taengball.co Open in urlscan Pro
2606:4700:3037::6818:6ccd  Malicious Activity! Public Scan

Submitted URL: https://u16209677.ct.sendgrid.net/ls/click?upn=CrEKzPKrKTWfroD-2BPmFai1aYiZAN-2FD-2BraT1zibOK90bI-2FqnlceR4bTWu8xwNPHaRtJVp_QYqlok...
Effective URL: http://taengball.co/$/apdf/view.php?email=
Submission: On June 03 via automatic, source openphish

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3037::6818:6ccd, located in United States and belongs to CLOUDFLARENET, US. The main domain is taengball.co.
This is the only time taengball.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
10 2606:4700:303... 13335 (CLOUDFLAR...)
1 69.16.252.49 32244 (LIQUIDWEB)
11 2
Domain Requested by
10 taengball.co taengball.co
1 dis.disasterfreehosting.com taengball.co
1 u16209677.ct.sendgrid.net 1 redirects
11 3

This site contains no links.

Subject Issuer Validity Valid
*.disasterfreehosting.com
GlobalSign Domain Validation CA - SHA256 - G2
2016-12-27 -
2018-02-25
a year crt.sh

This page contains 1 frames:

Primary Page: http://taengball.co/$/apdf/view.php?email=
Frame ID: CF76F60F0E67532BD4FC7907B23EA4CB
Requests: 11 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://u16209677.ct.sendgrid.net/ls/click?upn=CrEKzPKrKTWfroD-2BPmFai1aYiZAN-2FD-2BraT1zibOK90bI-2FqnlceR4bTW... HTTP 302
    http://taengball.co/$/apdf/index.php Page URL
  2. http://taengball.co/$/apdf/view.php?email= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

220 kB
Transfer

402 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u16209677.ct.sendgrid.net/ls/click?upn=CrEKzPKrKTWfroD-2BPmFai1aYiZAN-2FD-2BraT1zibOK90bI-2FqnlceR4bTWu8xwNPHaRtJVp_QYqlokheGy8WQy5Jdm31QUa7H4-2B4W85l84Pbh6mbezsO8r6pSoZ2YhCUGLJpUJqu4vWenc6aobH3ybTyO9eptqPtuVxBVTP563ZR-2FzVKi1Q9iUHZp9YPb9l3FJKA2XNRGWi6in761kmJ9Wrl75P5DUZ9ZUSUgV8TuyrYAP0-2F0KHmNd3Yq2jNEtfclwtiQAd-2BL-2BazTi1Ve2iczSSve9ywcBqLAZWvcpIo3lEYnUwkmeU-3D HTTP 302
    http://taengball.co/$/apdf/index.php Page URL
  2. http://taengball.co/$/apdf/view.php?email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u16209677.ct.sendgrid.net/ls/click?upn=CrEKzPKrKTWfroD-2BPmFai1aYiZAN-2FD-2BraT1zibOK90bI-2FqnlceR4bTWu8xwNPHaRtJVp_QYqlokheGy8WQy5Jdm31QUa7H4-2B4W85l84Pbh6mbezsO8r6pSoZ2YhCUGLJpUJqu4vWenc6aobH3ybTyO9eptqPtuVxBVTP563ZR-2FzVKi1Q9iUHZp9YPb9l3FJKA2XNRGWi6in761kmJ9Wrl75P5DUZ9ZUSUgV8TuyrYAP0-2F0KHmNd3Yq2jNEtfclwtiQAd-2BL-2BazTi1Ve2iczSSve9ywcBqLAZWvcpIo3lEYnUwkmeU-3D HTTP 302
  • http://taengball.co/$/apdf/index.php

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set index.php
taengball.co/$/apdf/
Redirect Chain
  • https://u16209677.ct.sendgrid.net/ls/click?upn=CrEKzPKrKTWfroD-2BPmFai1aYiZAN-2FD-2BraT1zibOK90bI-2FqnlceR4bTWu8xwNPHaRtJVp_QYqlokheGy8WQy5Jdm31QUa7H4-2B4W85l84Pbh6mbezsO8r6pSoZ2YhCUGLJpUJqu4vWenc6...
  • http://taengball.co/$/apdf/index.php
2 KB
2 KB
Document
General
Full URL
http://taengball.co/$/apdf/index.php
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
561d91abaae7105bf6621ddb02d50cb74701f3e891169a18bf59e648d7839f76

Request headers

Host
taengball.co
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:36 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d9bffad038798a6d86dcb8521d240dfe51591144416; expires=Fri, 03-Jul-20 00:33:36 GMT; path=/; domain=.taengball.co; HttpOnly; SameSite=Lax
Vary
Accept-Encoding,User-Agent
CF-Cache-Status
DYNAMIC
cf-request-id
0319321b590000c2f4d40fb200000001
Server
cloudflare
CF-RAY
59d552d88adac2f4-FRA
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Wed, 03 Jun 2020 00:33:36 GMT
Content-Type
text/html; charset=utf-8
Content-Length
59
Connection
keep-alive
Location
http://taengball.co/$/apdf/index.php
X-Robots-Tag
noindex, nofollow
loader.gif
taengball.co/$/apdf/files/
4 KB
4 KB
Image
General
Full URL
http://taengball.co/$/apdf/files/loader.gif
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/index.php
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19

Request headers

Referer
http://taengball.co/$/apdf/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:36 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2515
ETag
"5ed58df3-e85"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
59d552d9ac84c2f4-FRA
Content-Length
3717
cf-request-id
0319321c0d0000c2f4d4109200000001
pobg.gif
dis.disasterfreehosting.com/~crescen1/img/
0
0
Image
General
Full URL
https://dis.disasterfreehosting.com/~crescen1/img/pobg.gif
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/index.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.16.252.49 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
dis.disasterfreehosting.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://taengball.co/$/apdf/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Primary Request Cookie set view.php
taengball.co/$/apdf/
5 KB
2 KB
Document
General
Full URL
http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73d5802bb3882bd1a8732d68ff19a0210e4456b651a14730de0a848b3121cb91

Request headers

Host
taengball.co
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://taengball.co/$/apdf/index.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://taengball.co/$/apdf/index.php

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=df88b0eaadaa54b9d25ff9af7e6b03b871591144418; expires=Fri, 03-Jul-20 00:33:38 GMT; path=/; domain=.taengball.co; HttpOnly; SameSite=Lax
Vary
Accept-Encoding,User-Agent
CF-Cache-Status
DYNAMIC
cf-request-id
03193226300000c2f4d4194200000001
Server
cloudflare
CF-RAY
59d552e9eaddc2f4-FRA
Content-Encoding
gzip
bootstrap.min.css
taengball.co/$/apdf/files/
118 KB
20 KB
Stylesheet
General
Full URL
http://taengball.co/$/apdf/files/bootstrap.min.css
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61c23502ff4c86909ed9c218124f2fc3312868e35d62532b7e26d08d345bf4fc

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2513
ETag
W/"5ed58df3-1d96f"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
59d552eb0c88c2f4-FRA
cf-request-id
03193226e70000c2f4d419f200000001
jquery.min.js
taengball.co/$/apdf/files/
85 KB
30 KB
Script
General
Full URL
http://taengball.co/$/apdf/files/jquery.min.js
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2388
ETag
W/"5ed58df3-15283"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
59d552eb1bb60618-FRA
cf-request-id
03193226ec000006187a3fe200000001
bootstrap.min.js
taengball.co/$/apdf/files/
36 KB
10 KB
Script
General
Full URL
http://taengball.co/$/apdf/files/bootstrap.min.js
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2394
ETag
W/"5ed58df3-90b5"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
59d552eb1fdf9736-FRA
cf-request-id
03193226ed00009736340b9200000001
logo.jpg
taengball.co/$/apdf/files/
48 KB
48 KB
Image
General
Full URL
http://taengball.co/$/apdf/files/logo.jpg
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15376a8c2c600eb1b8540675810ef7cdbcaf862bb0f95beec18a4752dd621542

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2509
ETag
"5ed58df3-be33"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
59d552eb3c010618-FRA
Content-Length
48691
cf-request-id
0319322703000006187a000200000001
favicon.png
taengball.co/$/apdf/files/
2 KB
3 KB
Image
General
Full URL
http://taengball.co/$/apdf/files/favicon.png
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
577fe7b23b3663e2cdd2b57d7bb849558097e1c025405ba95b289f18b20d832a

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2509
ETag
"5ed58df3-9f2"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
59d552eb4ff79736-FRA
Content-Length
2546
cf-request-id
031932270b00009736340bb200000001
footer.png
taengball.co/$/apdf/files/
4 KB
4 KB
Image
General
Full URL
http://taengball.co/$/apdf/files/footer.png
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45b184735aabdf9b87d5712ba0b0ed0a4b38045fd99f03e5a7caec65f039abad

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2508
ETag
"5ed58df3-ea2"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
59d552eb4c1a0618-FRA
Content-Length
3746
cf-request-id
0319322710000006187a004200000001
background.jpg
taengball.co/$/apdf/files/
98 KB
98 KB
Image
General
Full URL
http://taengball.co/$/apdf/files/background.jpg
Requested by
Host: taengball.co
URL: http://taengball.co/$/apdf/view.php?email=
Protocol
HTTP/1.1
Server
2606:4700:3037::6818:6ccd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc833d925ec2b6e359a581787185194bca173e3085ed86399ce452003cdfb6f2

Request headers

Referer
http://taengball.co/$/apdf/view.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 03 Jun 2020 00:33:39 GMT
CF-Cache-Status
HIT
Last-Modified
Mon, 01 Jun 2020 23:23:31 GMT
Server
cloudflare
Age
2390
ETag
"5ed58df3-18691"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
59d552eb5d19c2f4-FRA
Content-Length
99985
cf-request-id
03193227130000c2f4d41a0200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
.taengball.co/ Name: __cfduid
Value: df88b0eaadaa54b9d25ff9af7e6b03b871591144418