![](/screenshots/96d66cb2-39cc-4e05-aa36-1019a5f8c538.png)
rack-space-a32937.owamser.workers.dev
Open in
urlscan Pro
104.21.59.184
Malicious Activity!
Public Scan
Submission: On December 12 via api from AU — Scanned from AU
Summary
TLS certificate: Issued by GTS CA 1P5 on November 21st 2023. Valid for: 3 months.
This is the only time rack-space-a32937.owamser.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rackspace (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.21.59.184 104.21.59.184 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 13.35.147.89 13.35.147.89 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 69.20.91.24 69.20.91.24 | 27357 (RACKSPACE) (RACKSPACE) | |
4 | 104.130.182.72 104.130.182.72 | 27357 (RACKSPACE) (RACKSPACE) | |
2 | 142.250.71.66 142.250.71.66 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 142.250.204.2 142.250.204.2 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 142.250.204.4 142.250.204.4 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.71.67 142.250.71.67 | 15169 (GOOGLE) (GOOGLE) | |
11 | 7 |
ASN16509 (AMAZON-02, US)
PTR: server-13-35-147-89.syd1.r.cloudfront.net
www.sitepoint.com |
ASN15169 (GOOGLE, US)
PTR: syd15s17-in-f2.1e100.net
www.googleadservices.com |
ASN15169 (GOOGLE, US)
PTR: syd09s25-in-f2.1e100.net
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: syd15s17-in-f3.1e100.net
www.google.com.au |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
rackspace.com
apps.rackspace.com — Cisco Umbrella Rank: 146593 cp.rackspace.com — Cisco Umbrella Rank: 663209 |
41 KB |
2 |
googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 138 |
20 KB |
1 |
google.com.au
www.google.com.au — Cisco Umbrella Rank: 29909 |
455 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
822 B |
1 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 |
894 B |
1 |
sitepoint.com
www.sitepoint.com — Cisco Umbrella Rank: 236695 |
|
1 |
workers.dev
rack-space-a32937.owamser.workers.dev |
6 KB |
0 |
ajax.goog
Failed
ajax.goog Failed |
|
11 | 8 |
Domain | Requested by | |
---|---|---|
4 | cp.rackspace.com |
rack-space-a32937.owamser.workers.dev
|
2 | www.googleadservices.com |
rack-space-a32937.owamser.workers.dev
www.googleadservices.com |
1 | www.google.com.au |
rack-space-a32937.owamser.workers.dev
|
1 | www.google.com | 1 redirects |
1 | googleads.g.doubleclick.net | 1 redirects |
1 | apps.rackspace.com |
rack-space-a32937.owamser.workers.dev
|
1 | www.sitepoint.com |
rack-space-a32937.owamser.workers.dev
|
1 | rack-space-a32937.owamser.workers.dev | |
0 | ajax.goog Failed |
rack-space-a32937.owamser.workers.dev
|
11 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rackspace.com |
cp.rackspace.com |
apps.rackspace.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
owamser.workers.dev GTS CA 1P5 |
2023-11-21 - 2024-02-19 |
3 months | crt.sh |
www.sitepoint.com Amazon RSA 2048 M03 |
2023-08-06 - 2024-09-02 |
a year | crt.sh |
apps.rackspace.com Thawte EV RSA CA G2 |
2023-08-08 - 2024-08-17 |
a year | crt.sh |
cp.rackspace.com Thawte TLS RSA CA G1 |
2023-07-05 - 2024-07-18 |
a year | crt.sh |
www.googleadservices.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://rack-space-a32937.owamser.workers.dev/
Frame ID: 4E356285AABB5D33A74B171955FBC320
Requests: 11 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Control Panel
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Hosted Email
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Website Terms
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=324807631&cv=9&fst=1702361439523&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=480&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Frack-space-a32937.owamser.workers.dev%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&ocp_id=X_l3ZYmtI-2NmsMPvISO8Aw&sscte=1&crd=&pscrd=IhMIydiKx56JgwMV7YZmAh08ggPO HTTP 302
- https://www.google.com/pagead/1p-user-list/1040066332/?random=324807631&cv=9&fst=1702360800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=480&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Frack-space-a32937.owamser.workers.dev%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ct_cookie_present=false&crd=&is_vtc=1&cid=CAQSGwDICaaNDjMMIiPJh53_sdDj3csWrnxJwHuCQQ&random=3984034773&resp=GooglemKTybQhCsO HTTP 302
- https://www.google.com.au/pagead/1p-user-list/1040066332/?random=324807631&cv=9&fst=1702360800000&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&eid=375603261%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=480&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Frack-space-a32937.owamser.workers.dev%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ct_cookie_present=false&crd=&is_vtc=1&cid=CAQSGwDICaaNDjMMIiPJh53_sdDj3csWrnxJwHuCQQ&random=3984034773&resp=GooglemKTybQhCsO&ipr=y
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
rack-space-a32937.owamser.workers.dev/ |
45 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.min.js
ajax.goog//leapis.com/ajax/libs/jquery/1.10.2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
apps.rackspace.com/a/js/ |
29 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
43 B 329 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion.js
www.googleadservices.com/pagead/ |
50 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
43 B 329 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.googleadservices.com/pagead/conversion/1040066332/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_20141002.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plus-anytime_anywhere-190x294.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com.au/pagead/1p-user-list/1040066332/ Redirect Chain
|
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ajax.goog
- URL
- https://ajax.goog//leapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rackspace (Online)55 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture boolean| _wm_redirect function| onFormSubmit object| Webmail object| $Login object| $TEAEncrypt object| google_conversion_id object| google_conversion_language object| google_conversion_format object| google_conversion_color object| google_conversion_label object| google_conversion_value object| google_tag_data function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_currency object| google_conversion_domain object| google_disable_viewthrough object| google_gtag_event_data object| google_remarketing_only object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| google_custom_params object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.goog
apps.rackspace.com
cp.rackspace.com
googleads.g.doubleclick.net
rack-space-a32937.owamser.workers.dev
www.google.com
www.google.com.au
www.googleadservices.com
www.sitepoint.com
ajax.goog
104.130.182.72
104.21.59.184
13.35.147.89
142.250.204.2
142.250.204.4
142.250.71.66
142.250.71.67
69.20.91.24
16b4cf2b9a4908b20dff3b6c586bc3209fdf4bf53ea4f1fa2827cbffe4ceb070
254954afb10634ad2eead14d873510c39a68c15d3bf54bf958655962cb7e1450
2894fa1d1ebe2f99a165317c3c46ea23a7de28590a1c3965508acaf802e9c9a8
678c7bdfa334cc04afdfdbb1e3e7ebf98ecce178135ab46d4d6791bf70cf6028
b5871344b9f3f097c1757fdf86fab39466d5dcf357a96b0908025a5433adf792
db18ad437ed30b29a15bb4a394df2f29cd5073ccab904b6ed5e2cf870530dc62
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f167dfd881b45166119fce39b1fa639e925f80e4e7391e3cbe83f843490b7b19