![](/screenshots/adf94535-1d50-45d3-ba03-800622815c7d.png)
nextdaysrl.com
Open in
urlscan Pro
192.185.73.15
Malicious Activity!
Public Scan
Submission: On March 25 via api from US — Scanned from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 17th 2024. Valid for: 3 months.
This is the only time nextdaysrl.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Coinbase (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 192.185.73.15 192.185.73.15 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
3 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
11 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-73-15.unifiedlayer.com
nextdaysrl.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nextdaysrl.com
1 redirects
nextdaysrl.com |
165 KB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 437 |
66 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
24 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
8 | nextdaysrl.com |
1 redirects
nextdaysrl.com
|
3 | cdn.jsdelivr.net |
nextdaysrl.com
|
1 | code.jquery.com |
nextdaysrl.com
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nextdaysrl.com cPanel, Inc. Certification Authority |
2024-03-17 - 2024-06-15 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://nextdaysrl.com/CB/home.php?id=146.70.85.164
Frame ID: 9F247AA36680B60D9B05EFADB77083D9
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/adf94535-1d50-45d3-ba03-800622815c7d.png)
Page Title
Соіnbаѕе - lоgіnDetected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://nextdaysrl.com/CB/assets/fonts/ec8b63007fcc272a.woff2 HTTP 301
- https://nextdaysrl.com/404-error/
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
nextdaysrl.com/CB/ |
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/ |
227 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
nextdaysrl.com/CB/assets/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
nextdaysrl.com/CB/assets/css/ |
2 KB 507 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Consumer_Wordmark.svg
nextdaysrl.com/CB/assets/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.slim.min.js
code.jquery.com/ |
71 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.5.4/dist/umd/ |
18 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/ |
79 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
05d2153dba2045ba.woff2
nextdaysrl.com/CB/assets/fonts/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ab97fd728bcf27e3.woff2
nextdaysrl.com/CB/assets/fonts/ |
113 KB 113 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
nextdaysrl.com/404-error/ Redirect Chain
|
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Coinbase (Crypto Exchange)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| acceptCookies function| $ function| jQuery object| Popper number| uidEvent object| bootstrap1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nextdaysrl.com/ | Name: PHPSESSID Value: ca7a0b7a6be974dec824313fcacfb613 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
nextdaysrl.com
192.185.73.15
2a04:4e42:200::649
2a04:4e42:400::485
0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c
126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38
18b80e40bb93ae5f8f1d3253b03d8e5d55b51341a27ed78cf42feadd012bcf9f
28444cf02206967ba5a7b8f5a7c58124861c2833562455d19763f80ccfd03209
3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8
754b1522e6230f6a892544deabc5d9dc1aee898f03b420eef2e51fded18cbeca
7b79eb599be33507f6cf46207e72d2362d8efb392466f8e67f80b7b70bbc451f
81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779
d01282e005ee479e1a078588257c5fad00e07b7b97f994323dee0bd6c3b7ae7f
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db