![](/screenshots/c66e9f2c-0e19-4503-8422-ee035e6bf3b6.png)
certified-domain.cloudsurveillance.net
Open in
urlscan Pro
34.200.105.26
Malicious Activity!
Public Scan
Effective URL: https://certified-domain.cloudsurveillance.net/c40120cd-64b3-4c15-b6dd-a280fb70fe3e
Submission: On July 09 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on January 8th 2024. Valid for: a year.
This is the only time certified-domain.cloudsurveillance.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 34.200.105.26 34.200.105.26 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 162.159.128.61 162.159.128.61 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 3 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-105-26.compute-1.amazonaws.com
service-noreply.info | |
certified-domain.cloudsurveillance.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
cloudsurveillance.net
certified-domain.cloudsurveillance.net |
190 KB |
1 |
vimeo.com
player.vimeo.com — Cisco Umbrella Rank: 3315 |
|
1 |
service-noreply.info
1 redirects
service-noreply.info — Cisco Umbrella Rank: 363680 |
1 KB |
7 | 3 |
Domain | Requested by | |
---|---|---|
6 | certified-domain.cloudsurveillance.net |
certified-domain.cloudsurveillance.net
|
1 | player.vimeo.com |
certified-domain.cloudsurveillance.net
|
1 | service-noreply.info | 1 redirects |
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
certified-domain.cloudsurveillance.net Amazon RSA 2048 M03 |
2024-01-08 - 2025-02-05 |
a year | crt.sh |
player.vimeo.com E1 |
2024-05-27 - 2024-08-25 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://certified-domain.cloudsurveillance.net/c40120cd-64b3-4c15-b6dd-a280fb70fe3e
Frame ID: 53DEA6454630BD251FF718D07C22B621
Requests: 7 HTTP requests in this frame
Frame:
https://player.vimeo.com/video/316118722
Frame ID: 7863BBDC3481AAD88ECE2302974DF8C1
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/c66e9f2c-0e19-4503-8422-ee035e6bf3b6.png)
Page Title
Sign in or Register | eBayPage URL History Show full URLs
-
https://service-noreply.info/4ae8d221e7aa7387ccd32da46f374a2638828abe
HTTP 301
https://certified-domain.cloudsurveillance.net/c40120cd-64b3-4c15-b6dd-a280fb70fe3e Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://service-noreply.info/4ae8d221e7aa7387ccd32da46f374a2638828abe
HTTP 301
https://certified-domain.cloudsurveillance.net/c40120cd-64b3-4c15-b6dd-a280fb70fe3e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
c40120cd-64b3-4c15-b6dd-a280fb70fe3e
certified-domain.cloudsurveillance.net/ Redirect Chain
|
19 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
certified-domain.cloudsurveillance.net/js/external/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
certified-domain.cloudsurveillance.net/js/external/ |
18 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
certified-domain.cloudsurveillance.net/js/external/ |
47 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vimeo.min.js
certified-domain.cloudsurveillance.net/js/external/ |
19 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
316118722
player.vimeo.com/video/ Frame 7863 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
4ae8d221e7aa7387ccd32da46f374a2638828abe
certified-domain.cloudsurveillance.net/ |
0 617 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery function| Popper object| bootstrap object| Vimeo boolean| VimeoPlayerResizeEmbeds_ object| popup function| onPageLoaded function| processPlayer function| switchToHookedPage function| checkForAccuracyOrSubmitForm function| submitForm function| closeWindow6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
service-noreply.info/ | Name: XSRF-TOKEN Value: eyJpdiI6ImxkeGswOU5ZZTZrTDVUQUZob2dYWFE9PSIsInZhbHVlIjoicUwzTUtvaks2N0lvSTBwWVZnWnhYa3k0ZGJHaGk5KytyT0NiYlJmaTdPdDN4MzY2cUxrRHpnbnphbkUvZ01aejdqVVBBcFBzVFlKZVpOdUZqZ3ZIdkJUTHdlR1lPbTUzOXg2SU52TTVndzNjdk1sVk8zN1hoV3lyTzhjQVE3WEwiLCJtYWMiOiIzZTI4ZDBkNGVmZThkZWUxOTFkZmRlZjBiMGYzYjE2MDVlODlmNGM2MTQ2Yjc3YzIyODYzYmFjMmQxZWJmZWUxIiwidGFnIjoiIn0%3D |
|
service-noreply.info/ | Name: bpid_lp_session Value: QpnykfWiEwsLGSbLfPbGWAgb7ri0XYZ6iLt0WPqF |
|
certified-domain.cloudsurveillance.net/ | Name: bpid_lp_session Value: m3UPo5L5h3uOkSNmLPVYl6BLtTSdxkSXvHdj10Z7 |
|
certified-domain.cloudsurveillance.net/ | Name: XSRF-TOKEN Value: eyJpdiI6IkNEUktCTlkvT0loVVpwMzlMWkJ4Q0E9PSIsInZhbHVlIjoiQzB6SEJFY0FrcG9FNy81bEc1OXpOdGpWcS9WUG1qRVVSRHIxdlowd0RaYjBNOURJRDRUeWQ1ajg2RDI1bDhnL2R3UHAyUU1MVmh1VGFqNGJlTEwwbHhxN0h6a2h6Q1R6dnFWWlRIWU8rRm1Wd3ZydWpJSCtkTHlCWW83U0ZFV0oiLCJtYWMiOiJmNTYyOTMwMTUzNjUwNmE4Yzk3YjY2ZjE1OGI5YThlZjkzZTZmZDgwYmM5MjY2OWRmZTA0ZGVjN2MxYWIyZDVlIiwidGFnIjoiIn0%3D |
|
.vimeo.com/ | Name: vuid Value: pl1305691336.1410746511 |
|
.vimeo.com/ | Name: _cfuvid Value: yT4zXGvkL2LJXdRgOVKqmvhAddc492f06lqhF4oIX4M-1720539885619-0.0.1.1-604800000 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
certified-domain.cloudsurveillance.net
player.vimeo.com
service-noreply.info
162.159.128.61
34.200.105.26
67a0b97b9a3399b8aef0ea8fd890d64d4487e84d509fc3f1812b974d61c5328e
b99285911c88d18e1b2084ce286992fd5a2744c744f74969f8e52ab34fb625a8
beccbd3e79b2d41bea5f3a0c7005810415d08f6224e7ead28913a2f49e8b5125
d9ec6c98a544f75a0dfb832dc7109e57fb1283f765741a4fe52d82b0dfd57a71
e27c54caa689e684beb7152f883c9238b96d5b38d97a738e6f6c699483ef163c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a180e9705774d9b9cc06d39d4142d1a426759e1f75b5cdde0995f64247780c