y6a.9rzspe.asia
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Effective URL: https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07
Submission: On June 25 via api from US — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on April 27th 2024. Valid for: 3 months.
This is the only time y6a.9rzspe.asia was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
6 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.144.186 172.67.144.186 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.134.112 172.67.134.112 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 5 |
ASN13335 (CLOUDFLARENET, US)
y6a.9rzspe.asia | |
wev.gub8ps.asia | |
tongji.f55ur.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
9rzspe.asia
1 redirects
y6a.9rzspe.asia |
25 KB |
6 |
563cdn.com
563cdn.com |
253 KB |
2 |
f55ur.top
tongji.f55ur.top |
2 KB |
1 |
lka3m6.asia
wes.lka3m6.asia |
34 KB |
1 |
gub8ps.asia
wev.gub8ps.asia |
34 KB |
1 |
9tnjqa.asia
sefww.9tnjqa.asia |
34 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381 |
31 KB |
19 | 7 |
Domain | Requested by | |
---|---|---|
8 | y6a.9rzspe.asia |
1 redirects
y6a.9rzspe.asia
|
6 | 563cdn.com |
y6a.9rzspe.asia
|
2 | tongji.f55ur.top |
y6a.9rzspe.asia
tongji.f55ur.top |
1 | wes.lka3m6.asia |
cdn.jsdelivr.net
|
1 | wev.gub8ps.asia |
cdn.jsdelivr.net
|
1 | sefww.9tnjqa.asia |
cdn.jsdelivr.net
|
1 | cdn.jsdelivr.net |
y6a.9rzspe.asia
|
19 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
9rzspe.asia GTS CA 1P5 |
2024-04-27 - 2024-07-26 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
563cdn.com E5 |
2024-06-08 - 2024-09-06 |
3 months | crt.sh |
9tnjqa.asia E1 |
2024-04-27 - 2024-07-26 |
3 months | crt.sh |
gub8ps.asia GTS CA 1P5 |
2024-04-27 - 2024-07-26 |
3 months | crt.sh |
lka3m6.asia GTS CA 1P5 |
2024-04-27 - 2024-07-26 |
3 months | crt.sh |
f55ur.top GTS CA 1P5 |
2024-05-28 - 2024-08-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07
Frame ID: DD4C8A9F7BEB0A3FBACCCE86B51A78C3
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Om de eurocup van 2024 te vieren, biedt Whatsapp 48 GB gratis mobiele oplaadplannen aan!Page URL History Show full URLs
-
http://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07
HTTP 307
https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 Page URL
-
https://y6a.9rzspe.asia/cdn-cgi/phish-bypass?atok=xXQYgIJaF8uMb83apT9HTIrHS1R0yhEO2lDRRbDaAsY-171927...
HTTP 301
https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07
HTTP 307
https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 Page URL
-
https://y6a.9rzspe.asia/cdn-cgi/phish-bypass?atok=xXQYgIJaF8uMb83apT9HTIrHS1R0yhEO2lDRRbDaAsY-1719276087-0.0.1.1-%2F%3Fbsa%3D23833e2bfae5ab3b8fe56bf888a16c07
HTTP 301
https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 HTTP 307
- https://y6a.9rzspe.asia/?bsa=23833e2bfae5ab3b8fe56bf888a16c07
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
y6a.9rzspe.asia/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
y6a.9rzspe.asia/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
y6a.9rzspe.asia/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
y6a.9rzspe.asia/ |
1 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
y6a.9rzspe.asia/ Redirect Chain
|
59 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdn.jsdelivr.net/npm/jquery@2.2/dist/ |
84 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
33a42539862492a9b9f70be8aa26cb76.jpg
563cdn.com/images/ |
207 KB 207 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
731dc2e5fc432602bc43b111af3d1da5.jpg
563cdn.com/images/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bea8090884dc191ea6ee9c484b3e006b.png
563cdn.com/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
043275da874a0f94c8bccbac355568b4.png
563cdn.com/images/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24809f1e14d9da543335dc14901ccdcc.jpg
563cdn.com/images/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
46b74b52fb18656c5c1c6494c27e41eb.png
563cdn.com/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
single.php
y6a.9rzspe.asia/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
sefww.9tnjqa.asia/js/ |
85 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
wev.gub8ps.asia/js/ |
85 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
wes.lka3m6.asia/js/ |
85 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
tongji.f55ur.top/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
event
tongji.f55ur.top/api/ |
2 B 510 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
y6a.9rzspe.asia/ |
1 KB 0 |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| system string| p function| set_Cookie function| get_Cookie function| $ function| jQuery function| prevent string| ad1 string| ad2 string| ad3 function| randomString number| madInt function| hh object| DOMString object| objServer function| deadline function| enviar function| tip_text function| messageToSend number| counter number| counter2 number| seconds function| plausible3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.y6a.9rzspe.asia/ | Name: __cf_mw_byp Value: xXQYgIJaF8uMb83apT9HTIrHS1R0yhEO2lDRRbDaAsY-1719276087-0.0.1.1-/?bsa=23833e2bfae5ab3b8fe56bf888a16c07 |
|
y6a.9rzspe.asia/ | Name: loclang Value: nl |
|
y6a.9rzspe.asia/ | Name: jdomains Value: wev.gub8ps.asia |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
563cdn.com
cdn.jsdelivr.net
sefww.9tnjqa.asia
tongji.f55ur.top
wes.lka3m6.asia
wev.gub8ps.asia
y6a.9rzspe.asia
172.67.134.112
172.67.144.186
188.114.97.3
2a04:4e42::485
2a06:98c1:3121::3
021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
37304fb9977499cb72781c602ede306064e411be48f7891be4d598241a6d8649
3c5a6b3b54d555d6aba05bdcb30488c17c89e036ec82fb1d5c8096a06a10b294
5677c88c0edb99b6b5a3c338e79b7bc176d74434facc65fb55d8d128389ec8cb
5b4a071607d5b85b5a870cd7a88dd4ef025ea98152a976481a890a9a021df4c4
831dc424503c5f3dc1494b7b8faafb2071fae561401f6f131bc302e77a73e9c4
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
a4ee0f5d810383d5fae94088f2dce872d7dfbac5f7a2e3250a49e26769b128b2
ab275fa6f77eda89d1c4416cbb7f825c7e44d923cf0fe29ed2e7dd3def44105b
ae04a5c8da1f1bdcb311885521dc733e5f62b015f5c248cef194485e0b8fd7df
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fb0d359f799d305671ad77c252c6e253afed28ed4a19259bd084e0e2f40079de
ff1f26fc70eb3eb43ad295f98d05a53bcb863e27ecb5762a007aafdaa041ece6