worker-home-american-eb1d.heleyas570.workers.dev Open in urlscan Pro
172.67.223.44 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://worker-home-american-eb1d.heleyas570.workers.dev/
Submission: On April 17 via automatic, source openphish (April 17th 2024, 1:09:27 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 172.67.223.44, located in United States and belongs to CLOUDFLARENET, US. The main domain is worker-home-american-eb1d.heleyas570.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on April 15th 2024. Valid for: 3 months.

This is the only time worker-home-american-eb1d.heleyas570.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3	172.67.223.44 172.67.223.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2620:100:6022... 2620:100:6022:15::a27d:420f	19679 (DROPBOX) (DROPBOX)
1	23.37.49.89 23.37.49.89	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	4

3 172.67.223.44 (United States)

ASN13335 (CLOUDFLARENET, US)

worker-home-american-eb1d.heleyas570.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)

dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.49.89 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-49-89.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	dropboxusercontent.com dl.dropboxusercontent.com — Cisco Umbrella Rank: 17352	18 KB
3	workers.dev worker-home-american-eb1d.heleyas570.workers.dev	18 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2799	164 B
1	aexp-static.com www.aexp-static.com — Cisco Umbrella Rank: 13618	48 KB
11	4

	Domain	Requested by
6	dl.dropboxusercontent.com	worker-home-american-eb1d.heleyas570.workers.dev dl.dropboxusercontent.com
3	worker-home-american-eb1d.heleyas570.workers.dev	worker-home-american-eb1d.heleyas570.workers.dev
1	api.ipify.org	worker-home-american-eb1d.heleyas570.workers.dev
1	www.aexp-static.com	worker-home-american-eb1d.heleyas570.workers.dev
11	4

This site contains no links.

Subject Issuer	Validity	Valid
heleyas570.workers.dev GTS CA 1P5	`2024-04-15` - `2024-07-14`	3 months	crt.sh
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1	`2024-03-25` - `2025-03-11`	a year	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2024-03-06` - `2025-03-06`	a year	crt.sh
ipify.org GTS CA 1P5	`2024-03-21` - `2024-06-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://worker-home-american-eb1d.heleyas570.workers.dev/
Frame ID: A9F5B79F793B0093A240F2835EFC3288
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

Page Statistics

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

84 kB
Transfer

525 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
worker-home-american-eb1d.heleyas570.workers.dev/ 62 KB
5 KB 139ms
44ms Document
text/html 172.67.223.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://worker-home-american-eb1d.heleyas570.workers.dev/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.223.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1cb8877168279f4f883c994a0c662228b78f268cf65d5f5e962d13716de828

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 87588781ced165c7-FRA
content-encoding: br
content-type: text/html;charset=UTF-8
date: Wed, 17 Apr 2024 01:09:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0nNhTtLuY8r3GF2ciRpDfjX50eI1BLpMh8YFWnPPDLT3dXD9CKPuqvXOoklDhfacxB3S4ID%2FfV7iZ%2Bm21VjZmdF1yKbZRTbjSX64uwsSEacP0hDwYOafh8U5n6LjtOWs6O29LXb7bvmYpk4wNoP8Dpc30YVF0eyIgAFIhIvbO3lS%2Be8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 ldelavd.css
dl.dropboxusercontent.com/s/ttfvw2v00hqadxh/ 15 KB
4 KB 621ms
527ms Stylesheet
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/ttfvw2v00hqadxh/ldelavd.css

Requested by

Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

742986c3263400cc14e94db1c58eb49786e4466272889ce602cd6df55297a82d

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:22 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: 0cb4e72f07ce47a8b78665105f7b6beb
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ldelavd.css"; filename*=UTF-8''ldelavd.css
pragma: public
server: envoy
x-server-response-time: 378
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 dls.min.css
www.aexp-static.com/cdaas/one/statics/@americanexpress/dls/6.24.0/package/dist/6.24.0/styles/ 358 KB
48 KB 206ms
49ms Stylesheet
text/css 23.37.49.89
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/@americanexpress/dls/6.24.0/package/dist/6.24.0/styles/dls.min.css
Requested by: Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.49.89 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-49-89.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5697ec2a5b964c283b604e35b4b9a8e550014fd6ebd602a849fd85038113d78b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 01:09:23 GMT
content-encoding: gzip
last-modified: Mon, 20 Feb 2023 20:23:12 GMT
etag: W/"63f3d6b0-596ee"
vary: Origin, Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, must-revalidate
timing-allow-origin: *
content-length: 48683

GET
H2 200 ldelave.css
dl.dropboxusercontent.com/s/l46v0c6zhz62fj0/ 8 KB
2 KB 729ms
636ms Stylesheet
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/l46v0c6zhz62fj0/ldelave.css

Requested by

Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

28e95207ed3568a6269b153b0b7e51c92a7504da9ef295744a7ec0dccd1f46cf

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: 4fca86dc4b5942d9b2a707ab53684ead
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ldelave.css"; filename*=UTF-8''ldelave.css
pragma: public
server: envoy
x-server-response-time: 421
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 ldelavf.css
dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ 3 KB
1 KB 642ms
548ms Stylesheet
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ldelavf.css

Requested by

Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

bcf4f34421a53befa0aceca5c27925d29fdc7f12671b8f0fbe9b138398d70436

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: 77c25260d0a74a55b1e9b43eb7fbd913
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ldelavf.css"; filename*=UTF-8''ldelavf.css
pragma: public
server: envoy
x-server-response-time: 404
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 ltolbec.gif
dl.dropboxusercontent.com/s/jnxrg3tqc0u8rxa/ 4 KB
5 KB 502ms
409ms Image
image/gif 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/jnxrg3tqc0u8rxa/ltolbec.gif

Requested by

Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-dropbox-request-id: dd2bcba6de0a44f6bf56e895de966695
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ltolbec.gif"; filename*=UTF-8''ltolbec.gif
content-length: 4424
pragma: public
server: envoy
etag: 1649372231639804n
x-server-response-time: 227
content-type: image/gif
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H3 200 njhamilodjtdjlogo.png
worker-home-american-eb1d.heleyas570.workers.dev/upfiles/ 8 KB
8 KB 43ms
43ms Image
text/html 172.67.223.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://worker-home-american-eb1d.heleyas570.workers.dev/upfiles/njhamilodjtdjlogo.png
Requested by: Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.223.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 01:09:22 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y7rAe5u%2BpNq35667xkO%2FA7M3wEr%2BX9cyPK0h%2FWR7RN0PgpCDqM30yjFvIWV1RT0h8nnaWcEwYHzxG%2F1zzlzo2%2FZ5tBIQLuXYNUxfY%2BLuhPm5dStoEhVuBN394eckySt88Pii6Bg3N6oFw8I73AddIWEt8yOoBGTZEMx6Yqk6NbJQd%2Bk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html;charset=UTF-8
cf-ray: 875887822eeb65c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
api.ipify.org/ 29 B
164 B 264ms
177ms Script
application/javascript 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getIP
Requested by: Host: worker-home-american-eb1d.heleyas570.workers.dev
URL: https://worker-home-american-eb1d.heleyas570.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c9e4b5296559934b513d44a0cee6c9c59a8db9b0ed9da4ec3f24cef5880e3af

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 01:09:23 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 87588782ba399b5e-FRA
content-length: 29
vary: Origin
content-type: application/javascript

GET
H2 200 ltolbeb.png
dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ 3 KB
3 KB 470ms
470ms Image
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ltolbeb.png

Requested by

Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ldelavf.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ldelavf.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: 164694c043314c1daef3a1e1cace96e7
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ldelavf.css"; filename*=UTF-8''ldelavf.css
pragma: public
server: envoy
x-server-response-time: 287
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 ltolbee.png
dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ 3 KB
3 KB 585ms
585ms Image
text/css 2620:100:6022:15::a27d:420f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ltolbee.png

Requested by

Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ldelavf.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dl.dropboxusercontent.com/s/dl0l68o9ckjx9h1/ldelavf.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date: Wed, 17 Apr 2024 01:09:23 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-dropbox-request-id: d501995d6d24441dbae4dc3f2e430651
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="ldelavf.css"; filename*=UTF-8''ldelavf.css
pragma: public
server: envoy
x-server-response-time: 443
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

GET
H3 200 favicon.ico
worker-home-american-eb1d.heleyas570.workers.dev/ 62 KB
5 KB 44ms
43ms Other
text/html 172.67.223.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://worker-home-american-eb1d.heleyas570.workers.dev/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.223.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1cb8877168279f4f883c994a0c662228b78f268cf65d5f5e962d13716de828

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://worker-home-american-eb1d.heleyas570.workers.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 01:09:24 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kjYbIfaDT7mGGSXbKp%2B1DkBeEmhQhBslFzRxpu3gxRqV0ljBFJm5Z0o4SdtfvE%2B7%2B6gJIsYLnegvI3vQ%2F8jGxd5LdWHf6Fd6nU03U1UzqkWMA8bcKFDfb9eH7WXjBpUFPrprVmP%2Bg8lNFiuGmLoIAX%2BFMaQlgZO%2BhgsdDjL6ips6dio%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html;charset=UTF-8
cf-ray: 8758878a6a5465c7-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getIP

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: zAu7trJk4hDlWOmf4wGJuzyC9lK6hulofmQod6cWpAwSPSLlBfYJwNzdvKjNXCX1

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/(Line 1) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/(Line 1) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/(Line 1) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/(Line 1) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worker-home-american-eb1d.heleyas570.workers.dev/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
dl.dropboxusercontent.com
worker-home-american-eb1d.heleyas570.workers.dev
www.aexp-static.com
172.67.223.44
172.67.74.152
23.37.49.89
2620:100:6022:15::a27d:420f
28e95207ed3568a6269b153b0b7e51c92a7504da9ef295744a7ec0dccd1f46cf
2c9e4b5296559934b513d44a0cee6c9c59a8db9b0ed9da4ec3f24cef5880e3af
5697ec2a5b964c283b604e35b4b9a8e550014fd6ebd602a849fd85038113d78b
742986c3263400cc14e94db1c58eb49786e4466272889ce602cd6df55297a82d
7e1cb8877168279f4f883c994a0c662228b78f268cf65d5f5e962d13716de828
b754eb74fa8f416b4803252f7994d7aa22d697a5eb77f0b4df8e3839f9621c9e
bcf4f34421a53befa0aceca5c27925d29fdc7f12671b8f0fbe9b138398d70436
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

worker-home-american-eb1d.heleyas570.workers.dev Open in urlscan Pro 172.67.223.44 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

84 kBTransfer

525 kBSize

1 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

7 Console Messages

Indicators

worker-home-american-eb1d.heleyas570.workers.dev Open in urlscan Pro
172.67.223.44 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

84 kB
Transfer

525 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!