cpanel16wh.bkk1.cloud.z.com
Open in
urlscan Pro
163.44.198.71
Malicious Activity!
Public Scan
Effective URL: https://cpanel16wh.bkk1.cloud.z.com/~cp670476/poonsup.com/appweb/spoofi/Issued/settings/
Submission: On March 28 via api from AU — Scanned from FR
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 15th 2024. Valid for: 3 months.
This is the only time cpanel16wh.bkk1.cloud.z.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Spotify (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a01:e0c:1:15... 2a01:e0c:1:1599::29 | 12322 (PROXAD) (PROXAD) | |
1 2 | 163.44.198.71 163.44.198.71 | 135161 (GMO-Z-COM...) (GMO-Z-COM-TH GMO-Z com NetDesign Holdings Co.) | |
2 | 2 |
ASN135161 (GMO-Z-COM-TH GMO-Z com NetDesign Holdings Co., Ltd., JP)
PTR: cpanel16wh.bkk1.cloud.z.com
cpanel16wh.bkk1.cloud.z.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
z.com
1 redirects
cpanel16wh.bkk1.cloud.z.com |
374 KB |
1 |
free.fr
1 redirects
s.free.fr |
232 B |
2 | 2 |
Domain | Requested by | |
---|---|---|
2 | cpanel16wh.bkk1.cloud.z.com | 1 redirects |
1 | s.free.fr | 1 redirects |
2 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
accounts.spotify.com |
www.spotify.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpanel16wh.bkk1.cloud.z.com cPanel, Inc. Certification Authority |
2024-02-15 - 2024-05-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://cpanel16wh.bkk1.cloud.z.com/~cp670476/poonsup.com/appweb/spoofi/Issued/settings/
Frame ID: 62CE0A93E7CEBF8D2ABBD873156E290C
Requests: 6 HTTP requests in this frame
Frame:
data://truncated
Frame ID: ACF6697BCBAED3497FBB56CF636F0449
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Login - SpotifyPage URL History Show full URLs
-
https://s.free.fr/3CF32rUP
HTTP 301
https://cpanel16wh.bkk1.cloud.z.com/~cp670476/RAMD/ HTTP 302
https://cpanel16wh.bkk1.cloud.z.com/~cp670476/poonsup.com/appweb/spoofi/Issued/settings/ Page URL
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Terms & Conditions
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://s.free.fr/3CF32rUP
HTTP 301
https://cpanel16wh.bkk1.cloud.z.com/~cp670476/RAMD/ HTTP 302
https://cpanel16wh.bkk1.cloud.z.com/~cp670476/poonsup.com/appweb/spoofi/Issued/settings/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
cpanel16wh.bkk1.cloud.z.com/~cp670476/poonsup.com/appweb/spoofi/Issued/settings/ Redirect Chain
|
373 KB 374 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
353 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
74 KB 74 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 KB 68 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
72 KB 72 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame ACF6 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Spotify (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onpagereveal1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cpanel16wh.bkk1.cloud.z.com/ | Name: PHPSESSID Value: g98u3m00nap31odlf069lv7940 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cpanel16wh.bkk1.cloud.z.com
s.free.fr
163.44.198.71
2a01:e0c:1:1599::29
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
372cd0fe98167ffc57b624aed00ab6f53e89bd8cf5690867c1a786983ceec95b
4affce2cbaf847a5ca93588c90b23e482118bb1314d0fdf11bb67f9ee7592cc7
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
94a441841a7b0b96eec17260ee6f2e5da5ce7b71a6e9e2276e2bf323a8998e3e
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758