cash.app-securessquareup.com
Open in
urlscan Pro
162.241.125.130
Malicious Activity!
Public Scan
Submission: On January 27 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by R3 on January 27th 2021. Valid for: 3 months.
This is the only time cash.app-securessquareup.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cash App (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 162.241.125.130 162.241.125.130 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
8 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: mail.overvine.com
cash.app-securessquareup.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
app-securessquareup.com
cash.app-securessquareup.com |
499 KB |
8 | 1 |
Domain | Requested by | |
---|---|---|
8 | cash.app-securessquareup.com |
cash.app-securessquareup.com
|
8 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cash.app-securessquareup.com R3 |
2021-01-27 - 2021-04-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cash.app-securessquareup.com/
Frame ID: DC8A01EF2B0A9EA57319E4941E1440DF
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
cash.app-securessquareup.com/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash-market-rounded-light.woff2
cash.app-securessquareup.com/static/fonts/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash-market-rounded-regular.woff2
cash.app-securessquareup.com/static/fonts/ |
33 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash-market-rounded-medium.woff2
cash.app-securessquareup.com/static/fonts/ |
35 KB 36 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
cash.app-securessquareup.com/static/js/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash.css
cash.app-securessquareup.com/static/css/ |
238 KB 239 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash-market-rounded-medium.woff2
cash.app-securessquareup.com/static/fonts/ |
35 KB 36 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cash-market-rounded-regular.woff2
cash.app-securessquareup.com/static/fonts/ |
33 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cash App (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cash.app-securessquareup.com/ | Name: PHPSESSID Value: 0d49d2ed639dfbd5217d44904df1056d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cash.app-securessquareup.com
162.241.125.130
32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3
62761387d4c11f4b987b6beca0e7c011e6c68ad251f97437d7d655be7bbee186
a1abd94048e822be4d2b551ce86d9250314fb453a2b87092a6bb1138ae167c14
de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b
e83f48c001b68ad2019dd5b4420d4d22a73f1a00c4b18c227c928ee7761f68f8
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d