coronaviruscovid-19.today
Open in
urlscan Pro
185.80.53.149
Malicious Activity!
Public Scan
Effective URL: https://coronaviruscovid-19.today/CAP/Captcha/
Submission: On July 02 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 4th 2020. Valid for: 3 months.
This is the only time coronaviruscovid-19.today was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 160.153.128.44 160.153.128.44 | 21501 (GODADDY-AMS) (GODADDY-AMS) | |
5 | 185.80.53.149 185.80.53.149 | 59711 (HZ-NL-AS) (HZ-NL-AS) | |
2 | 2606:4700::68... 2606:4700::6810:84e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a00:1450:400... 2a00:1450:4001:81a::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 5 |
ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-128-44.ip.secureserver.net
cityu.edu.lb |
ASN59711 (HZ-NL-AS, GB)
PTR: bestsalesfunnel.com
coronaviruscovid-19.today |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
coronaviruscovid-19.today
coronaviruscovid-19.today |
11 KB |
3 |
google.com
www.google.com |
546 B |
2 |
cloudflare.com
cdnjs.cloudflare.com |
30 KB |
1 |
gstatic.com
www.gstatic.com |
127 KB |
1 |
cityu.edu.lb
cityu.edu.lb |
274 B |
12 | 5 |
Domain | Requested by | |
---|---|---|
5 | coronaviruscovid-19.today |
cityu.edu.lb
coronaviruscovid-19.today |
3 | www.google.com |
coronaviruscovid-19.today
www.gstatic.com |
2 | cdnjs.cloudflare.com |
coronaviruscovid-19.today
|
1 | www.gstatic.com |
www.google.com
|
1 | cityu.edu.lb | |
12 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cityu.edu.lb Go Daddy Secure Certificate Authority - G2 |
2019-08-11 - 2020-10-10 |
a year | crt.sh |
cpcalendars.coronaviruscovid-19.today Let's Encrypt Authority X3 |
2020-05-04 - 2020-08-02 |
3 months | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
www.google.com GTS CA 1O1 |
2020-06-10 - 2020-09-02 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-06-10 - 2020-09-02 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://coronaviruscovid-19.today/CAP/Captcha/
Frame ID: 94EBD87255630E30F3D3B901B5BE4F29
Requests: 10 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc4xqsZAAAAAKQzIRPI59XciuB-rHOYnp-5y4rM&co=aHR0cHM6Ly9jb3JvbmF2aXJ1c2NvdmlkLTE5LnRvZGF5OjQ0Mw..&hl=en&v=NMoy4HgGiLr5NAQaEQa2ho8X&size=normal&cb=7dkfvfx5s3pk
Frame ID: 607A9D1564A9A6AF66F1AAAD468D5D54
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=NMoy4HgGiLr5NAQaEQa2ho8X&k=6Lc4xqsZAAAAAKQzIRPI59XciuB-rHOYnp-5y4rM&cb=gdtaul7jinmu
Frame ID: 388E3EBE96F00F9FED403DCCA7DED8EF
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://cityu.edu.lb/tri-p/ Page URL
- https://coronaviruscovid-19.today/CAP/Captcha/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
reCAPTCHA (Captchas) Expand
Detected patterns
- html /<div[^>]+class="g-recaptcha"/i
- script /\/recaptcha\/api\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://cityu.edu.lb/tri-p/ Page URL
- https://coronaviruscovid-19.today/CAP/Captcha/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
cityu.edu.lb/tri-p/ |
118 B 274 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
coronaviruscovid-19.today/CAP/Captcha/ |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/ |
2 KB 957 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
coronaviruscovid-19.today/CAP/Captcha/css/ |
115 B 174 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ss.css
coronaviruscovid-19.today/CAP/Captcha/css/ |
250 B 302 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
674 B 546 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
coronaviruscovid-19.today/CAP/Captcha/js/ |
781 B 851 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/NMoy4HgGiLr5NAQaEQa2ho8X/ |
323 KB 127 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
momgram@2x.png
coronaviruscovid-19.today/CAP/Captcha/css/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 607A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bframe
www.google.com/recaptcha/api2/ Frame 388E |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client function| $ function| jQuery object| closure_lm_1297530 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
cityu.edu.lb
coronaviruscovid-19.today
www.google.com
www.gstatic.com
160.153.128.44
185.80.53.149
2606:4700::6810:84e5
2a00:1450:4001:81a::2004
2a00:1450:4001:81f::2003
051c78756e5e68ef14e03b210842561fe6cd6823dfd259af8840e3596cf1a10c
4f490363170f8e3e4bddbb591ac623c364033e274858e31726902857712e8981
698ce127bf7b2139384c3ce4e05d2f59ae41f662c45e1a02f23c37d2b8454e3e
6a71ae90da5a3b626f58d74267c98b546483e77e73be3fb2c5bf4956cc42b3dd
92ac9918f6b2c2cdafd7d6a648eb9ad0bf716e0b4a0465a219afefb295d46403
b76ffbb2665f82b493e054b50d3d1bb3f2a8b4233be1795ca9937956eef196bc
c1533bc39e2dd8ede3893909d6f42760e0598d075951447afe88158e57b0961a
cc15c325492dd5972c007635108f190eb6c75025e75c89d6b006ca7aeb4278a3
ded323b7e9e8846a7321dd58b70e948808c9eb3ce89d7617ed1dfc84dca281e5
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32