urlscan.io logo urlscan.io
SecurityTrails logo

no34093933874.pages.dev Open in urlscan Pro
188.114.97.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://no34093933874.pages.dev/
Submission: On July 16 via automatic, source openphish — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is no34093933874.pages.dev.
TLS certificate: Issued by WE1 on July 15th 2024. Valid for: 3 months.
This is the only time no34093933874.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Network Solutions (Internet)

Domain & IP information

IP Address AS Autonomous System
1 188.114.97.3 13335 (CLOUDFLAR...)
2 104.18.10.207 13335 (CLOUDFLAR...)
2 2a04:4e42:600... 54113 (FASTLY)
2 23.81.68.43 396362 (LEASEWEB-...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 5
1    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
no34093933874.pages.dev
2    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
2    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    23.81.68.43 (Edison, United States)

ASN396362 (LEASEWEB-USA-NYC, US)
webmail.networksolutionsemail.com
1    2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
Apex Domain
Subdomains		 Transfer
2 networksolutionsemail.com
webmail.networksolutionsemail.com — Cisco Umbrella Rank: 270070
7 KB
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
61 KB
2 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4508
47 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410
7 KB
1 pages.dev
no34093933874.pages.dev
57 KB
8 5
Domain Requested by
2 webmail.networksolutionsemail.com no34093933874.pages.dev
2 code.jquery.com no34093933874.pages.dev
2 stackpath.bootstrapcdn.com no34093933874.pages.dev
1 cdn.jsdelivr.net no34093933874.pages.dev
1 no34093933874.pages.dev
8 5

This site contains no links.

Subject Issuer Validity Valid
no34093933874.pages.dev
WE1		 2024-07-15 -
2024-10-13		 3 months crt.sh
bootstrapcdn.com
GTS CA 1P5		 2024-05-25 -
2024-08-23		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
*.networksolutionsemail.com
Sectigo RSA Domain Validation Secure Server CA		 2024-02-07 -
2025-02-06		 a year crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA		 2024-05-04 -
2025-05-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://no34093933874.pages.dev/
Frame ID: 9034E204B181B0F98D6C3BB3C2310309
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in - Professional Email

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

178 kB
Transfer

599 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
no34093933874.pages.dev/ 		185 KB
57 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://no34093933874.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2d71114e1314f4e5825b315975b2e9a5730d633890488e8b446009cd7f716c8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8a423269ac5593be-AMS
content-encoding
br
content-type
text/html; charset=utf-8
date
Tue, 16 Jul 2024 13:04:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EPOKraHcKIxgecvuNowD4%2FI4Aqboz%2BF%2FySK3pCXZP8Ewg7W2eDGfnlxzOafv5V3pk%2BQ6N8vUqS6OkdUxT12cufgvzT9Msnru2J0IuC5eC01NOAu%2F7%2F32Bner7v1lEJ0AoUhxIhg%2FeIs2Og%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
1055
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
10777383
cdn-cachedat
07/07/2023 01:23:40
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver
1.03
cdn-requestpullcode
200
server
cloudflare
etag
W/"816af0eddd3b4822c2756227c7e7b7ee"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
11f873f6646fa46b819bbd06b011b0c8
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
8a42326a7d030ba8-AMS
cdn-requestpullsuccess
True
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
2539625
x-cache
HIT, HIT
content-length
30875
x-served-by
cache-lga21931-LGA, cache-ams2100114-AMS
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1721135054.479554,VS0,VE0
etag
W/"28feccc0-15d9d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
440263, 245321
logo
webmail.networksolutionsemail.com/brands/5/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.networksolutionsemail.com/brands/5/logo
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.81.68.43 Edison, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software
/
Resource Hash
38f4cd5c0c12b0655856bb8470b15392154ebad70467d63a577ff730e8f248df
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload;
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-request-id
tx00000577d26b354fc6ab9-00665997b1-aa7bba73-msc1
x-app-server
rgw14fra15
x-amz-storage-class
STANDARD
content-length
4342
x-xss-protection
1; mode=block
last-modified
Fri, 08 Jul 2022 14:01:02 GMT
x-amz-meta-s3cmd-attrs
md5:8d74d147618554291f8cb17959e22450
etag
"8d74d147618554291f8cb17959e22450"
x-download-options
noopen
content-type
image/png
x-rgw-object-type
Normal
accept-ranges
bytes
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
2504323
x-cache
HIT, HIT
content-length
30879
x-served-by
cache-lga21981-LGA, cache-ams2100114-AMS
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1721135054.479557,VS0,VE0
etag
W/"28feccc0-15d84"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
250991, 71014
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.5.2/dist/umd/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@popperjs/core@2.5.2/dist/umd/popper.min.js
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b341df65f4ae526103325a74b19e05a97cc89e0ad232816bfe853a56831068a9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
6131634
x-jsd-version
2.5.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6380
x-served-by
cache-fra-eddf8230131-FRA, cache-lga21928-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"4785-1nNOLfRgVlbAQdjbsczfWaJjx/0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UW5xLXXnkV97vhj1hLe90w3LpiIsmu%2FydTb1tcaJC%2F2rxyvs6lqLLookLSadGrPWRLOB70XVSljwP1IP%2B7eG6KVSCarmi85bho%2F7bi2MlbCJzoqn5JQq7FEA6vorUdNGdQtsUwmSJnws6rLkw2E%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8a42326b1bf10e35-AMS
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 		59 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: no34093933874.pages.dev
URL: https://no34093933874.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
864
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
10786893
cdn-cachedat
08/20/2022 02:35:31
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver
1.02
cdn-requestpullcode
200
server
cloudflare
etag
W/"02d223393e00c273efdcb1ade8f4f8b1"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
a6bc14db3a88cabcd6b3bc56a77879ef
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
8a42326aed6d0ba8-AMS
cdn-requestpullsuccess
True
favicon.ico
webmail.networksolutionsemail.com/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://webmail.networksolutionsemail.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.81.68.43 Edison, United States, ASN396362 (LEASEWEB-USA-NYC, US),
Reverse DNS
Software
/
Resource Hash
467cf02eb2affc7b67bf2bfbe77365ee71ed341bac2eb9e9d63dacc27ca3be8a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://no34093933874.pages.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 13:04:14 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload;
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-request-id
tx000000532cdd98006145a-00665997a7-aa7bbad0-msc1
x-app-server
rgw17fra15
x-amz-storage-class
STANDARD
content-length
1839
x-xss-protection
1; mode=block
last-modified
Fri, 08 Jul 2022 14:01:01 GMT
x-amz-meta-s3cmd-attrs
md5:56290301f8e9f74229e3fd6e8fec4183
etag
"56290301f8e9f74229e3fd6e8fec4183"
x-download-options
noopen
content-type
image/png
x-rgw-object-type
Normal
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Network Solutions (Internet)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| Popper object| bootstrap function| _0x5407 function| _0x5e48c3 function| _0x14552e function| _0x5387 function| _0x4d8190

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff