uber-centrals.com Open in urlscan Pro
66.235.200.145  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response uber-centrals.com/	68 KB 15 KB	788ms 637ms	Document text/html	66.235.200.145 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://uber-centrals.com/ Protocol HTTP/1.1 Server 66.235.200.145 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS host77.ipowerweb.com Software cloudflare / Resource Hash b413cb0bb413234c34e2b830e33284d1be4224e4e9ffd64c27b581f3fd343bd1 Request headers Host uber-centrals.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 05 May 2021 14:12:34 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=da867e7e33a89e1bc5778a77e231b2b4c1620223954; expires=Fri, 04-Jun-21 14:12:34 GMT; path=/; domain=.uber-centrals.com; HttpOnly; SameSite=Lax Vary Accept-Encoding host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== CF-Cache-Status EXPIRED cf-request-id 09de78a49f0000f162dab8d000000001 Server cloudflare CF-RAY 64aa9080fee2f162-ARN Content-Encoding gzip
GET H2	200	main-a0f334f81a.css d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/stylesheets/	274 KB 137 KB	258ms 86ms	Stylesheet text/css	65.9.76.118 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/stylesheets/main-a0f334f81a.css Requested by Host: uber-centrals.com URL: http://uber-centrals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.76.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 5d93f1a7b70069bb2daaf716f5c1d3b2fdf3206adaeff8b97034d15dce229f17 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 23 Jan 2021 22:05:29 GMT content-encoding gzip age 8784426 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 139802 last-modified Fri, 22 Jan 2021 05:16:46 GMT server AmazonS3 etag "0a942ffac7ae0e9dd7f9fed1d544f542" x-amz-version-id 2Cz2CYP4nBTzTgB11RKC2Ne0NUs0QS_5 via 1.1 a156165ae278c5ddd408f18e7181dccd.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop AMS1-C1 accept-ranges bytes content-type text/css x-amz-cf-id c0V-eVofTbF2m4n7KHLhqvnvC9JKKg22l0mJb4B7O0Mcm8fmP7tAnw==
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	67ms 8ms	Script application/javascript	2001:4de0:ac18::1:a:1b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: uber-centrals.com URL: http://uber-centrals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Origin http://uber-centrals.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 05 May 2021 14:12:34 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1620223954.dop167.fr8.t,1620223954.cds270.fr8.hc,1620223954.cds144.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H2	200	Uber_Logo_White_RGB-da68b0cf59.svg d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/	1 KB 1 KB	125ms 56ms	Image image/svg+xml	65.9.76.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/Uber_Logo_White_RGB-da68b0cf59.svg Requested by Host: uber-centrals.com URL: http://uber-centrals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.76.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash aedf0fa22a9fc2d7de5ab42c5641182ff04a4da368f5d69857fdee73a3db9681 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 16 Nov 2020 20:30:25 GMT content-encoding gzip age 14665330 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 664 last-modified Wed, 11 Nov 2020 01:13:26 GMT server AmazonS3 etag "2d53c520576018416e0455fbe70e2eec" x-amz-version-id xOgX8QoItzECDSpvWlGYh6HTmTOiNx3u via 1.1 a156165ae278c5ddd408f18e7181dccd.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop AMS1-C1 accept-ranges bytes content-type image/svg+xml x-amz-cf-id JqoqX5p5Kh1sPKVlZU361caaGGPmRm6xuuv6ZgEzq7bO0qoOQm3X9A==
GET H2	200	1454024011-global_aqua_01_scale_125_144dpi_01-37a1ca0b8b.png d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/	17 KB 18 KB	127ms 70ms	Image image/png	65.9.76.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1a3f4spazzrp4.cloudfront.net/arch-frontend/1.1.1/d1a3f4spazzrp4.cloudfront.net/1454024011-global_aqua_01_scale_125_144dpi_01-37a1ca0b8b.png Requested by Host: uber-centrals.com URL: http://uber-centrals.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.76.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bd0036eab65ce50fc360db502f12ab38deab9fc75ded555e559b1fa514031927 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Wed, 17 Mar 2021 01:05:54 GMT via 1.1 a156165ae278c5ddd408f18e7181dccd.cloudfront.net (CloudFront) last-modified Tue, 16 Mar 2021 04:02:13 GMT server AmazonS3 age 4280802 etag "37a1ca0b8b384e1f249e8c3cf45c6f52" x-cache Hit from cloudfront x-amz-version-id 98.Nv7xcYb_4Bi0Gx2AEKioSf073eE_r cache-control max-age=31536000 x-amz-cf-pop AMS1-C1 accept-ranges bytes content-type image/png content-length 17884 x-amz-cf-id NrzLP31QAs34uCvqDJQjN8sfs9muryzI0s7lYDjLyOPOSuBQni4NfA==
GET DATA	200 OK	truncated /	32 KB 32 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 27fb71338e0e96f5cd1e83f1f7fed0987e05d4cd5bbb82fa35b20d1d45e87658 Request headers Origin http://uber-centrals.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	32 KB 32 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 323096575cb514f494901242ac7526db5e1970e0959b85b3603e0987559047e1 Request headers Origin http://uber-centrals.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	31 KB 31 KB		Font application/font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bf7ddec2bffa6786ccd5f8f19e9f5624bcc20a3d7ca46766377405549d63d798 Request headers Origin http://uber-centrals.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/font-woff
GET DATA	200 OK	truncated /	19 KB 19 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b57312e9203c631e4435fa1c8c6d5236ac23050dc4948ef050089e80d2425bcd Request headers Origin http://uber-centrals.com Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/octet-stream

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Uber (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
d1a3f4spazzrp4.cloudfront.net
uber-centrals.com
2001:4de0:ac18::1:a:1b
65.9.76.118
66.235.200.145
27fb71338e0e96f5cd1e83f1f7fed0987e05d4cd5bbb82fa35b20d1d45e87658
323096575cb514f494901242ac7526db5e1970e0959b85b3603e0987559047e1
5d93f1a7b70069bb2daaf716f5c1d3b2fdf3206adaeff8b97034d15dce229f17
aedf0fa22a9fc2d7de5ab42c5641182ff04a4da368f5d69857fdee73a3db9681
b413cb0bb413234c34e2b830e33284d1be4224e4e9ffd64c27b581f3fd343bd1
b57312e9203c631e4435fa1c8c6d5236ac23050dc4948ef050089e80d2425bcd
bd0036eab65ce50fc360db502f12ab38deab9fc75ded555e559b1fa514031927
bf7ddec2bffa6786ccd5f8f19e9f5624bcc20a3d7ca46766377405549d63d798
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e