updat3s.atts3rvices.workers.dev
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Submission Tags: phishing
Submission: On June 16 via api from US — Scanned from NL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2022. Valid for: a year.
This is the only time updat3s.atts3rvices.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 52.20.78.240 52.20.78.240 | 14618 (AMAZON-AES) (AMAZON-AES) | |
6 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-78-240.compute-1.amazonaws.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 686 |
108 KB |
2 |
workers.dev
updat3s.atts3rvices.workers.dev |
26 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3033 |
215 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 329 |
84 KB |
6 | 4 |
Domain | Requested by | |
---|---|---|
2 | code.jquery.com |
updat3s.atts3rvices.workers.dev
|
2 | updat3s.atts3rvices.workers.dev |
updat3s.atts3rvices.workers.dev
|
1 | api.ipify.org |
updat3s.atts3rvices.workers.dev
|
1 | ajax.googleapis.com |
updat3s.atts3rvices.workers.dev
|
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-15 - 2023-06-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-05-25 - 2022-08-17 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2022-02-07 - 2023-03-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://updat3s.atts3rvices.workers.dev/
Frame ID: 1D07F81BE6E6F8252A471B58931ECF37
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
updat3s.atts3rvices.workers.dev/ |
193 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 84 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.js
code.jquery.com/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
updat3s.atts3rvices.workers.dev/ |
193 KB 13 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
31 B 215 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
660 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery function| getIP0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
code.jquery.com
updat3s.atts3rvices.workers.dev
2001:4de0:ac18::1:a:2a
2a00:1450:4001:801::200a
2a06:98c1:3120::3
52.20.78.240
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
4eedd9d2bd2793eca89838d1316318d9cb5c745c03cf8ebc89b2e2f6da647f80
59355d5727f7597145dc7137fac487907bd1289ec3f1205a7341f70dcabe5bf2
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
d0ef33f0a60129ce215e69ccab7093bcdc5645fbccbf43b164374d91c877b6fe
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad