secure-cashapp289892jasjkda.bumbleshrimp.com
Open in
urlscan Pro
216.10.242.73
Malicious Activity!
Public Scan
Submitted URL: http://fd.ax/l1
Effective URL: https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/signin.php?country.x=&locale.x=
Submission: On February 14 via manual from US
Effective URL: https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/signin.php?country.x=&locale.x=
Submission: On February 14 via manual from US
Summary
This website contacted 2 IPs
in 3 countries
across 4 domains to perform 9 HTTP transactions.
The main IP is 216.10.242.73, located in
India and
belongs to PUBLIC-DOMAIN-REGISTRY, US.
The main domain is secure-cashapp289892jasjkda.bumbleshrimp.com.
TLS certificate: Issued by R3 on February 14th 2021. Valid for: 3 months.
This is the only time secure-cashapp289892jasjkda.bumbleshrimp.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on February 14th 2021. Valid for: 3 months.
This is the only time secure-cashapp289892jasjkda.bumbleshrimp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cash App (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 2606:4700:303... 2606:4700:3030::ac43:c473 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 1 | 167.89.115.121 167.89.115.121 | 11377 (SENDGRID) (SENDGRID) | |
| 7 | 216.10.242.73 216.10.242.73 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
| 2 | 151.101.113.49 151.101.113.49 | 54113 (FASTLY) (FASTLY) | |
| 9 | 2 |
1
167.89.115.121
(Herndon, United States)
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
| u12335903.ct.sendgrid.net |
7
216.10.242.73
(India)
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
| secure-cashapp289892jasjkda.bumbleshrimp.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
bumbleshrimp.com
secure-cashapp289892jasjkda.bumbleshrimp.com |
411 KB |
| 2 |
squarecdn.com
cash-f.squarecdn.com |
69 KB |
| 2 |
fd.ax
2 redirects
fd.ax |
2 KB |
| 1 |
sendgrid.net
1 redirects
u12335903.ct.sendgrid.net |
272 B |
| 9 | 4 |
| Domain | Requested by | |
|---|---|---|
| 7 | secure-cashapp289892jasjkda.bumbleshrimp.com |
secure-cashapp289892jasjkda.bumbleshrimp.com
|
| 2 | cash-f.squarecdn.com |
secure-cashapp289892jasjkda.bumbleshrimp.com
|
| 2 | fd.ax | 2 redirects |
| 1 | u12335903.ct.sendgrid.net | 1 redirects |
| 9 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cpanel.secure-cashapp289892jasjkda.bumbleshrimp.com R3 |
2021-02-14 - 2021-05-15 |
3 months | crt.sh |
| *.squarecdn.com Entrust Certification Authority - L1K |
2021-02-04 - 2022-02-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/signin.php?country.x=&locale.x=
Frame ID: C5EA7361B60B5146DE1698A196788405
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://fd.ax/l1
HTTP 301
https://fd.ax/l1 HTTP 302
https://u12335903.ct.sendgrid.net/ls/click?upn=y-2Fb0hQAvUHx-2FBpb3wOOg03CZNx-2FQ7efpPovG-2FxGPnovugiop40Ydaq5... HTTP 302
https://secure-cashapp289892jasjkda.bumbleshrimp.com/redirect-new.php Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/?rnh Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/index.php Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/signin.php?country.x=&locale.x= Page URL
Detected technologies
Froala Editor
(Rich Text Editors)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<[^>]+class="[^"]*(?:fr-view|fr-box)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
- html /<[^>]+class="[^"]*(?:fr-view|fr-box)/i
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<[^>]+class="[^"]*(?:fr-view|fr-box)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://fd.ax/l1
HTTP 301
https://fd.ax/l1 HTTP 302
https://u12335903.ct.sendgrid.net/ls/click?upn=y-2Fb0hQAvUHx-2FBpb3wOOg03CZNx-2FQ7efpPovG-2FxGPnovugiop40Ydaq5JCaeaY6L6nM5LVb9IfWXvgh-2FKgtHegB0rmciUdRDxycRLdxZGfjY-3DY_qm_MDNvCNyez08PpLsyvG8Ik2GRDgDzCLwM9ILQdiVp3a0rMZqpdl55a0Cno9g-2F7GOslgRmYk6s5qbMcLr-2FkWtYO7MEGa2j5YQXnhe73JXXbV3I8xcbkfLglFu82DUczmG5UPijEmaR-2BGknUaG4C4tZIBR-2FqdqGt3b7M07jYclNTCu4nSgy2RLWO4HghiBgQHWxTeEB-2FsWuJgHg4TH0KrSkKH7vPPxZ36751d78PCoGVU0-3D HTTP 302
https://secure-cashapp289892jasjkda.bumbleshrimp.com/redirect-new.php Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/?rnh Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/index.php Page URL
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/login/signin.php?country.x=&locale.x= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://fd.ax/l1 HTTP 301
- https://fd.ax/l1 HTTP 302
- https://u12335903.ct.sendgrid.net/ls/click?upn=y-2Fb0hQAvUHx-2FBpb3wOOg03CZNx-2FQ7efpPovG-2FxGPnovugiop40Ydaq5JCaeaY6L6nM5LVb9IfWXvgh-2FKgtHegB0rmciUdRDxycRLdxZGfjY-3DY_qm_MDNvCNyez08PpLsyvG8Ik2GRDgDzCLwM9ILQdiVp3a0rMZqpdl55a0Cno9g-2F7GOslgRmYk6s5qbMcLr-2FkWtYO7MEGa2j5YQXnhe73JXXbV3I8xcbkfLglFu82DUczmG5UPijEmaR-2BGknUaG4C4tZIBR-2FqdqGt3b7M07jYclNTCu4nSgy2RLWO4HghiBgQHWxTeEB-2FsWuJgHg4TH0KrSkKH7vPPxZ36751d78PCoGVU0-3D HTTP 302
- https://secure-cashapp289892jasjkda.bumbleshrimp.com/redirect-new.php
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
redirect-new.php
secure-cashapp289892jasjkda.bumbleshrimp.com/ Redirect Chain
|
411 B 619 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
 Cookie set
/
secure-cashapp289892jasjkda.bumbleshrimp.com/ |
78 B 458 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.php
secure-cashapp289892jasjkda.bumbleshrimp.com/login/ |
119 B 435 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
signin.php
secure-cashapp289892jasjkda.bumbleshrimp.com/login/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style-cashapp.css
secure-cashapp289892jasjkda.bumbleshrimp.com/assets/css/ |
316 KB 317 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
secure-cashapp289892jasjkda.bumbleshrimp.com/assets/js/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
signin.js
secure-cashapp289892jasjkda.bumbleshrimp.com/assets/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cash-market-rounded-medium.woff2
cash-f.squarecdn.com/static/fonts/cashmarket/ |
35 KB 36 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cash-market-rounded-regular.woff2
cash-f.squarecdn.com/static/fonts/cashmarket/ |
33 KB 33 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cash App (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| secure-cashapp289892jasjkda.bumbleshrimp.com/ | Name: PHPSESSID Value: 1e9c58e026b07f5d8fdc6d428868ed2f |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cash-f.squarecdn.com
fd.ax
secure-cashapp289892jasjkda.bumbleshrimp.com
u12335903.ct.sendgrid.net
151.101.113.49
167.89.115.121
216.10.242.73
2606:4700:3030::ac43:c473
32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3
5139509bfa5d15eefc7a213f13652a9f08ba3354b88d8bf7e7e20c47347e3096
685a208b947d30c6a414f3575bba670a56e18122312284c32e6e3de7d99258a6
8c5b213f9789c7ddadf2faf550f55955f71340819367a07a19ec5c38eae7ea84
9df8a417dbd3b1d130efdf7d391b9b085983813977fdccbc42268f39261f655e
a9a2bbdeaa324c618a15318e6a892a8eb9114f5924c740cfae55658e891b096f
dbabbe5cd081b10155766d5d4b44193ea17602506e64fc680c815716d04f6c90
de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b