api-walletfix.pages.dev
Open in
urlscan Pro
172.66.47.98
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On April 10 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on April 7th 2024. Valid for: 3 months.
This is the only time api-walletfix.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 16Shop (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 172.66.47.98 172.66.47.98 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 4 | 172.67.41.16 172.67.41.16 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 109.169.71.112 109.169.71.112 | 20860 (IOMART-AS) (IOMART-AS) | |
12 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
pages.dev
api-walletfix.pages.dev |
100 KB |
4 |
tailwindcss.com
2 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 51134 |
238 KB |
1 |
smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 169223 |
1 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
9 | api-walletfix.pages.dev |
api-walletfix.pages.dev
|
4 | cdn.tailwindcss.com |
2 redirects
api-walletfix.pages.dev
|
1 | smtpjs.com |
api-walletfix.pages.dev
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
api-walletfix.pages.dev GTS CA 1P5 |
2024-04-07 - 2024-07-06 |
3 months | crt.sh |
smtpjs.com R3 |
2024-04-09 - 2024-07-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://api-walletfix.pages.dev/connection-module/
Frame ID: E2D9EF297ABF8F6F89CACCBE67B9FEC5
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://cdn.tailwindcss.com/ HTTP 302
- https://cdn.tailwindcss.com/3.4.3
- https://cdn.tailwindcss.com/?plugins=forms,typography,aspect-ratio,line-clamp HTTP 302
- https://cdn.tailwindcss.com/3.4.3?plugins=forms@0.5.7,typography@0.5.12,aspect-ratio@0.4.2,line-clamp@0.4.4
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
api-walletfix.pages.dev/connection-module/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flowbite.min.css
api-walletfix.pages.dev/flowbite-1.5.3/dist/ |
146 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inter.css
api-walletfix.pages.dev/inter/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.4.3
cdn.tailwindcss.com/ Redirect Chain
|
357 KB 110 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.4.3
cdn.tailwindcss.com/ Redirect Chain
|
459 KB 128 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
api-walletfix.pages.dev/ajax/libs/jquery/3.6.1/ |
88 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wc1.png
api-walletfix.pages.dev/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error.png
api-walletfix.pages.dev/connection-module/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mine.js
api-walletfix.pages.dev/connection-module/js/ |
766 B 571 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form-submission-handler.js
api-walletfix.pages.dev/connection-module/js/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
api-walletfix.pages.dev/ |
24 KB 5 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 16Shop (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| tailwind function| $ function| jQuery string| /template.html function| thankyou_message object| Email function| ready0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api-walletfix.pages.dev
cdn.tailwindcss.com
smtpjs.com
109.169.71.112
172.66.47.98
172.67.41.16
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
5489be50c2b337c82218c4386896869cc2eda978315299b925a391df2a250805
59455702b7d6b45dbf604e43023bb1d0e079e2ff6a57ed2397b67a6478f16877
63ae0113d05677d47e0c6cdd274b8667c5ce233fac4dcac0d4b8ea964207ac3f
662bb9c9d16848a2cd955188415e6a9ef75fbd44a3711e2fddd72d6482a6b147
6f0a2c50296c2d198381d565335fe57abf952bbd3b588126157546870be7383e
8005f738036307f7d695c4b291f3daec4205a4265f8d3b7cd48a77bb126d568b
84bf3bad5219e890849b317a417b29294f01d52009ebcf8774329fb893b9a2e7
9efaf272cbcca84a72964ee14d0a0958606f007cdd117704409d5c11f81f1ff6
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b4ad80993343015313a8055eee8071d49bfc9bd6546d2d93dd3e18123dada0a5
d2c35bf03246b0634bb22cbdc74962c8368e5e13b656e7f3cc10029da79d2e5c