pensive-wescoff-550305.netlify.app
Open in
urlscan Pro
2a03:b0c0:3:e0::27e:2001
Malicious Activity!
Public Scan
Effective URL: https://pensive-wescoff-550305.netlify.app/
Submission: On February 15 via manual from MD
Summary
TLS certificate: Issued by AlphaSSL CA - SHA256 - G2 on March 4th 2020. Valid for: a year.
This is the only time pensive-wescoff-550305.netlify.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a00:1288:110... 2a00:1288:110:c104::2000 | 34010 (YAHOO-IRD) (YAHOO-IRD) | |
3 | 43.255.154.106 43.255.154.106 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
11 | 2a03:b0c0:3:e... 2a03:b0c0:3:e0::27e:2001 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
15 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-43-255-154-106.ip.secureserver.net
advanceb2bmedia.com |
ASN14061 (DIGITALOCEAN-ASN, US)
pensive-wescoff-550305.netlify.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
netlify.app
pensive-wescoff-550305.netlify.app |
102 KB |
3 |
advanceb2bmedia.com
advanceb2bmedia.com |
8 KB |
1 |
yahoo.com
r.search.yahoo.com |
818 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
11 | pensive-wescoff-550305.netlify.app |
advanceb2bmedia.com
pensive-wescoff-550305.netlify.app |
3 | advanceb2bmedia.com |
r.search.yahoo.com
advanceb2bmedia.com |
1 | r.search.yahoo.com | |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.search.yahoo.com DigiCert SHA2 High Assurance Server CA |
2020-10-22 - 2021-04-13 |
6 months | crt.sh |
advanceb2bmedia.com Go Daddy Secure Certificate Authority - G2 |
2020-09-24 - 2021-10-26 |
a year | crt.sh |
*.netlify.app AlphaSSL CA - SHA256 - G2 |
2020-03-04 - 2021-03-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pensive-wescoff-550305.netlify.app/
Frame ID: 3212F741ECFEB09CB15FD415BCFF3B60
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://r.search.yahoo.com/_ylt=AwrJ7Fk5JSpg0b4AGhRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZANBMDYxNV8xBHNlY... Page URL
- https://advanceb2bmedia.com/ Page URL
- https://pensive-wescoff-550305.netlify.app/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache Traffic Server (Web Servers) Expand
Detected patterns
- headers server /ATS\/?([\d.]+)?/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://r.search.yahoo.com/_ylt=AwrJ7Fk5JSpg0b4AGhRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZANBMDYxNV8xBHNlYwNzcg--/RV=2/RE=1613403578/RO=10/RU=https%3a%2f%2fadvanceb2bmedia.com%2f/RK=2/RS=XaHzcrcXna4efmlHy4Z..Y1fj7s- Page URL
- https://advanceb2bmedia.com/ Page URL
- https://pensive-wescoff-550305.netlify.app/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
RS=XaHzcrcXna4efmlHy4Z..Y1fj7s-
r.search.yahoo.com/_ylt=AwrJ7Fk5JSpg0b4AGhRXNyoA;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZANBMDYxNV8xBHNlYwNzcg--/RV=2/RE=1613403578/RO=10/RU=https%3a%2f%2fadvanceb2bmedia.com%2f/RK=2/ |
376 B 818 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
advanceb2bmedia.com/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
install.css
advanceb2bmedia.com/wp-admin/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wordpress-logo.png
advanceb2bmedia.com/wp-admin/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
pensive-wescoff-550305.netlify.app/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
pensive-wescoff-550305.netlify.app/ |
138 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
pensive-wescoff-550305.netlify.app/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
pensive-wescoff-550305.netlify.app/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
pensive-wescoff-550305.netlify.app/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MaskedPassword.js
pensive-wescoff-550305.netlify.app/ |
17 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
pensive-wescoff-550305.netlify.app/ |
13 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
pensive-wescoff-550305.netlify.app/ |
68 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
pensive-wescoff-550305.netlify.app/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
pensive-wescoff-550305.netlify.app/ |
50 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
pensive-wescoff-550305.netlify.app/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Microsoft (Consumer)58 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| axios function| MaskedPassword function| loadForm function| redirect function| emGet function| loadEmail function| loadPassword function| loadPasswordAgain undefined| userEmail undefined| userPassword undefined| confirmPassword function| processEmail function| processPassword function| processPassword2 function| displayPassword function| displayPassword2 function| show function| hide function| set function| sendDetails function| ValidateEmail string| url_link object| emailDiv object| emailForm object| email_InputDiv object| email_input object| accountDiv object| creatAccountDiv object| accessDiv object| acesssAccountDiv object| next_buttonholderDiv object| next_buttonholder1 object| next_buttonholder2 object| next_buttonholder3 object| nextbutton object| passwordDiv object| passwordForm object| password_InputDiv object| password_input object| forgot_passwordDiv object| signin_buttonholderDiv object| signin_buttonholder1 object| signin_buttonholder2 object| signin_buttonholder3 object| signinbutton function| $ function| jQuery function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block; report=https://csp.search.yahoo.com/xssreport |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
advanceb2bmedia.com
pensive-wescoff-550305.netlify.app
r.search.yahoo.com
2a00:1288:110:c104::2000
2a03:b0c0:3:e0::27e:2001
43.255.154.106
17ecfb633c2142af931d0e365019aaaa6668911ee61d374ffc00d5a99778da5c
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
31df1e69ea3aece8a8bae5c08bcb7f5e977cb76f886897b301355359b66a48ec
424a9bcd3c94cad44f645899eeaca19900efc075b07d65313dc24770240f8b99
4b52781951c70cc8a2ae2afdaac5d673c656c3be0f1c769fa6c1e9e4f5ed8d3b
784b3cf9616ce0095f883b52aa9662b29359e34914ead299153c6b01087e8263
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
9fe3c5f0aa6a78e4b3ad803e2c1051c430653ffeef7e7df08299d66517c398c5
c5a17d46976d471cf060c5a0e25749a323d6ab20cf0910f40afed81047ba21ef
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
f8da9db9b44d241743076eb3057bc42b881ddd0a15a7d61ececadd8f84d64fb0