a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2606:4700:3034::ac43:b72c, located in United States and belongs to CLOUDFLARENET, US. The main domain is a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 18th 2021. Valid for: a year.

This is the only time a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1	2606:4700:303... 2606:4700:3034::ac43:b72c		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2

1 2606:4700:3034::ac43:b72c (United States)

ASN13335 (CLOUDFLARENET, US)

a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	workers.dev a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev	120 KB
1	1

	Domain	Requested by
1	a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev
1	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-05-18` - `2022-05-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/
Frame ID: 6A9F976E517DC65124118C3E8200FDDC
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

120 kB
Transfer

292 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/ 188 KB
120 KB 66ms
34ms Document
text/html 2606:4700:3034::ac43:b72c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:b72c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11aa7bb49495ad2205ff2d6116c949d1a40af70f1912a221d9d545aae0207798

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 19 May 2021 02:42:20 GMT
content-type: text/html; charset=utf-8
cf-ray: 6519f8ad49832bca-FRA
age: 7973
vary: Accept-Encoding
cf-cache-status: HIT
cf-request-id: 0a2419c04f00002bca038c7000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
feature-policy: none
referrer-policy: unsafe-url
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DdQaZdtKAQnEuUBJ1SLXWJCmZUwMMHxsGAvIichD991Ph9cFJ0XqOlYFbRtpZrJyD631eVxDOvE7tYp7oNDV0%2BwWtmsnd2VkXnZuvVKuLeL3IcSGU%2FWrx7XvGkePui4u4QSfcrrNirxhFa2obFxJ8hq0rJ5Is%2BywwduTBbLLEt39pBJUnyAe9EJ%2BSksovFjbo%2BGkulqUAWyYPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ 86 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f1bd02d32bb72af0c6d749da0c33b531d02c6e789740e3d6023082ee4a920153

Request headers

Referer: https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f8fc8a8b4fd2284c4b89bb0a54654a29f6195105e2224e210d95ffe08f1fb88

Request headers

Referer: https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6f354299045fec095abfe8fd7780631ecbabb69ef0ab18405fc7b5d867917ef

Request headers

Referer: https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9845715720434d45fb904d9614441ee83df6f306158caa829953739bb883fc5

Request headers

Referer: https://a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev
2606:4700:3034::ac43:b72c
11aa7bb49495ad2205ff2d6116c949d1a40af70f1912a221d9d545aae0207798
3f8fc8a8b4fd2284c4b89bb0a54654a29f6195105e2224e210d95ffe08f1fb88
a9845715720434d45fb904d9614441ee83df6f306158caa829953739bb883fc5
b6f354299045fec095abfe8fd7780631ecbabb69ef0ab18405fc7b5d867917ef
f1bd02d32bb72af0c6d749da0c33b531d02c6e789740e3d6023082ee4a920153

a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev Open in urlscan Pro 2606:4700:3034::ac43:b72c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

120 kBTransfer

292 kBSize

0 Cookies

0 Outgoing links

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

a98s0f-31f981f-13f9uj9-f1390.zpznlytxb-hua98v32v0-13fh981-ch91sc3.workers.dev Open in urlscan Pro
2606:4700:3034::ac43:b72c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

120 kB
Transfer

292 kB
Size

0
Cookies

1 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!