![](/screenshots/9b90de87-41f5-4f18-81f4-0efb30cd3a75.png)
ch.unup2dates.us
Open in
urlscan Pro
2606:4700:3032::6815:2887
Malicious Activity!
Public Scan
Submission: On July 20 via manual from EG — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on May 29th 2023. Valid for: 3 months.
This is the only time ch.unup2dates.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3032::6815:2887 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 9 | 2606:4700::68... 2606:4700::6811:2b8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 104.16.168.131 104.16.168.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 108.139.47.120 108.139.47.120 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.225.223.115 13.225.223.115 | 16509 (AMAZON-02) (AMAZON-02) | |
19 | 5 |
ASN13335 (CLOUDFLARENET, US)
js.hcaptcha.com | |
newassets.hcaptcha.com | |
hcaptcha.com |
ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-120.jfk50.r.cloudfront.net
findicons.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-223-115.jfk51.r.cloudfront.net
images.freeimages.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cloudflare.com
1 redirects
challenges.cloudflare.com — Cisco Umbrella Rank: 6195 |
211 KB |
6 |
hcaptcha.com
js.hcaptcha.com — Cisco Umbrella Rank: 13012 newassets.hcaptcha.com — Cisco Umbrella Rank: 11654 hcaptcha.com — Cisco Umbrella Rank: 8351 |
268 KB |
1 |
freeimages.com
images.freeimages.com — Cisco Umbrella Rank: 211075 |
634 B |
1 |
findicons.com
1 redirects
findicons.com — Cisco Umbrella Rank: 413396 |
306 B |
1 |
unup2dates.us
ch.unup2dates.us |
5 KB |
19 | 5 |
Domain | Requested by | |
---|---|---|
9 | challenges.cloudflare.com |
1 redirects
ch.unup2dates.us
challenges.cloudflare.com |
4 | newassets.hcaptcha.com |
js.hcaptcha.com
newassets.hcaptcha.com |
1 | hcaptcha.com |
newassets.hcaptcha.com
|
1 | images.freeimages.com |
ch.unup2dates.us
|
1 | findicons.com | 1 redirects |
1 | js.hcaptcha.com |
ch.unup2dates.us
|
1 | ch.unup2dates.us | |
19 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
unup2dates.us GTS CA 1P5 |
2023-05-29 - 2023-08-27 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-15 - 2024-04-14 |
a year | crt.sh |
challenges.cloudflare.com Cloudflare Inc ECC CA-3 |
2022-09-18 - 2023-09-17 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://ch.unup2dates.us/dEJEBpYi
Frame ID: 869CE8A11E550B4425C37435FDF7350D
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/fd00b2a/static/hcaptcha.html
Frame ID: 1F15C48BAE107DB83A46705B60C0F33E
Requests: 2 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/fd00b2a/static/hcaptcha.html
Frame ID: C894992A8520C23CD4595904AE0684F3
Requests: 4 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/se3gh/0x4AAAAAAACPB5pkeL6e6saC/auto/normal
Frame ID: 2DDF960E704A835B107F0717821BDBB8
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/g/49c24b54/api.js?onload=onloadTurnstileCallback
- https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png HTTP 301
- https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
dEJEBpYi
ch.unup2dates.us/ |
22 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/g/49c24b54/ Redirect Chain
|
22 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
js.hcaptcha.com/1/ |
312 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_new_logo_alt.png
images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/ Redirect Chain
|
254 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/fd00b2a/static/ Frame 1F15 |
2 KB 809 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/fd00b2a/static/ Frame C894 |
2 KB 1012 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/se3gh/0x4AAAAAAACPB5pkeL6e6saC/auto/ Frame 2DDF |
24 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/fd00b2a/ Frame C894 |
312 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/ Frame 2DDF |
175 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/fd00b2a/ Frame 1F15 |
312 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C894 |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
checksiteconfig
hcaptcha.com/ Frame C894 |
853 B 1008 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
6cc5ec2b-36d8-4e97-ac28-9ab145f4f6e6
https://challenges.cloudflare.com/ Frame 2DDF |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
3556766e4b65088
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1142895851:1689881339:hb-GcmlSC2zq2Vrv4x3T-KPEdqgjPVBKQUHNo6whjr8/7e9db6791e61e256/ Frame 2DDF |
165 KB 122 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
x_0U1qi5OWORyiR
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/7e9db6791e61e256/1689882413404/1214fe49d62a7c2111cd444ad4bfa677666eceb54f470468ed92492bae7ebde5/ Frame 2DDF |
1 B 632 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
e2e9668d-29e3-40fc-ab38-8523a87f9cd7
https://challenges.cloudflare.com/ Frame 2DDF |
99 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
URvGutUPcshYH3C
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/7e9db6791e61e256/1689882413404/ Frame 2DDF |
61 B 148 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TjOh_8bgiSBeQiM
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/7e9db6791e61e256/1689882413409/f3bffffdae25d260958908ad4ff25b0797966239086fdf41ff856fe25ba66925/ Frame 2DDF |
1 B 630 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
afa4f043-1974-4f98-b020-e755d00f2f34
https://challenges.cloudflare.com/ Frame 2DDF |
99 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
3556766e4b65088
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1142895851:1689881339:hb-GcmlSC2zq2Vrv4x3T-KPEdqgjPVBKQUHNo6whjr8/7e9db6791e61e256/ Frame 2DDF |
14 KB 11 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 function| verifyCallback_CF function| verifyCallback_hCaptcha function| validateElement function| refreshCallBack function| switchToSecondCaptcha function| onloadTurnstileCallback function| incrementLoader object| Raven object| hcaptcha object| grecaptcha object| turnstile number| ticker1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.unup2dates.us/ | Name: oAme Value: 9db7ea8d23a90ca68f3483354a5bbb96721d4ac6dc1598d101fcc70dde883e6b |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ch.unup2dates.us
challenges.cloudflare.com
findicons.com
hcaptcha.com
images.freeimages.com
js.hcaptcha.com
newassets.hcaptcha.com
104.16.168.131
108.139.47.120
13.225.223.115
2606:4700:3032::6815:2887
2606:4700::6811:2b8
04f17bd9f0f426e0ae6ad681eb2e872d6180cb0d61b5f28f93dcfbd083c368f2
2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36
27092d5edc8f1af9666f071cd9e5828d08aadf10ee28f97ceceeca1bc9f62375
348210b17d41cb3210b2d69d63c0985b9937438cfd001f983e228d61c43e9954
445f7367f321d0d2699a1d2086a99a07b3ba72f16b0565b36a577accb2159299
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
5a9814b789c53ccdfa371eff3ba6e75e262adae89d194e581fce5950b470d6c8
658aa6ea8fe3988d2b7c088061e187a3b17aa530690c52e6b45551251b8e75e0
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
8da6995557d29a73fe50e281b1e09e241f0893b6b41ecf27702ba4f5c25c0194
b195634af4745b44061c577d69bf882eff7d96aea4b3af313651124e8768bb68
b510eb24c75ccf8cc28682250e9f1f13770095c328405888919e72f6ab6cf540
dbca23300b3beeefb7ca7cb3ee5f511e62191546966be51093ab11b5d9b7004b
ff7adbc1b7611ba2b3e0d197c14db35831525e5cedfe38dfc6edfee9a3a15dc6