uaa.y5cz7w.top Open in urlscan Pro
2606:4700:3035::ac43:9662  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response uaa.y5cz7w.top/	1 KB 1 KB	879ms 396ms	Document text/html	2606:4700:3035::ac43:9662 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uaa.y5cz7w.top/ Protocol HTTP/1.1 Server 2606:4700:3035::ac43:9662 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b60b1adafcf561ad318c14b257a77fabf971c8a71516c87d3c94771cde69c54 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 81c1661c7fac4dcd-FRA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 26 Oct 2023 08:41:12 GMT Last-Modified Thu, 26 Oct 2023 08:36:49 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=khMNjWFOruaLx%2FPNr5BpKDuv1hceGjG5zEoqlANKBZ4pIE7UopgLf6XPMgGE69%2FvCktliITIAY0exsHwDoJGGHKy91sFzJS5lcOJTuiq492QgvoY3z0a%2B7aVd6P%2BzvTMoahnzy7oaGUon4mK9w%3D%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	chunk-vendors.d25f0563.css uaa.y5cz7w.top/css/	235 KB 46 KB	584ms 584ms	Stylesheet text/css	2606:4700:3035::ac43:9662 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uaa.y5cz7w.top/css/chunk-vendors.d25f0563.css Requested by Host: uaa.y5cz7w.top URL: http://uaa.y5cz7w.top/ Protocol HTTP/1.1 Server 2606:4700:3035::ac43:9662 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1bebba22cabbfd8e999e53d35ecb55b8cb82a9e928eed9ed10f9160ba1154e45 Request headers accept-language de-DE,de;q=0.9 Referer http://uaa.y5cz7w.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Thu, 26 Oct 2023 08:41:13 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Mon, 23 Oct 2023 12:56:09 GMT Server cloudflare ETag W/"65366d69-3adcc" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oHjszgCBt%2Fi0v1nKAjfTwg0AzztIJfCbLEaQ%2BoUcHm9GVic9B2RH0JQ9QJfk%2F%2FS2aFPNRsf90%2BfNKoDlf8k9f2%2FVPsKHNx%2B4kxDpRzXqm6sEgrKceeeJYPgHgp3GQHMQsYMTmON10uDPJzcfxQ%3D%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/css Cache-Control max-age=43200 CF-RAY 81c1661efabf4dcd-FRA Expires Thu, 26 Oct 2023 20:41:13 GMT
GET H/1.1	200 OK	jquery.min.js Show response cdn.staticfile.org/jquery/1.10.2/	91 KB 33 KB	2470ms 894ms	Script application/javascript	240e:914:500c:2:3::3f6 CHINANET-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js Requested by Host: uaa.y5cz7w.top URL: http://uaa.y5cz7w.top/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 240e:914:500c:2:3::3f6 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN), Reverse DNS Software Tengine / Resource Hash 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Request headers accept-language de-DE,de;q=0.9 Referer http://uaa.y5cz7w.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers X-Log X-Log Date Wed, 25 Oct 2023 16:58:17 GMT Via cache45.l2cn3125[0,0,304-0,H], cache58.l2cn3125[1,0], ens-vcache11.cn5582[0,0,200-0,H], ens-vcache8.cn5582[2,0] Content-Encoding gzip X-Svr IO X-Reqid mV8AAADPM60xaJEX Age 56578 X-Swift-CacheTime 86378 X-Cache HIT TCP_MEM_HIT dirn:9:282701906 Content-Transfer-Encoding binary Content-Disposition inline; filename="jquery.min.js"; filename*=utf-8''jquery.min.js Connection keep-alive X-Swift-SaveTime Wed, 25 Oct 2023 16:58:39 GMT Content-Length 32989 Last-Modified Tue, 16 Feb 2016 04:22:54 GMT Server Tengine Etag "FuLzYD4jcR9kRvJ4pBHZBWI9ZSAe.gz" Access-Control-Max-Age 2592000 Ali-Swift-Global-Savetime 1698253097 Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers X-Log, X-Reqid Cache-Control public, max-age=31536000 Vary Accept-Encoding Accept-Ranges bytes X-Qiniu-Zone 0 Timing-Allow-Origin * EagleId 7ce1269c16983096751278118e
GET H/1.1	200 OK	chunk-vendors.ba4f7857.js Show response uaa.y5cz7w.top/js/	957 KB 310 KB	775ms 768ms	Script application/javascript	2606:4700:3035::ac43:9662 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uaa.y5cz7w.top/js/chunk-vendors.ba4f7857.js Requested by Host: uaa.y5cz7w.top URL: http://uaa.y5cz7w.top/ Protocol HTTP/1.1 Server 2606:4700:3035::ac43:9662 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15839ac8d3105d4fd9fe7942ef8c7eaa232878e0c965b01d5e35ef08bcc67678 Request headers accept-language de-DE,de;q=0.9 Referer http://uaa.y5cz7w.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Thu, 26 Oct 2023 08:41:13 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Mon, 23 Oct 2023 13:29:04 GMT Server cloudflare ETag W/"65367520-ef320" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HgYN0uczb8mFR%2Fcig5ttvnarB0307PU6rV5xnCkDAnZ9jZpdiKA14U8yRHPUrTJIZBPCkty7hlW%2BTjAD%2FPc4WdoVRhW%2FLgqz%2BNBr9tWgBvMhpMo4b%2Bn8jSH4rNPBs%2Bug7QvppVdryr9Obd5b8g%3D%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript Cache-Control max-age=43200 CF-RAY 81c1661f0bad2c36-FRA Expires Thu, 26 Oct 2023 20:41:13 GMT
GET H/1.1	200 OK	web.06bfce35.js Show response uaa.y5cz7w.top/js/	23 KB 10 KB	404ms 398ms	Script application/javascript	2606:4700:3035::ac43:9662 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uaa.y5cz7w.top/js/web.06bfce35.js?ver=1.22 Requested by Host: uaa.y5cz7w.top URL: http://uaa.y5cz7w.top/ Protocol HTTP/1.1 Server 2606:4700:3035::ac43:9662 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67926048a61ab5e6d03a8b5f68feb2cea26b2672e2a9d7d689b57ee71c83b9d5 Request headers accept-language de-DE,de;q=0.9 Referer http://uaa.y5cz7w.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Date Thu, 26 Oct 2023 08:41:13 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Wed, 25 Oct 2023 14:02:43 GMT Server cloudflare ETag W/"65392003-5ab4" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lwwHcwIheZ%2BlSHajGQSTyjKvBJZrcW87hW57%2FIyHDVSR2e291hih1ynvKvCTDoh7Q%2B%2BlS7XNqeMvdwJNWB5pv1ZpNSqm9SXm8dNizukCNbJdPrb6qc0zGwat%2Bi4N9lLW6%2FkbhTsyExtrO0tH8Q%3D%3D"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript Cache-Control max-age=43200 CF-RAY 81c1661f0dd21cab-FRA Expires Thu, 26 Oct 2023 20:41:13 GMT
POST H/1.1	200 OK	fk.php Show response uaa.y5cz7w.top/	7 B 688 B	390ms 389ms	XHR text/html	2606:4700:3035::ac43:9662 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uaa.y5cz7w.top/fk.php Requested by Host: cdn.staticfile.org URL: https://cdn.staticfile.org/jquery/1.10.2/jquery.min.js Protocol HTTP/1.1 Server 2606:4700:3035::ac43:9662 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2cb4b1431b84ec15d35ed83bb927e27e8967d75f4bcd9cc4b25c8d879ae23e18 Request headers Accept */* Referer http://uaa.y5cz7w.top/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 26 Oct 2023 08:41:15 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZRkgt1pUeV2zVNB4QzopY3TR09a6pKXKpsKiL%2BZQRtcFwWmn62BG7hDMrHl5Ld0qADYMxZ9JBgkyHxfHJpov2V6cTLiXW%2BfRPsoQfWE89BC7v4IYTsuDnNtYLv9jDXkJM%2FB7Nb5uKybBxJOFpA%3D%3D"}],"group":"cf-nel","max_age":604800} Content-Type text/html; charset=UTF-8 Vary Accept-Encoding Connection keep-alive CF-RAY 81c166308ef12c36-FRA alt-svc h3=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| webpackJsonp number| isEnable string| qrcode_text function| _0xbf96 function| _0x1c04 function| _

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.staticfile.org
uaa.y5cz7w.top
240e:914:500c:2:3::3f6
2606:4700:3035::ac43:9662
0b60b1adafcf561ad318c14b257a77fabf971c8a71516c87d3c94771cde69c54
15839ac8d3105d4fd9fe7942ef8c7eaa232878e0c965b01d5e35ef08bcc67678
1bebba22cabbfd8e999e53d35ecb55b8cb82a9e928eed9ed10f9160ba1154e45
2cb4b1431b84ec15d35ed83bb927e27e8967d75f4bcd9cc4b25c8d879ae23e18
67926048a61ab5e6d03a8b5f68feb2cea26b2672e2a9d7d689b57ee71c83b9d5
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e