powadeng.gq Open in urlscan Pro
104.42.99.211  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response powadeng.gq/flaps/trads/	19 KB 9 KB	362ms 317ms	Document text/html	104.42.99.211 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://powadeng.gq/flaps/trads/ Protocol HTTP/1.1 Server 104.42.99.211 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / TinyCP Resource Hash 63c14a8b207e84e0725cc7e7fbdea7344752ad4384fcdada5a6d355a8bbd4d60 Request headers Host powadeng.gq Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 31 Aug 2020 17:41:47 GMT Server Apache/2.4.29 (Ubuntu) Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip X-Powered-By TinyCP Content-Length 9359 Keep-Alive timeout=5, max=100 Content-Type text/html; charset=UTF-8
GET H2	200	SpryValidationTextField.css dagapower.cf/pdf/	3 KB 1023 B	20ms 18ms	Stylesheet text/css	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dagapower.cf/pdf/SpryValidationTextField.css Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d47cbf9aa74969bc84393dbfc6245f9d7ba2ceb5edee1b28636ff38c75f695b Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT content-encoding br cf-cache-status HIT last-modified Sun, 02 Sep 2018 15:00:36 GMT server cloudflare age 329 etag W/"bfe-574e4afe5ed00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 5cb88b5d8ea505ed-FRA cf-request-id 04e7356e79000005edee89e200000001
GET H2	200	style.css dagapower.cf/pdf/	4 KB 1 KB	19ms 18ms	Stylesheet text/css	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dagapower.cf/pdf/style.css Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a4b4bcf914972866a7b57b6439e5ca6896b0eb9d755a09def78c01c7ea63eabe Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT content-encoding br cf-cache-status HIT last-modified Sun, 02 Sep 2018 14:58:32 GMT server cloudflare age 329 etag W/"10d5-574e4a881d600-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 5cb88b5d9eac05ed-FRA cf-request-id 04e7356e7a000005edee89f200000001
GET H2	200	SpryValidationTextField.js Show response dagapower.cf/pdf/	73 KB 16 KB	28ms 28ms	Script application/javascript	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dagapower.cf/pdf/SpryValidationTextField.js Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7555b2cd6c16af7c07bf8f2fc42f98019f2ddd877c3a798e1f65caf689e448b2 Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT content-encoding br cf-cache-status HIT last-modified Sun, 02 Sep 2018 14:58:10 GMT server cloudflare age 329 etag W/"125b0-574e4a7322480-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5cb88b5d9eb105ed-FRA cf-request-id 04e7356e7a000005edee8a0200000001
GET H2	200	secure.png dagapower.cf/pdf/	55 KB 55 KB	16ms 16ms	Image image/png	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://dagapower.cf/pdf/secure.png Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb99a9a3fc4349ffa77cefbd09d46ac646d3d9645569a2abd0e9f084df127dd1 Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT cf-cache-status HIT last-modified Sun, 02 Sep 2018 14:57:29 GMT server cloudflare age 329 etag "dbe7-574e4a4c08840" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5cb88b5d9ebb05ed-FRA content-length 56295 cf-request-id 04e7356e7c000005edee8a1200000001
GET DATA	200 OK	truncated /	4 KB 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 55f7c313596e3dd498c6a095af8301060491b5aded868f729f655d5b0f3d416f Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type text/css
GET H2	200	blurred.jpg isc.sans.edu/diaryimages/images/	24 KB 24 KB	307ms 103ms	Image image/jpeg	45.60.103.34 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://isc.sans.edu/diaryimages/images/blurred.jpg Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.103.34 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 01f108803383b949820c95cb28ed6d96c3fe953fbbd7273e924ac558ef4c2c5e Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:48 GMT last-modified Mon, 19 Mar 2018 22:31:52 GMT x-cdn Incapsula etag "66d7-567cb86414d77" strict-transport-security max-age=31556926; includeSubDomains content-type image/jpeg status 200 x-iinfo 11-173378381-0 0CNN RT(1598895708029 0) q(0 -1 -1 -1) r(0 -1) cache-control max-age=37858, public content-length 24164 expires Tue, 01 Sep 2020 04:12:46 GMT
GET H/1.1	404 Not Found	Acrobat_Reader.fw.png powadeng.gq/flaps/trads/	273 B 273 B	177ms 176ms	Image text/html	104.42.99.211 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://powadeng.gq/flaps/trads/Acrobat_Reader.fw.png Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol HTTP/1.1 Server 104.42.99.211 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash 70a29cc4128966a311cb51fcdae5473b96c21452277d21dcce6c5a736c14d547 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 31 Aug 2020 17:41:47 GMT Server Apache/2.4.29 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 273 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	pdf-logo.png powadeng.gq/flaps/trads/	273 B 273 B	333ms 316ms	Image text/html	104.42.99.211 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://powadeng.gq/flaps/trads/pdf-logo.png Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol HTTP/1.1 Server 104.42.99.211 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash 70a29cc4128966a311cb51fcdae5473b96c21452277d21dcce6c5a736c14d547 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 31 Aug 2020 17:41:48 GMT Server Apache/2.4.29 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 273 Content-Type text/html; charset=iso-8859-1
GET H2	200	Acrobat_Reader.fw.png dagapower.cf/pdf/	60 KB 60 KB	13ms 12ms	Image image/png	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://dagapower.cf/pdf/Acrobat_Reader.fw.png Requested by Host: dagapower.cf URL: https://dagapower.cf/pdf/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e9d799f426b22004c33e534cf0a63f1236f1a3c18a941e899ddcfabdddf8c846 Request headers Referer https://dagapower.cf/pdf/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT cf-cache-status HIT last-modified Sun, 02 Sep 2018 15:00:11 GMT server cloudflare age 329 etag "ee5e-574e4ae6874c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5cb88b5ddfa205ed-FRA content-length 61022 cf-request-id 04e7356ea5000005edee8a4200000001
GET H2	200	pdf-logo.png dagapower.cf/pdf/	39 KB 39 KB	51ms 50ms	Image image/png	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://dagapower.cf/pdf/pdf-logo.png Requested by Host: dagapower.cf URL: https://dagapower.cf/pdf/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 58761cde7886c796f27c9283c903e296a7de07de05ed447b49ea198feea884ff Request headers Referer https://dagapower.cf/pdf/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT cf-cache-status HIT last-modified Sun, 02 Sep 2018 14:59:35 GMT server cloudflare age 328 etag "9b25-574e4ac4323c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5cb88b5ddfa805ed-FRA content-length 39717 cf-request-id 04e7356ea5000005edee8a5200000001
GET H/1.1	404 Not Found	bg_form.png powadeng.gq/flaps/trads/images/	273 B 273 B	323ms 311ms	Image text/html	104.42.99.211 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL http://powadeng.gq/flaps/trads/images/bg_form.png Requested by Host: powadeng.gq URL: http://powadeng.gq/flaps/trads/ Protocol HTTP/1.1 Server 104.42.99.211 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash 70a29cc4128966a311cb51fcdae5473b96c21452277d21dcce6c5a736c14d547 Request headers Referer http://powadeng.gq/flaps/trads/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 31 Aug 2020 17:41:48 GMT Server Apache/2.4.29 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 273 Content-Type text/html; charset=iso-8859-1
GET H2	200	adobe_logo_new_1.jpg dagapower.cf/pdf/	22 KB 22 KB	13ms 13ms	Image image/jpeg	2606:4700:3033::681c:1147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://dagapower.cf/pdf/adobe_logo_new_1.jpg Requested by Host: dagapower.cf URL: https://dagapower.cf/pdf/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:1147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6007bf95a0410574c4801866e0cea412af057cd9314315560badca389eb198be Request headers Referer https://dagapower.cf/pdf/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 31 Aug 2020 17:41:47 GMT cf-cache-status HIT last-modified Sun, 02 Sep 2018 14:58:59 GMT server cloudflare age 327 etag "56aa-574e4aa1dd2c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5cb88b5defd905ed-FRA content-length 22186 cf-request-id 04e7356eac000005edee8a7200000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| MM_goToURL object| Spry function| validateForm object| sprytextfield1 object| sprytextfield2

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dagapower.cf
isc.sans.edu
powadeng.gq
104.42.99.211
2606:4700:3033::681c:1147
45.60.103.34
01f108803383b949820c95cb28ed6d96c3fe953fbbd7273e924ac558ef4c2c5e
55f7c313596e3dd498c6a095af8301060491b5aded868f729f655d5b0f3d416f
58761cde7886c796f27c9283c903e296a7de07de05ed447b49ea198feea884ff
6007bf95a0410574c4801866e0cea412af057cd9314315560badca389eb198be
63c14a8b207e84e0725cc7e7fbdea7344752ad4384fcdada5a6d355a8bbd4d60
70a29cc4128966a311cb51fcdae5473b96c21452277d21dcce6c5a736c14d547
7555b2cd6c16af7c07bf8f2fc42f98019f2ddd877c3a798e1f65caf689e448b2
7d47cbf9aa74969bc84393dbfc6245f9d7ba2ceb5edee1b28636ff38c75f695b
a4b4bcf914972866a7b57b6439e5ca6896b0eb9d755a09def78c01c7ea63eabe
e9d799f426b22004c33e534cf0a63f1236f1a3c18a941e899ddcfabdddf8c846
eb99a9a3fc4349ffa77cefbd09d46ac646d3d9645569a2abd0e9f084df127dd1