robloxthong.pages.dev
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://robloxthong.pages.dev/
Submission: On March 19 via api from US — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on March 18th 2023. Valid for: 3 months.
This is the only time robloxthong.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.96.187.226 172.96.187.226 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC) | |
1 | 146.75.116.193 146.75.116.193 | 54113 (FASTLY) (FASTLY) | |
15 | 5 |
ASN32475 (SINGLEHOP-LLC, US)
PTR: 172.96.187.226-static.reverse.arandomserver.com
mtevor.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
pages.dev
1 redirects
robloxthong.pages.dev |
75 KB |
1 |
imgur.com
i.stack.imgur.com — Cisco Umbrella Rank: 10522 |
9 KB |
1 |
mtevor.com
mtevor.com |
896 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34 |
965 B |
0 |
wellter.de
Failed
bux.wellter.de Failed |
|
15 | 5 |
Domain | Requested by | |
---|---|---|
12 | robloxthong.pages.dev |
1 redirects
robloxthong.pages.dev
|
1 | i.stack.imgur.com | |
1 | mtevor.com |
robloxthong.pages.dev
|
1 | fonts.googleapis.com |
robloxthong.pages.dev
|
0 | bux.wellter.de Failed |
mtevor.com
|
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.robloxthong.pages.dev GTS CA 1P5 |
2023-03-18 - 2023-06-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-02 - 2023-05-25 |
3 months | crt.sh |
mtevor.com R3 |
2023-02-03 - 2023-05-04 |
3 months | crt.sh |
i.stack.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2022-10-12 - 2023-10-12 |
a year | crt.sh |
This page contains 1 frames:
Frame:
https://bux.wellter.de/index.html?source=cs
Frame ID: 56A522D0F882049E6CA835382A0894F6
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://robloxthong.pages.dev/
HTTP 307
https://robloxthong.pages.dev/ Page URL
-
https://robloxthong.pages.dev/cdn-cgi/phish-bypass?atok=178wnkx3ruGFO8QYQxE6kJaf4kuC5eAugR0AHQsuswE-167920...
HTTP 301
https://robloxthong.pages.dev/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://robloxthong.pages.dev/
HTTP 307
https://robloxthong.pages.dev/ Page URL
-
https://robloxthong.pages.dev/cdn-cgi/phish-bypass?atok=178wnkx3ruGFO8QYQxE6kJaf4kuC5eAugR0AHQsuswE-1679205204-0-%2F
HTTP 301
https://robloxthong.pages.dev/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://robloxthong.pages.dev/ HTTP 307
- https://robloxthong.pages.dev/
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
robloxthong.pages.dev/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
robloxthong.pages.dev/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
robloxthong.pages.dev/cdn-cgi/images/ |
452 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
robloxthong.pages.dev/ Redirect Chain
|
28 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
robloxthong.pages.dev/wp-content/plugins/wp-random-post-inside//css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dashicons.min.css
robloxthong.pages.dev/wp-includes/css/ |
58 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.min.css
robloxthong.pages.dev/wp-includes/css/dist/block-library/ |
77 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 965 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
robloxthong.pages.dev/wp-content/themes/iconic-one/ |
38 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
custom.css
robloxthong.pages.dev/wp-content/themes/iconic-one/ |
69 B 593 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
arpw-frontend.css
robloxthong.pages.dev/wp-content/plugins/advanced-random-posts-widget/assets/css/ |
275 B 681 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roblox.js
mtevor.com/cluster-static/ |
1 KB 896 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
selectnav.js
robloxthong.pages.dev/wp-content/themes/iconic-one/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
index.html
bux.wellter.de/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
h6viz.gif
i.stack.imgur.com/ |
9 KB 9 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bux.wellter.de
- URL
- https://bux.wellter.de/index.html?source=cs
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.robloxthong.pages.dev/ | Name: __cf_mw_byp Value: 178wnkx3ruGFO8QYQxE6kJaf4kuC5eAugR0AHQsuswE-1679205204-0-/ |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bux.wellter.de
fonts.googleapis.com
i.stack.imgur.com
mtevor.com
robloxthong.pages.dev
bux.wellter.de
146.75.116.193
172.96.187.226
2a00:1450:4001:82a::200a
2a06:98c1:3120::3
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
11af2548da80acbbbf50e135461aef077f75f4b0145cb46dcb4ba3b045983a6f
14b9bdc15584540d4e072ff690279f5bc8b15df337b227115bb12af5acb2c704
2491fb8dcef57ce25a10ab818dcbbaf55f3f9fc609223991eababbd58a7fbf34
37ca9a4ef271f1f315ede7bca42c0bd3a05692ec97053cbf9f3e7ea69eb16e45
387b160853ac745a823784df8b45b28f35670b19183a76dd64d15ad11bea9273
49bdec568a08f644667ee4c6e765c3dd1f452dab912d5dfb1f42bd34c0f03708
7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2
c097810c5c2818c403e04fffc03a639cde42bdecb0c53323119cd7f77f8394fa
e74842c2ffbcbdf5e77eba8e6b1a458586d9ec0653c6d0d818fc1e48548a15a6
f0c0e663b80a4b571fa819b92e6827f7c470ba3720079e33fc1158ec7e18d22b
f10e353945c670f4268c7df6818b1acf560e4a5c3e65213896695557c5405808
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016