER, US),
Reverse DNS
Software
nginx /
Resource Hash
ea22b990ead275611b56dbd0022c36377fd547417d2ea38b3e8ae58b0973ca4a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Referer
https://www.netcracker.com/assets/templates/v.3.0/css/styles.css?v=3.0.150
Origin
https://www.netcracker.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 19 Jun 2023 09:00:23 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains
Last-Modified
Tue, 21 Feb 2017 10:31:35 GMT
Server
nginx
ETag
"58ac1707-3b34"
Content-Type
application/font-woff2
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
15156
caniphish-phish-response
awo0vrpjg3.execute-api.ap-southeast-2.amazonaws.com/default/
0
0
Script
General
Full URL
https://awo0vrpjg3.execute-api.ap-southeast-2.amazonaws.com/default/caniphish-phish-response?callback=jQuery36004947547655561546_1687165222643&_=1687165222644
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.210.61.248 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-210-61-248.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.netcracker.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery string| responseEndpoint boolean| signInCalled function| signIn function| redirectPage function| parseQuery string| uri

2 Cookies

Domain/Path Name / Value
.netcracker.com/ Name: PHPSESSID
Value: 49bddcf095187d6a21da08f7e8586731
www.netcracker.com/ Name: cookiesession1
Value: 678A8C36B8E9DF7EC7FBE12A795FA8A5

1 Console Messages

Source Level URL
Text
network error URL: https://awo0vrpjg3.execute-api.ap-southeast-2.amazonaws.com/default/caniphish-phish-response?callback=jQuery36004947547655561546_1687165222643&_=1687165222644
Message:
Failed to load resource: the server responded with a status of 500 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains