smarttobacco.net
Open in
urlscan Pro
173.212.219.206
Malicious Activity!
Public Scan
Submission: On August 03 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R11 on July 23rd 2024. Valid for: 3 months.
This is the only time smarttobacco.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 173.212.219.206 173.212.219.206 | 51167 (CONTABO) (CONTABO) | |
1 | 2620:1ec:bdf::44 2620:1ec:bdf::44 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:26f0:350... 2a02:26f0:3500:11::215:14c7 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
3 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.64.153.224 172.64.153.224 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.26.12.205 104.26.12.205 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 10 |
ASN51167 (CONTABO, DE)
PTR: ns2021.itlinks.com
smarttobacco.net |
ASN20940 (AKAMAI-ASN1, NL)
cdn-icons-png.flaticon.com |
ASN13335 (CLOUDFLARENET, US)
www.teachmepersonalfinance.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
39 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410 |
62 KB |
2 |
smarttobacco.net
smarttobacco.net |
9 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2512 |
155 B |
1 |
teachmepersonalfinance.com
www.teachmepersonalfinance.com |
59 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
30 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832 |
15 KB |
1 |
flaticon.com
cdn-icons-png.flaticon.com — Cisco Umbrella Rank: 58646 |
6 KB |
1 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2218 |
2 KB |
0 |
geoplugin.net
Failed
www.geoplugin.net Failed |
|
14 | 10 |
Domain | Requested by | |
---|---|---|
3 | cdnjs.cloudflare.com |
smarttobacco.net
|
2 | cdn.jsdelivr.net |
smarttobacco.net
|
2 | smarttobacco.net | |
1 | api.ipify.org |
ajax.googleapis.com
|
1 | www.teachmepersonalfinance.com |
smarttobacco.net
|
1 | ajax.googleapis.com |
smarttobacco.net
|
1 | maxcdn.bootstrapcdn.com |
smarttobacco.net
|
1 | cdn-icons-png.flaticon.com |
smarttobacco.net
|
1 | aadcdn.msauth.net |
smarttobacco.net
|
0 | www.geoplugin.net Failed |
smarttobacco.net
|
14 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
smarttobacco.net R11 |
2024-07-23 - 2024-10-21 |
3 months | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-04-30 - 2025-04-30 |
a year | crt.sh |
*.flaticon.com E6 |
2024-06-07 - 2024-09-05 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
bootstrapcdn.com WE1 |
2024-07-23 - 2024-10-21 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
teachmepersonalfinance.com E6 |
2024-06-20 - 2024-09-18 |
3 months | crt.sh |
ipify.org WE1 |
2024-07-18 - 2024-10-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://smarttobacco.net/PDFAUTO.htm
Frame ID: 6946BFF21FD5EF41AF601B6DECD471CF
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Excel Local | SharedDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Bootstrap (Web Frameworks) Expand
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Axios (JavaScript libraries) Expand
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Lodash (JavaScript Libraries) Expand
Detected patterns
- lodash.*\.js
Popper (Miscellaneous) Expand
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
PDFAUTO.htm
smarttobacco.net/ |
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2223615.png
cdn-icons-png.flaticon.com/512/2223/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue@2.6.12
cdn.jsdelivr.net/npm/ |
91 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lodash.min.js
cdn.jsdelivr.net/npm/lodash@4.17.21/ |
71 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
irs_form_8822-b_top-1536x834.jpg
www.teachmepersonalfinance.com/wp-content/uploads/2023/05/ |
59 KB 59 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
javascript.gp
www.geoplugin.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
22 B 155 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
smarttobacco.net/ |
0 169 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.geoplugin.net
- URL
- http://www.geoplugin.net/javascript.gp
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Vue function| $ function| jQuery function| Popper object| bootstrap function| _ function| axios string| tx1 string| tx2 string| ur1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www.teachmepersonalfinance.com/ | Name: __cf_bm Value: CCJ6g0CmZL5pSZmyFG5EauyPesJI2bVZT0QcmA1hGpM-1722650499-1.0.1.1-0EfufjAeV.RDeRKw0vta9h8TsMPgogcb_EbcpFsmXGchXvp1bqQn7hYkMtsQEq1SuJyCX0JLmoqGKP32jniJKg |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
ajax.googleapis.com
api.ipify.org
cdn-icons-png.flaticon.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
smarttobacco.net
www.geoplugin.net
www.teachmepersonalfinance.com
www.geoplugin.net
104.17.25.14
104.18.11.207
104.26.12.205
172.64.153.224
173.212.219.206
2620:1ec:bdf::44
2a00:1450:4001:806::200a
2a02:26f0:3500:11::215:14c7
2a04:4e42::485
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2
4e94810eee6ac6383d2ad20ea8dcc764ba153b475eceb2af52ecf169d7e533bd
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a9085ec6ecc921fe1b32cb36563b6861d2ab6ada692f1d9565f0d0dde155173e
a9705dfc47c0763380d851ab1801be6f76019f6b67e40e9b873f8b4a0603f7a9
d1522dcc2b1574e4b9d191b7bfa61306f09acff6a6e000a849305ad899f96a87
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
e8dc6188ba5016343d0ad0d45485406d31b3df0237377f7e0937ec0a5c6dbeef
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e