webmailstoragesrvr4567-supportdev.codeanyapp.com
Open in
urlscan Pro
198.199.109.95
Malicious Activity!
Public Scan
Effective URL: https://webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/index.html?emailtoken=3D&domain=3D
Submission: On January 09 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 20th 2021. Valid for: a year.
This is the only time webmailstoragesrvr4567-supportdev.codeanyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Square (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 198.199.109.95 198.199.109.95 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2606:50c0:800... 2606:50c0:8000::153 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 3.232.242.170 3.232.242.170 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 194.62.157.86 194.62.157.86 | 30823 (COMBAHTON...) (COMBAHTON combahton GmbH) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:827::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2004 | 15169 (GOOGLE) (GOOGLE) | |
19 | 7 |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com
webmailstoragesrvr4567-supportdev.codeanyapp.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-242-170.compute-1.amazonaws.com
api.ipify.org |
ASN30823 (COMBAHTON combahton GmbH, DE)
PTR: rs-zap791673-1.zap-srv.com
api.apbmedia3.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
codeanyapp.com
webmailstoragesrvr4567-supportdev.codeanyapp.com |
9 KB |
1 |
gstatic.com
t1.gstatic.com |
978 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 8 |
374 B |
1 |
apbmedia3.com
api.apbmedia3.com |
224 B |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3301 |
287 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 258 |
30 KB |
1 |
github.io
cellyru.github.io |
13 KB |
19 | 7 |
Domain | Requested by | |
---|---|---|
8 | webmailstoragesrvr4567-supportdev.codeanyapp.com |
webmailstoragesrvr4567-supportdev.codeanyapp.com
|
1 | t1.gstatic.com | |
1 | www.google.com | 1 redirects |
1 | api.apbmedia3.com |
webmailstoragesrvr4567-supportdev.codeanyapp.com
|
1 | api.ipify.org |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
webmailstoragesrvr4567-supportdev.codeanyapp.com
|
1 | cellyru.github.io |
webmailstoragesrvr4567-supportdev.codeanyapp.com
cellyru.github.io |
19 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.codeanyapp.com Sectigo RSA Domain Validation Secure Server CA |
2021-08-20 - 2022-08-20 |
a year | crt.sh |
www.github.com DigiCert SHA2 High Assurance Server CA |
2020-05-06 - 2022-04-14 |
2 years | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2021-01-19 - 2022-02-19 |
a year | crt.sh |
api.apbmedia3.com R3 |
2022-01-02 - 2022-04-02 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/index.html?emailtoken=3D&domain=3D
Frame ID: 91D96319A8CFB041A5240313AB93CE90
Requests: 18 HTTP requests in this frame
Frame:
https://api.apbmedia3.com/api/render?output=screenshot&viewport.isLandscape=true&viewport.width=1500&url=https://3D
Frame ID: 7B6F7CADDAC85C5F2815FCD68660D23C
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Sign InPage URL History Show full URLs
- https://webmailstoragesrvr4567-supportdev.codeanyapp.com/?user=3D Page URL
- https://webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/index.html?emailtoken=3D&domain=3D Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://webmailstoragesrvr4567-supportdev.codeanyapp.com/?user=3D Page URL
- https://webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/index.html?emailtoken=3D&domain=3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 17- https://www.google.com/s2/favicons?domain=3D HTTP 301
- https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://3D&size=16
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
webmailstoragesrvr4567-supportdev.codeanyapp.com/ |
15 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/ |
979 B 713 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b64.js
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/ |
1 KB 677 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
cellyru.github.io/css-july21/ |
73 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js.download
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/Sign%20In_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.js.download
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/Sign%20In_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sentry.js.download
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/Sign%20In_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sentry.js.download
webmailstoragesrvr4567-supportdev.codeanyapp.com/blue/Sign%20In_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
22 B 287 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-regular.otf
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-medium.otf
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-medium.woff
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-regular.woff
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-medium.ttf
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sqmarket-regular.ttf
cellyru.github.io/fonts/sqmarket/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
render
api.apbmedia3.com/api/ Frame 7B6F |
88 B 224 B |
Document
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2
t1.gstatic.com/ Redirect Chain
|
726 B 978 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-regular.otf
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-medium.otf
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-medium.woff
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-regular.woff
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-medium.ttf
- Domain
- cellyru.github.io
- URL
- https://cellyru.github.io/fonts/sqmarket/sqmarket-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Square (Financial)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onsecuritypolicyviolation object| onslotchange object| b64 object| apiVersions string| hash string| data object| urlDataObject object| api function| $ function| jQuery function| ChangeFavicon string| str string| navUserAgent string| browserName string| browserVersion number| majorVersion undefined| tempNameOffset number| tempVersionOffset number| tempVersion string| aggents function| checkForm undefined| str1 undefined| str2 undefined| str30 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
20 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.apbmedia3.com
api.ipify.org
cellyru.github.io
t1.gstatic.com
webmailstoragesrvr4567-supportdev.codeanyapp.com
www.google.com
cellyru.github.io
194.62.157.86
198.199.109.95
2606:50c0:8000::153
2a00:1450:4001:808::2004
2a00:1450:4001:827::2004
2a00:1450:4001:828::200a
3.232.242.170
51cf2c08e194edca1fb9f3847a881466478e532ffda627c5a8ff2bb4b6ce0841
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
5f356f617ffb259a86eeea4802c52587cf8c841c13b66d70190681152bfa5a65
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
899baa63c09af0c8355c5118923c8e42f3692be65f1bad5a956add33f0653582
ae53ed566b5e868927fc7051483be68d1c6e4fcf75493dc5909f69da321834de
b0dda14a05235bdb5d63b82929f8cd3c4bdb2095fa59415bf93dca6449f5b16d
c52b4bf8f815b011871cd68b5084fd578aacb37abefc0b34131e03fd23061c35
e4788f4bb769b1fed135d3ebbd55f3a1bf84315eb8999fda4363de460288c162