www.my-1passwordc.com Open in urlscan Pro
194.31.9.4  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.my-1passwordc.com/	1 MB 161 KB	613ms 54ms	Document text/html	194.31.9.4 HYPERGUARD-AS
General Check archive.org Show headers Download Go to Full URL https://www.my-1passwordc.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 194.31.9.4 , Hong Kong, ASN211343 (HYPERGUARD-AS, NL), Reverse DNS Software nginx/1.22.0 / PHP/7.3.31-1~deb10u1 Resource Hash 2767593f9035821c0942b4861912154b4e5ae15d3e9d0e22cc9c72adde484c95 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Sat, 27 Aug 2022 01:22:02 GMT Server nginx/1.22.0 Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/7.3.31-1~deb10u1
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	57ms 12ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: www.my-1passwordc.com URL: https://www.my-1passwordc.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://www.my-1passwordc.com/ Origin https://www.my-1passwordc.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sat, 27 Aug 2022 01:22:02 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15d9d" vary Accept-Encoding x-hw 1661563322.dop154.fr8.t,1661563322.cds012.fr8.hn,1661563322.cds144.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET DATA	200 OK	truncated /	333 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 204ae24d0b9c95793fd4a50dcd57431232686f301d2a3fe3cd90dc85fc7228f6 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a7527e1b5dc4e8da48186a4c49bdc8f0562fd2a58ad5fce6ddab316aa4d75eb2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 59c9e16c52a50c59a22b8a3aef3a98ff5744ef6e60576ec307e788fb5905596e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1Password (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| savepage_ShadowLoader function| check

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
www.my-1passwordc.com
194.31.9.4
2001:4de0:ac18::1:a:2b
204ae24d0b9c95793fd4a50dcd57431232686f301d2a3fe3cd90dc85fc7228f6
2767593f9035821c0942b4861912154b4e5ae15d3e9d0e22cc9c72adde484c95
59c9e16c52a50c59a22b8a3aef3a98ff5744ef6e60576ec307e788fb5905596e
a7527e1b5dc4e8da48186a4c49bdc8f0562fd2a58ad5fce6ddab316aa4d75eb2
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e