587015.playcode.io Open in urlscan Pro
85.143.219.160  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 587015.playcode.io/	41 KB 42 KB	113ms 86ms	Document text/html	85.143.219.160 TRADERSOFT
General Check archive.org Show headers Download Go to Full URL http://587015.playcode.io/ Protocol HTTP/1.1 Server 85.143.219.160 St Petersburg, Russian Federation, ASN201848 (TRADERSOFT, RU), Reverse DNS 49545.simplecloud.ru Software nginx/1.14.2 / Resource Hash 0a6a7364aa5fe600782ff1f3943c9752740a9bf2cd2275d1a2d57cfcfa2258d9 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host 587015.playcode.io Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx/1.14.2 Date Thu, 07 May 2020 04:47:24 GMT Content-Type text/html; charset=utf-8 Content-Length 42469 Connection keep-alive Access-Control-Allow-Origin * X-DNS-Prefetch-Control off Strict-Transport-Security max-age=15552000; includeSubDomains X-Download-Options noopen X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block ETag W/"a5e5-rNYezDFLuEaIDWEzYgmy+s4KQKI"
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/	86 KB 30 KB	21ms 21ms	Script application/javascript	2606:4700::6810:84e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: 587015.playcode.io URL: http://587015.playcode.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer http://587015.playcode.io/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 07 May 2020 04:47:24 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT age 24785979 status 200 alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 cf-request-id 028f0ec3cb0000d70db61ba200000001 served-in-seconds 0.003 timing-allow-origin * last-modified Wed, 01 May 2019 21:45:59 GMT server cloudflare etag W/"5cca1397-15851" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 cf-ray 58f84d7faea4d70d-FRA expires Tue, 27 Apr 2021 04:47:24 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cdd666bf866b3aaba311acc79ebc0b780690651c42bd14efc7228a373a9263a7 Request headers Referer http://587015.playcode.io/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	internt_web_technology-13-512.png cdn3.iconfinder.com/data/icons/internet-and-web-4/78/	9 KB 10 KB	62ms 38ms	Image image/webp	2606:4700:10::6816:92d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn3.iconfinder.com/data/icons/internet-and-web-4/78/internt_web_technology-13-512.png Requested by Host: 587015.playcode.io URL: http://587015.playcode.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:92d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 340731dede31f14fd399a1720ad8d768d3df2f37b4388631e02b7fac5cac38a5 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://587015.playcode.io/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 07 May 2020 04:47:24 GMT via 1.1 vegur x-content-type-options nosniff cf-cache-status HIT age 1064161 cf-polished origFmt=png, origSize=10424 status 200 content-disposition inline; filename="internt_web_technology-13-512.webp" vary Accept x-amz-request-id 29DB652A5DCD37E3 x-amz-id-2 qz8CNgh1Ut6GeqPNAKMV/RpWUH/Rgp3nTBM6Uu1jNxj8xI+vJWBnxzo8XSWQNQ3GDSkFzV7YlmI= accept-ranges bytes last-modified Mon, 16 Oct 2017 15:32:48 GMT server cloudflare etag "64b04190c66a7abb0b0c592543b8e990" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000; includeSubDomains; preload content-type image/webp access-control-allow-origin * expires Thu, 31 Dec 2037 23:55:55 GMT cache-control max-age=315360000 x-amz-version-id CnAxHP2qXzaWJkr5_3LKmXh53HPbs5l0 cf-request-id 028f0ec3e80000971600a57200000001 content-length 9082 cf-ray 58f84d7fdeda9716-FRA cf-bgj imgq:100,h2pri

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| startTimer function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

587015.playcode.io
cdn3.iconfinder.com
cdnjs.cloudflare.com
2606:4700:10::6816:92d
2606:4700::6810:84e5
85.143.219.160
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0a6a7364aa5fe600782ff1f3943c9752740a9bf2cd2275d1a2d57cfcfa2258d9
340731dede31f14fd399a1720ad8d768d3df2f37b4388631e02b7fac5cac38a5
cdd666bf866b3aaba311acc79ebc0b780690651c42bd14efc7228a373a9263a7