worker-account-review-c405.gatopa3681.workers.dev Open in urlscan Pro
2606:4700:3031::ac43:a108 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://worker-account-review-c405.gatopa3681.workers.dev/
Submission: On January 13 via api (January 13th 2024, 9:19:09 am UTC) from LU — Scanned from DE

Summary HTTP 14 Redirects Links 36 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3031::ac43:a108, located in United States and belongs to CLOUDFLARENET, US. The main domain is worker-account-review-c405.gatopa3681.workers.dev.
TLS certificate: Issued by E1 on January 8th 2024. Valid for: 3 months.

This is the only time worker-account-review-c405.gatopa3681.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CapitalOne (Financial)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3031::ac43:a108	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3038::6815:ebb5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	23.53.43.122 23.53.43.122	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
14	4

2 2606:4700:3031::ac43:a108 (United States)

ASN13335 (CLOUDFLARENET, US)

worker-account-review-c405.gatopa3681.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::6815:ebb5 (United States)

ASN13335 (CLOUDFLARENET, US)

www.linkpicture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 23.53.43.122 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-43-122.deploy.static.akamaitechnologies.com

ecm.capitalone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	capitalone.com ecm.capitalone.com — Cisco Umbrella Rank: 13016	93 KB
2	workers.dev worker-account-review-c405.gatopa3681.workers.dev	55 KB
1	linkpicture.com www.linkpicture.com — Cisco Umbrella Rank: 422586
14	3

	Domain	Requested by
11	ecm.capitalone.com	worker-account-review-c405.gatopa3681.workers.dev
2	worker-account-review-c405.gatopa3681.workers.dev	worker-account-review-c405.gatopa3681.workers.dev
1	www.linkpicture.com	worker-account-review-c405.gatopa3681.workers.dev
14	3

This site contains links to these domains. Also see Links.

Domain
www.capitalone.com
www.capitalone.co.uk
verified.capitalone.com
www.capitalone.ca
phx.corporate-ir.net
press.capitalone.com
diversity.capitalone.com
www.capitalonecareers.com
twitter.com
www.facebook.com
www.youtube.com
www.linkedin.com
www.instagram.com
www.fdic.gov

Subject Issuer	Validity	Valid
gatopa3681.workers.dev E1	`2024-01-08` - `2024-04-07`	3 months	crt.sh
linkpicture.com E1	`2023-12-09` - `2024-03-08`	3 months	crt.sh
ecm.capitalone.com DigiCert EV RSA CA G2	`2023-06-23` - `2024-06-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://worker-account-review-c405.gatopa3681.workers.dev/
Frame ID: 2C0B32E99D6A82FAD2DE5C98DF822D05
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

148 kB
Transfer

584 kB
Size

0
Cookies

36 Outgoing links

These are links going to different origins than the main page.

URL: https://www.capitalone.com/

Search URL Search Domain Scan URL

URL: https://www.capitalone.co.uk/myaccount/secure/sign-in.jsf
Title: United Kingdom

Search URL Search Domain Scan URL

URL: https://verified.capitalone.com/auth/null
Title: Forgot Username or Password?

Search URL Search Domain Scan URL

URL: https://verified.capitalone.com/auth/signin
Title: Set Up Online Access

Search URL Search Domain Scan URL

URL: https://verified.capitalone.com/auth/other-products
Title: Business or Commercial

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/credit-cards/
Title: Personal Credit Cards

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/credit-cards/business/
Title: Business Credit Cards

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/bank/
Title: Personal Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/small-business-bank/
Title: Small Business Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/commercial/
Title: Commercial Banking

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/auto-financing/
Title: Auto Loans

Search URL Search Domain Scan URL

URL: http://www.capitalone.ca/
Title: Canada

Search URL Search Domain Scan URL

URL: http://www.capitalone.co.uk/
Title: UK

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/
Title: About Capital One

Search URL Search Domain Scan URL

URL: http://phx.corporate-ir.net/phoenix.zhtml?c=70667&p=irol-irhome
Title: Investors

Search URL Search Domain Scan URL

URL: http://press.capitalone.com/phoenix.zhtml?c=251626&p=irol-overview
Title: Press

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/investingforgood/
Title: Investing for Good

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/financial-education/
Title: Financial Education

Search URL Search Domain Scan URL

URL: https://diversity.capitalone.com/inclusion/
Title: Diversity & Inclusion

Search URL Search Domain Scan URL

URL: https://www.capitalonecareers.com/
Title: Search Jobs

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/military/
Title: Service members Civil Relief Act

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/media/doc/corporate/foreign-bank-account-certification-Capital-One.pdf
Title: Patriot Act Cert

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/subpoena-policy/
Title: Subpoena Policy

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/disclosures/
Title: Additional Disclosures

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/contact/
Title: Contact Us

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/identity-protection/privacy/
Title: Privacy

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/identity-protection/commitment/
Title: Security

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/legal/terms-conditions/
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/about/accessibility-commitment/
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://twitter.com/capitalone

Search URL Search Domain Scan URL

URL: https://www.facebook.com/capitalone

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/CapitalOne

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/capital-one

Search URL Search Domain Scan URL

URL: https://www.instagram.com/capitalone/

Search URL Search Domain Scan URL

URL: http://www.capitalone.com/

Search URL Search Domain Scan URL

URL: http://www.fdic.gov/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response worker-account-review-c405.gatopa3681.workers.dev/	245 KB 28 KB	535ms 51ms	Document text/html	2606:4700:3031::ac43:a108 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:a108 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c9523f6f70cc92b3b5e850f765273b13a5a3b8b36617ef12a14f1b0b3a2369b2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-ray 844c8e35c9ed99ba-CDG content-encoding br content-type text/html;charset=UTF-8 date Sat, 13 Jan 2024 09:19:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CfEKOB6aexc1g%2FGxRR%2FphzWQkwhQySJJeIX9BEiS37VHJcqPfIiEZJKnoOe0hEQe4Ugsd2qlxEDB53ebE3HP65tk46gVq0XW39lqaS9A53cYwV8u0Olvl5PnqN%2F4WBlWQ0Q5DZvd95gnrBvHQEfEEIJDj0zvS1MfC%2BsUYlM%2F3PcRH1EnHSbYKe3mFcg1evEL"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	serverComponent.php Show response worker-account-review-c405.gatopa3681.workers.dev/index_files/	245 KB 27 KB	56ms 55ms	Script text/html	2606:4700:3031::ac43:a108 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://worker-account-review-c405.gatopa3681.workers.dev/index_files/serverComponent.php Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:a108 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c9523f6f70cc92b3b5e850f765273b13a5a3b8b36617ef12a14f1b0b3a2369b2` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers date Sat, 13 Jan 2024 09:19:04 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=otolxCUu%2BXdezkJ1bPzkp8SYbYSBqR6tbW3b2JsLsqw1xKVpRESeq5nnwV6bAzD1zJVg%2BSJvWJgZ8uX4e0QQPjN9rkK2%2FgSJAQiKyQcwDyQbOFAkh8e3pT9MgqM2uiQ3IU0yvjr%2FjDjJHs4OtBxoUpL4ddQKLyh1yC3cmZnLFG4%2F7nNGsHCfm%2FCSzkvFsKpV"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 844c8e36eb6199ba-CDG alt-svc h3=":443"; ma=86400
GET H2	404	icon-user.svg www.linkpicture.com/q/	0 0	353ms 247ms	Image text/html	2606:4700:3038::6815:ebb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.linkpicture.com/q/icon-user.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:ebb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `851482af290e1c99e97ad3a6e4bf119c76643f3522ceb53f12951a2132329fe8` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	96 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2814ae645f0912212718a9e26255a2794a76096ac59f1a45adc32b64e6de7c5d` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	twitter-social.svg ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/	1 KB 1 KB	155ms 39ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/twitter-social.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `d1b4860dcce83c4c73736dedeafe3b09403b267d087ef721a35dbffd5e564c68` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id WY8VBzDyq7FctDDX8MrQBW0rTz7Flw8l content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:04 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 734 last-modified Fri, 28 Jun 2019 00:26:05 GMT server AmazonS3 etag W/"c2f1acf6f29c52f793f66b65ba91d49f" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=717774 access-control-allow-credentials false access-control-allow-headers * x-amz-cf-id ZroAwm0az6utrip3wUCGcbmv85E4VBdq34OwB6OyIsizN8M4HSabAg== expires Sun, 21 Jan 2024 16:41:58 GMT
GET H2	200	facebook-social.svg ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/	431 B 770 B	155ms 39ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/facebook-social.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `b312fb49b19387ededa2729f0c384686ce7c83811b0ea0367ef63767e612da03` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id sp5rcJ_CixBIFs_Kbc9AtTIkRc82cd4R content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:04 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 282 last-modified Fri, 28 Jun 2019 00:26:05 GMT server AmazonS3 etag "e43c5a7e7fb8c3c12579162a4986b1ad" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=2059326 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id QggxwpsUKvKHRDfqkbOxWPsJKiEmI2OyJS2Y4OI41BxrAYjW_6iC8g== expires Tue, 06 Feb 2024 05:21:10 GMT
GET H2	200	you-tube-social.svg ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/	491 B 785 B	535ms 419ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/you-tube-social.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `bb29a96bd1b20b9dedd8197ce7f9a29fc742aa6555df924453b5561c6ef3564f` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id 5PqSeWnBhEvAtcPgf2XAbVZCtyvnbUxM content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:05 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 295 last-modified Fri, 28 Jun 2019 00:26:05 GMT server AmazonS3 etag "0a9ec1ae291522dcb84befe6a44c3830" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=2459319 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id RmiBNxQZQsxXyXOhnMAOeBeZvWz9zZlvQAy__E3FiIcTAe7oAHPFhw== expires Sat, 10 Feb 2024 20:27:44 GMT
GET H2	200	linkedin-social.svg ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/	605 B 838 B	156ms 40ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/linkedin-social.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `bb0c33cd3e05dfff3f5fe39c013a2afc5ddd457d3b76b0bc7ee231cf5d0f01f7` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id V4.R2G9M5ytZINKkEHFYF7hbdLSExGPo content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:04 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 349 last-modified Fri, 28 Jun 2019 00:26:05 GMT server AmazonS3 etag "4135a3d131493d86e0db3c8ad0420602" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=717707 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id -7gQ65wGUMht4Vji_xbvYK68WjczHHI21aMOpuNyX-7ZFnupKYqcbw== expires Sun, 21 Jan 2024 16:40:51 GMT
GET H2	200	instagram-social.svg ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/	2 KB 1 KB	535ms 419ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/social-icons/instagram-social.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `bb4babc75eb6ef45fd42a6fb5f50b059473aaf36c607bef28a4aedb514e238fc` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id FUfIizReL1r02BrKB1G0_CUQXIQQ79Tx content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:05 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 768 last-modified Fri, 28 Jun 2019 00:26:05 GMT server AmazonS3 etag W/"7ff5bca5e93664bc612cc91ae53ac496" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=717787 access-control-allow-credentials false access-control-allow-headers * x-amz-cf-id uE6PA48ZNrIeu2CKdD0zAuAcC75j6fX2XOb-H4bALqSch9SGYER24Q== expires Sun, 21 Jan 2024 16:42:12 GMT
GET H2	200	capital-one-logo.svg ecm.capitalone.com/CI_Common/assets/images/logos/	4 KB 2 KB	152ms 37ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/logos/capital-one-logo.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `57dfca5b95599a613da940f4a49ab6378fcf0586366a47cae679796930bf0eed` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id 8LzbBBEj8zCeatCBoYuv1q1dFFpTcVNl content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:04 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 1745 last-modified Wed, 20 Jan 2021 18:06:43 GMT server AmazonS3 etag W/"f0b7ad81821effc52540e39cafda48f9" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=1602796 access-control-allow-credentials false access-control-allow-headers * x-amz-cf-id nlurtXExhUfQq5DWydu0vi-e4JQokd--wlw53HYjKqJQ4f81pGnAPw== expires Wed, 31 Jan 2024 22:32:20 GMT
GET H2	200	www-fdic.svg ecm.capitalone.com/CI_Common/assets/images/footer/	2 KB 1 KB	149ms 41ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/www-fdic.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `017d9cf1015d4388c0069e8f2e147d998616605a8fdbb461cd964ff5cda545e3` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id 8xRP0pbuqhkFsGgLYTsgGzSHlkx4pEGg content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:04 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 958 last-modified Fri, 28 Jun 2019 00:26:06 GMT server AmazonS3 etag W/"a5b2f8771a99c2670dd5183853596b4f" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=2024333 access-control-allow-credentials false access-control-allow-headers * x-amz-cf-id ys8eabcYuwYqUDFKAszD_2YMRGACk53BfYJWaBSWxUEpU73ZzYZjlw== expires Mon, 05 Feb 2024 19:37:57 GMT
GET H2	200	www-ehl.svg ecm.capitalone.com/CI_Common/assets/images/footer/	437 B 788 B	528ms 420ms	Image image/svg+xml	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ecm.capitalone.com/CI_Common/assets/images/footer/www-ehl.svg Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `2d23c63e03fb685ed80f2554da2069dbc431720b6ed4f3f7cce579f52aaa62af` Request headers accept-language de-DE,de;q=0.9 Referer https://worker-account-review-c405.gatopa3681.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id Cfpp_Ya_3POEKViDatTY.UH0GBjWHzjx content-encoding gzip access-control-request-method POST,GET,PUT,DELETE date Sat, 13 Jan 2024 09:19:05 GMT x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 299 last-modified Fri, 28 Jun 2019 00:26:06 GMT server AmazonS3 etag "30d0ea03dfc7173265c5896affca1ad9" vary Accept-Encoding access-control-max-age 86400 content-type image/svg+xml access-control-allow-origin * access-control-allow-methods GET,POST cache-control max-age=2345824 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id bqJRjyKR6jBlaBdVeCzcvWPA36ynHDIfVMC88o1JbeDrM3smERV37Q== expires Fri, 09 Feb 2024 12:56:09 GMT
GET H2	200	Optimist_W_Lt.woff2 ecm.capitalone.com/CI_Common/assets/fonts/	27 KB 28 KB	188ms 69ms	Font binary/octet-stream	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Lt.woff2 Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `902c5a9d8ad932630fb2021fe1a1a7f4f06513b19e8d073866178ee65ff33fe9` Request headers Referer https://worker-account-review-c405.gatopa3681.workers.dev/ Origin https://worker-account-review-c405.gatopa3681.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id Q75rYxmglrbgkwTTGgaHL71RQB9n5YCD date Sat, 13 Jan 2024 09:19:04 GMT access-control-request-method POST,GET,PUT,DELETE x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 27852 last-modified Fri, 28 Jun 2019 00:26:02 GMT server AmazonS3 etag "cb37fa55f3dfdd26d61901032a53644f" access-control-max-age 86400 access-control-allow-methods GET,POST content-type binary/octet-stream access-control-allow-origin * cache-control max-age=1662178 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id h0SFw9H04k0ba6QWyTFU_BPEPDtVXRcWBuoUyOEJbHj2ICMipY8o1g== expires Thu, 01 Feb 2024 15:02:02 GMT
GET H2	200	Optimist_W_Rg.woff2 ecm.capitalone.com/CI_Common/assets/fonts/	28 KB 28 KB	212ms 94ms	Font binary/octet-stream	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_Rg.woff2 Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `9b98e19f831844b3dae8e1fd65b6802bc778446fbdacac8203e34bbc02eacbcd` Request headers Referer https://worker-account-review-c405.gatopa3681.workers.dev/ Origin https://worker-account-review-c405.gatopa3681.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id 1GgM.ruzxSoQhqV._aklwOsuyVwoqFBE date Sat, 13 Jan 2024 09:19:04 GMT access-control-request-method POST,GET,PUT,DELETE x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 28388 last-modified Fri, 28 Jun 2019 00:26:02 GMT server AmazonS3 etag "f4e1fbca28c954a486a90828b2ee7543" access-control-max-age 86400 access-control-allow-methods GET,POST content-type binary/octet-stream access-control-allow-origin * cache-control max-age=1597148 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id aWTZdtaZ2i8sTNYXlfyNpGJw4AP8_FtedViFqLScwtn2jQlqgSs-oQ== expires Wed, 31 Jan 2024 20:58:12 GMT
GET H2	200	Optimist_W_SBd.woff2 ecm.capitalone.com/CI_Common/assets/fonts/	28 KB 28 KB	152ms 34ms	Font binary/octet-stream	23.53.43.122 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ecm.capitalone.com/CI_Common/assets/fonts/Optimist_W_SBd.woff2 Requested by Host: worker-account-review-c405.gatopa3681.workers.dev URL: https://worker-account-review-c405.gatopa3681.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.43.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-43-122.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash `48b4ed4ba8ee0eaeddfba861e6772c61f818931816102636a888ec0b49bce056` Request headers Referer https://worker-account-review-c405.gatopa3681.workers.dev/ Origin https://worker-account-review-c405.gatopa3681.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers x-amz-version-id QmX7yv6RJT4hT4UTSJmqyU0reaonF3KP date Sat, 13 Jan 2024 09:19:04 GMT access-control-request-method POST,GET,PUT,DELETE x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 content-length 28188 last-modified Fri, 28 Jun 2019 00:26:02 GMT server AmazonS3 etag "d647937062406e5cc182de0cc77947d8" access-control-max-age 86400 access-control-allow-methods GET,POST content-type binary/octet-stream access-control-allow-origin * cache-control max-age=1576590 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers * x-amz-cf-id avx2KJ0q-4KRrtX_pEHqWNHkI89Sju8J8m9YYI-Ej2rOItW6KmS0Vg== expires Wed, 31 Jan 2024 15:15:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CapitalOne (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.linkpicture.com/q/icon-user.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ecm.capitalone.com
worker-account-review-c405.gatopa3681.workers.dev
www.linkpicture.com
23.53.43.122
2606:4700:3031::ac43:a108
2606:4700:3038::6815:ebb5
017d9cf1015d4388c0069e8f2e147d998616605a8fdbb461cd964ff5cda545e3
2814ae645f0912212718a9e26255a2794a76096ac59f1a45adc32b64e6de7c5d
2d23c63e03fb685ed80f2554da2069dbc431720b6ed4f3f7cce579f52aaa62af
48b4ed4ba8ee0eaeddfba861e6772c61f818931816102636a888ec0b49bce056
57dfca5b95599a613da940f4a49ab6378fcf0586366a47cae679796930bf0eed
851482af290e1c99e97ad3a6e4bf119c76643f3522ceb53f12951a2132329fe8
902c5a9d8ad932630fb2021fe1a1a7f4f06513b19e8d073866178ee65ff33fe9
9b98e19f831844b3dae8e1fd65b6802bc778446fbdacac8203e34bbc02eacbcd
b312fb49b19387ededa2729f0c384686ce7c83811b0ea0367ef63767e612da03
bb0c33cd3e05dfff3f5fe39c013a2afc5ddd457d3b76b0bc7ee231cf5d0f01f7
bb29a96bd1b20b9dedd8197ce7f9a29fc742aa6555df924453b5561c6ef3564f
bb4babc75eb6ef45fd42a6fb5f50b059473aaf36c607bef28a4aedb514e238fc
c9523f6f70cc92b3b5e850f765273b13a5a3b8b36617ef12a14f1b0b3a2369b2
d1b4860dcce83c4c73736dedeafe3b09403b267d087ef721a35dbffd5e564c68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

worker-account-review-c405.gatopa3681.workers.dev Open in urlscan Pro 2606:4700:3031::ac43:a108 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

148 kBTransfer

584 kBSize

0 Cookies

36 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

worker-account-review-c405.gatopa3681.workers.dev Open in urlscan Pro
2606:4700:3031::ac43:a108 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

148 kB
Transfer

584 kB
Size

0
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!