wardding.formjelly.com
Open in
urlscan Pro
34.83.64.96
Malicious Activity!
Public Scan
Submission: On July 25 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 27th 2022. Valid for: 3 months.
This is the only time wardding.formjelly.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 34.83.64.96 34.83.64.96 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2a00:1450:400... 2a00:1450:400e:810::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
8 | 4 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 96.64.83.34.bc.googleusercontent.com
wardding.formjelly.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
formjelly.com
wardding.formjelly.com |
127 KB |
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1166 |
2 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 72 |
1 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
5 | wardding.formjelly.com |
wardding.formjelly.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | aadcdn.msftauth.net |
wardding.formjelly.com
|
1 | fonts.googleapis.com |
wardding.formjelly.com
|
8 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
formjelly.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.formjelly.com R3 |
2022-05-27 - 2022-08-25 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-07-04 - 2022-09-26 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2022-04-01 - 2023-04-01 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-07-04 - 2022-09-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wardding.formjelly.com/f/gbtlqt
Frame ID: 8EB1BD6155C2733FC1C250110CD3E9F0
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Formjelly FormDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: made with
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
gbtlqt
wardding.formjelly.com/f/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-b8370b9556f1bcc256b9ebd43e85e3a9.css
wardding.formjelly.com/css/ |
369 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
auth.css
wardding.formjelly.com/css/ |
328 B 229 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
made-with.png
wardding.formjelly.com/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
survey-5a3bba4d1f298591866da9b70f0389b1.js
wardding.formjelly.com/js/ |
135 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| flatpickr0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
fonts.googleapis.com
fonts.gstatic.com
wardding.formjelly.com
152.199.23.37
2a00:1450:4001:812::2003
2a00:1450:400e:810::200a
34.83.64.96
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
3323802b91392d1d27c41e45bf13c6afad9ec2e86a5d5eb019df12ca69657b94
48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836
4ee0018c8d7ff49e0cd5a58544189f4b4f3939c26a0251b4722851a42f70b33f
7a631feb58889d34733e677f9c4892c1b7d4d2cc10990961513be43adbeefee9
9e8f43be120cf64eea30f0680832a2af1c6c7e15368bebebb58350f377cde90d
c3277a2eadea4248504fdd214af09a8cdf981239fe5a73cc878a7a1c5cc3fd16
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615