waistbaxi.com
Open in
urlscan Pro
2606:4700:3034::6815:20b5
Malicious Activity!
Public Scan
Effective URL: https://waistbaxi.com/sf/tpl9?logo=lidl&item=925X&sub1=6JQU&sub2=472874&sub3=3f92b024-c33d-4ed5-ac85-d24ec4bf8b95
Submission: On November 26 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by E1 on October 29th 2022. Valid for: 3 months.
This is the only time waistbaxi.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 2 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 45.60.156.36 45.60.156.36 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 50.115.175.215 50.115.175.215 | 32875 (VIRP) (VIRP) | |
1 2 | 185.176.220.11 185.176.220.11 | 39845 (LV-2CLOUD...) (LV-2CLOUD-ASN16) | |
3 | 2606:4700:303... 2606:4700:3034::6815:20b5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6812:1f4e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a04:4e42::307 2a04:4e42::307 | 54113 (FASTLY) (FASTLY) | |
4 | 2606:4700::68... 2606:4700::6812:1f8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:211... 2600:9000:211e:9c00:16:d863:1940:21 | 16509 (AMAZON-02) (AMAZON-02) | |
17 | 7 |
ASN13335 (CLOUDFLARENET, US)
performance.radar.cloudflare.com |
ASN54113 (FASTLY, US)
exactly-huge-arachnid.edgecompute.app | |
uniquely-peaceful-hagfish.edgecompute.app |
ASN13335 (CLOUDFLARENET, US)
serverless-benchmarks-rust.compute-pipe.com | |
serverless-benchmarks-js.compute-pipe.com |
ASN16509 (AMAZON-02, US)
d37vlkgj6jn9t1.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
compute-pipe.com
serverless-benchmarks-rust.compute-pipe.com — Cisco Umbrella Rank: 45533 serverless-benchmarks-js.compute-pipe.com — Cisco Umbrella Rank: 45288 |
966 B |
4 |
edgecompute.app
exactly-huge-arachnid.edgecompute.app — Cisco Umbrella Rank: 44736 uniquely-peaceful-hagfish.edgecompute.app — Cisco Umbrella Rank: 44774 |
853 B |
3 |
cloudflare.com
performance.radar.cloudflare.com — Cisco Umbrella Rank: 19522 |
6 KB |
3 |
waistbaxi.com
waistbaxi.com |
4 KB |
2 |
kngarie.com
1 redirects
kngarie.com |
2 KB |
1 |
cloudfront.net
d37vlkgj6jn9t1.cloudfront.net |
548 B |
1 |
ophylias.com
ophylias.com |
434 B |
1 |
brsafe.com.br
1 redirects
link.brsafe.com.br |
1 KB |
17 | 8 |
Domain | Requested by | |
---|---|---|
3 | performance.radar.cloudflare.com |
waistbaxi.com
performance.radar.cloudflare.com |
3 | waistbaxi.com |
kngarie.com
waistbaxi.com |
2 | uniquely-peaceful-hagfish.edgecompute.app |
waistbaxi.com
|
2 | serverless-benchmarks-js.compute-pipe.com |
waistbaxi.com
|
2 | serverless-benchmarks-rust.compute-pipe.com |
waistbaxi.com
|
2 | exactly-huge-arachnid.edgecompute.app |
waistbaxi.com
|
2 | kngarie.com |
1 redirects
ophylias.com
|
1 | d37vlkgj6jn9t1.cloudfront.net |
waistbaxi.com
|
1 | ophylias.com | |
1 | link.brsafe.com.br | 1 redirects |
17 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.cloudflare.com |
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ophylias.com Sectigo RSA Domain Validation Secure Server CA |
2022-11-01 - 2023-11-01 |
a year | crt.sh |
kngarie.com R3 |
2022-11-01 - 2023-01-30 |
3 months | crt.sh |
*.waistbaxi.com E1 |
2022-10-29 - 2023-01-27 |
3 months | crt.sh |
radar.cloudflare.com Cloudflare Inc ECC CA-3 |
2022-07-22 - 2023-07-21 |
a year | crt.sh |
*.edgecompute.app GlobalSign Atlas R3 DV TLS CA 2022 Q3 |
2022-07-22 - 2023-08-23 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-11-01 - 2023-11-01 |
a year | crt.sh |
*.cloudfront.net Amazon |
2022-02-01 - 2023-01-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://waistbaxi.com/sf/tpl9?logo=lidl&item=925X&sub1=6JQU&sub2=472874&sub3=3f92b024-c33d-4ed5-ac85-d24ec4bf8b95
Frame ID: 9979C3BACF9B606DB601993B62B63F3B
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Access deniedPage URL History Show full URLs
-
https://link.brsafe.com.br/Molce_QQ6
HTTP 301
https://ophylias.com/100587b0a201375c800//molcs Page URL
- https://kngarie.com/r/f6adc806-067c-4480-9944-ef9b13c0f671/472874/1293799013/ Page URL
-
https://kngarie.com/r2/f6adc806-067c-4480-9944-ef9b13c0f671/472874/1293799013//3f92b024-c33d-4ed...
HTTP 302
https://waistbaxi.com/sf/tpl9?logo=lidl&item=925X&sub1=6JQU&sub2=472874&sub3=3f92b024-c33d-4ed5-ac... Page URL
Detected technologies
Laravel (Web Frameworks) ExpandDetected patterns
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Troubleshooting guide
Search URL Search Domain Scan URL
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://link.brsafe.com.br/Molce_QQ6
HTTP 301
https://ophylias.com/100587b0a201375c800//molcs Page URL
- https://kngarie.com/r/f6adc806-067c-4480-9944-ef9b13c0f671/472874/1293799013/ Page URL
-
https://kngarie.com/r2/f6adc806-067c-4480-9944-ef9b13c0f671/472874/1293799013//3f92b024-c33d-4ed5-ac85-d24ec4bf8b95/?red_param_1=https%3A%2F%2Fophylias.com%2F&fctr=0
HTTP 302
https://waistbaxi.com/sf/tpl9?logo=lidl&item=925X&sub1=6JQU&sub2=472874&sub3=3f92b024-c33d-4ed5-ac85-d24ec4bf8b95 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://link.brsafe.com.br/Molce_QQ6 HTTP 301
- https://ophylias.com/100587b0a201375c800//molcs
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
molcs
ophylias.com/100587b0a201375c800// Redirect Chain
|
140 B 434 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
kngarie.com/r/f6adc806-067c-4480-9944-ef9b13c0f671/472874/1293799013/ |
735 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
tpl9
waistbaxi.com/sf/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
errors.css
waistbaxi.com/cdn-cgi/styles/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.js
performance.radar.cloudflare.com/ |
16 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
external.png
waistbaxi.com/cdn-cgi/images/ |
265 B 483 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
exactly-huge-arachnid.edgecompute.app/ |
129 B 331 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serverless-benchmarks-rust.compute-pipe.com/ |
134 B 363 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serverless-benchmarks-js.compute-pipe.com/ |
134 B 188 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
uniquely-peaceful-hagfish.edgecompute.app/ |
129 B 187 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
exactly-huge-arachnid.edgecompute.app/ |
129 B 171 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serverless-benchmarks-rust.compute-pipe.com/ |
134 B 227 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
serverless-benchmarks-js.compute-pipe.com/ |
134 B 188 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
uniquely-peaceful-hagfish.edgecompute.app/ |
129 B 164 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
d37vlkgj6jn9t1.cloudfront.net/ |
134 B 548 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
beacon
performance.radar.cloudflare.com/api/ |
15 B 277 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
beacon
performance.radar.cloudflare.com/api/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
November 26th 2022, 2:27:14 pm
UTC —
From France
Threats:
Phishing
Comment: Phishing - Website is trying to steal user credentials
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| e boolean| t boolean| r boolean| n boolean| o boolean| s function| a function| c function| h function| d function| u function| f function| p function| y function| m object| b function| w function| g function| T object| v function| E function| S object| A function| $9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
link.brsafe.com.br/ | Name: goodbye-cookie Value: 3791ace24bf3838923d96fa0295013a7|20c41e16235e551ef771483aa49ca16a |
|
link.brsafe.com.br/ | Name: XSRF-TOKEN Value: eyJpdiI6ImVWUk9aT01nWVJSbVRMaldVekhMVUE9PSIsInZhbHVlIjoiRnBBYUxNWlwvUVYzVFwvaCt5RjVtdGhLZTJNZXQ1U1VRRkQ2NlE4ckdsUlp0ZXhlUjltNUNCVkl6M0twRTNMWjRoVzVOZVhIelA0U2ZuMlR5XC9ETFpybnc9PSIsIm1hYyI6ImI3ZmVmZjAxZWNiMDE1OGNhOGQxYTg0ODNkYjZlN2YzYzRkZDZhNDc3OWQ0ZDM4YzBlYTM5YzU0YjlkNjA2NWQifQ%3D%3D |
|
link.brsafe.com.br/ | Name: laravel_session Value: eyJpdiI6IlpHU3BjdkVLSjAwMFlTMEcyaW1YQVE9PSIsInZhbHVlIjoiczFNamREc3NpMld6SXg1am5IRUFhb2E3QTVuVlZqY3phUGwrZE9PR0RzNnBhRkhLWU1jY1BQanZ3OWxOdEF2RStPXC80K2l4ZSszSitLYVwvdnBqSjhodz09IiwibWFjIjoiNTQwN2QwMWFkNTljMmFhMzIzNzA1YzIyZDlmMTc3MzVhNmJmZTk0ZmQ3ZWE3MzA5N2I2NDgxNWJhOWNhYzc3OCJ9 |
|
link.brsafe.com.br/ | Name: SERVERID Value: oci_eec_ing_prd|Y4IiE|Y4IiE |
|
.brsafe.com.br/ | Name: visid_incap_2660497 Value: /tp10JEfRzWn0InyJDzzCQ0igmMAAAAAQUIPAAAAAADYxqPGR+KK58T2tLci3gyJ |
|
.brsafe.com.br/ | Name: incap_ses_464_2660497 Value: YAA/RpNR+lGZm8QyY3ZwBg4igmMAAAAA0IlZxNT+5nzsc6EP+Idaqw== |
|
ophylias.com/ | Name: uid21837 Value: 1293799013-20221126082624-d91d5fd1991275ebcd61c2a353aa6fac- |
|
.kngarie.com/ | Name: 04709823-923b-4b08-9458-3db482340b20-check Value: 3f92b024-c33d-4ed5-ac85-d24ec4bf8b95 |
|
.radar.cloudflare.com/ | Name: __cf_bm Value: nGciRFI6WEjMpsaIloGH6du6mfzttO435FwoLyhLC9A-1669472785-0-AS2cBp220GCuyrw1iHxenKXsKpT5cViOpy6prImmjktUXWMmg+2IPA1TeTHKx9Thrm1c5Xe1jniojCn8DVIS+64= |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d37vlkgj6jn9t1.cloudfront.net
exactly-huge-arachnid.edgecompute.app
kngarie.com
link.brsafe.com.br
ophylias.com
performance.radar.cloudflare.com
serverless-benchmarks-js.compute-pipe.com
serverless-benchmarks-rust.compute-pipe.com
uniquely-peaceful-hagfish.edgecompute.app
waistbaxi.com
185.176.220.11
2600:9000:211e:9c00:16:d863:1940:21
2606:4700:3034::6815:20b5
2606:4700::6812:1f4e
2606:4700::6812:1f8
2a04:4e42::307
45.60.156.36
50.115.175.215
33232b22d49185f8d1d887a520323fdb7c563e67d1a941a97b44b649f9971bdd
336fd526a71524973c7c2bc701f13e5bacb61068ad2ef31991e992f1638cf86a
458bca77b5ff651d26ccc070874e5864283b790fccbb9c63dc3e378fccaa734f
7df4aa33d078484697126432b82ef34cda6ea378e44b302d92bf68cca205f81b
9f03b2b292f718119a8203689d05692e054f1059112c981c1e20dec82e9f2ddb
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
f25cd9ed1af41e7371c277cac3cb7521a8b753e732e83df71e25da3c71045aaa