![](/screenshots/a0e9684c-3a95-4387-88e0-ee2099a59823.png)
mursu-e366.irakfflazrtgy.workers.dev
Open in
urlscan Pro
2606:4700:3033::ac43:aae9
Malicious Activity!
Public Scan
Submission: On March 24 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on January 29th 2024. Valid for: 3 months.
This is the only time mursu-e366.irakfflazrtgy.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3033::ac43:aae9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | () () | ||
3 | 2001:4998:14:... 2001:4998:14:800::1001 | 14777 (YAHOO) (YAHOO) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c17::5f | 15169 (GOOGLE) (GOOGLE) | |
7 | 6 |
ASN13335 (CLOUDFLARENET, US)
mursu-e366.irakfflazrtgy.workers.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
yimg.com
s.yimg.com — Cisco Umbrella Rank: 850 |
165 KB |
2 |
workers.dev
mursu-e366.irakfflazrtgy.workers.dev |
344 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 716 |
30 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
30 KB |
7 | 4 |
Domain | Requested by | |
---|---|---|
3 | s.yimg.com |
mursu-e366.irakfflazrtgy.workers.dev
s.yimg.com |
2 | mursu-e366.irakfflazrtgy.workers.dev |
mursu-e366.irakfflazrtgy.workers.dev
|
1 | ajax.googleapis.com |
mursu-e366.irakfflazrtgy.workers.dev
|
1 | code.jquery.com |
mursu-e366.irakfflazrtgy.workers.dev
|
7 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.aol.com |
help.aol.com |
login.aol.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
irakfflazrtgy.workers.dev E1 |
2024-01-29 - 2024-04-28 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA |
2024-03-05 - 2024-04-24 |
2 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-26 - 2024-05-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mursu-e366.irakfflazrtgy.workers.dev/33d08248-e597-4633-ae36-74c8c7ee273f
Frame ID: 0683F9682DFEA01FAD2357F9F05C5527
Requests: 8 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Not you?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
33d08248-e597-4633-ae36-74c8c7ee273f
mursu-e366.irakfflazrtgy.workers.dev/ |
938 KB 344 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
eafe6de5-6b78-48e5-b342-83c457175956
https://mursu-e366.irakfflazrtgy.workers.dev/ |
703 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo-main.css
s.yimg.com/wm/mbr/3f8e5364ed44b634b3e3571d15679137f4abbd32/ |
621 KB 135 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Yahoo_Sans-Regular.woff2
s.yimg.com/cv/ae/sports/fonts/2017/ |
28 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
650 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)194 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| s string| m function| _0x40f754 function| _0x4798 function| _0x36b1 string| _0xod3 function| _0x30e0e7 function| _0x25df function| _0x35a2 string| version_ function| _0x333bea function| _0x1578 function| _0x30a6 function| _0x480e function| _0x587b string| _0xodi function| _0x1d7537 function| _0x15cb function| _0x3e9e function| _0x199b function| _0x40db function| _0x4372 function| _0x4e83 function| _0x562436 number| _0xodf function| _0x24b1 function| _0x410c function| _0x36ef20 function| _0x131d0a function| _0x15b1 function| _0x4e9e function| _0x1f067b function| _0x2337 function| _0x270e function| templatePage function| $ function| jQuery function| LLLll6y4CA56nc1o2nfu6se6llll function| iIIi6y4cA56Nc1o2nfu6se6iiii object| GJo5Q4 function| tJYZOM object| gUYTjnl number| nYdwgB object| woEwbx string| KqBJ6Ei string| oUacBy string| FRNVRQO string| AHbGdlU string| HjB1NZ1 string| YBfXwUF string| dc_VNx string| gGpqnC string| Y6QYJpJ string| ijUbgTt string| _Fmc93D string| OzITKBO string| D7HDka string| XWS9GRm string| G5Lx0L string| YV_4rL0 string| XSy9F3w string| rZCv1W string| QPjYiH string| elusL18 string| BHhMqj string| Ho6vgy6 string| K4PQjW string| rwTF2S string| eJ5LUG string| witvVJd string| cw_TH0m string| lZ6Md6_ string| UnPbMW string| WEqpvAN string| pVSuAs string| WV8NAHd string| qguyI7 string| jsE0LL string| ABdq8S string| b8YqYI string| R1jc39 string| YY6COtl string| xqerbuG string| gWN5yvN string| LS53CCK string| qU344A string| dwBxPx string| wGUongv string| TQEabIg string| GV2V7aq string| UZOk1j string| oRVz5Uy string| WjZSjh string| iaTxwYG string| V5AuVi string| SK5UPi string| HX6x29 string| PzUevf string| e_5Jux string| Q0jgqat string| BVYigC string| IaL1v4o string| w4WB8Ll string| wcNSgc string| YAhm7i string| IQ92FO string| wKcEye string| clI3BR string| laESwf string| QxIX86U string| ViBYLO string| hcLnEa string| Z7CAqMR string| dMtShyr string| zWbCisP string| XTKfSsl string| mrdmoA string| fUUdIZ string| qTN4f5 string| mM7eav string| lxxsLeD string| IM5nuB string| i7hhH3 string| TJJ6Ft_ string| rOyEe4M string| UDFrDEH object| NpyGmV object| MkDiO4m object| jzRLQwx object| tdZbzY function| lllll6y4ca56nc1o2nfu6se6llll function| paD2pq function| FPZvLq function| llli6y4ca56nc1o2nfu6se6iiii function| pAOMyv undefined| y41V2sH object| Nsh5oQ3 number| qLrMxR number| FbTwLMi number| mPW6i6d function| EHtgyC string| omu08TO string| _53MTm string| DMcG3b string| dKffdWm string| k5qWHVG string| uTvECZ string| F9s2DH string| CuHvvn string| SWXsi0_ string| AuTCL6 string| EfDUEe string| V5IA4O_ string| UV3Z0fm string| jZhwr03 string| yCFqMI string| S8groZ string| MAuSHWm string| RJvTrQf string| s90xyw string| DW45o8T string| giF_rde string| qK4hJGE string| ipVitce string| au5Y70u string| WX3QCTw string| yJqrZfM string| zo3ImRU string| uh9fqh string| T6YGlTT string| Gk6m7N string| BA_RBt string| hG4aDV string| UjUPNBQ object| JrK2NZ object| nJ1zjd object| AYROel object| BDSBMT object| eTUKu0S undefined| RYe99V object| qO0Iugm undefined| cLCPmnO object| QtgI6Kn object| QmV_EG function| aydmZ0H function| bWVpAi function| bIVipvq function| mQGJWB function| F3Awj5 function| UXSoD_0 function| SuzE3Q function| z4B22V function| llii6y4ca56nc1o2nfu6se6iiii function| llll6y4ca56nc1o2nfu6se6lli0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
code.jquery.com
mursu-e366.irakfflazrtgy.workers.dev
s.yimg.com
2001:4998:14:800::1001
2606:4700:3033::ac43:aae9
2607:f8b0:4004:c17::5f
2a04:4e42:200::649
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1a540d6790659adf104de6f73b3be7526e1729da358976fa63f366e2ca01c58d
910ec081ee16dee4ea0d08548ced9140e732cc8ecac038f873d849dbf746bfaa
ba49824ee967f18f51c977fdbb503c269bf8591fe40061f64f9cace1972d688c
c5b544941ae7bf714491ee0a5f21562bbc6e6aa4ce546be7efda34c59e40a159
fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560