c-be7.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2cfa  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://lamonv.com/ Page URL
2. https://c-be7.pages.dev/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response lamonv.com/	129 B 249 B	531ms 162ms	Document text/html	198.54.126.19 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://lamonv.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.19 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server260-5.web-hosting.com Software LiteSpeed / PHP/7.4.30 Resource Hash bea0f678b4c16c56ba4d48ab57720178996d91b2bc1e7e3f57af0c39704cb842 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-length 82 content-type text/html; charset=UTF-8 date Thu, 29 Sep 2022 12:19:04 GMT server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.4.30 x-turbo-charged-by LiteSpeed
GET H2	200	Primary Request / Show response c-be7.pages.dev/	23 KB 10 KB	131ms 82ms	Document text/html	2606:4700:310c::ac42:2cfa CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://c-be7.pages.dev/ Requested by Host: lamonv.com URL: https://lamonv.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2cfa , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff3f8bd97ce067cd0f0348a2f8142e7940e7c6b83badff7b48cd37f8381b32da Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://lamonv.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 7524aa48bc9c91ed-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 29 Sep 2022 12:19:05 GMT etag W/"30f63502032eb343629f05232c974179" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7hfkzwSp31b2vjfd0eCxUmlhnCIQSi3oGAkukZ60rffGPEvhKL2XceNkYfz5u3YpANn2QGhj8gT%2FZ0pfLy0uqH6wyJ%2FmP4A2DotZ6xnJDxAShHeP%2BQtm%2Bs5wNFfYGjjDugugjMA9x9OOPoa7XZI%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	89ms 56ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: c-be7.pages.dev URL: https://c-be7.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer Origin https://c-be7.pages.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Thu, 29 Sep 2022 12:19:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 227368 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27938 last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qyt3zCoFUiEeffO3fWV40Oy9K3Nf0%2BVcfE17AyyXm0CMe3%2F%2B4Nt%2BnyeAjV4n33bjpqnwNlzoMNDK1iSyXiYEwC0o%2Bs2x42m52vmWj%2F7NM491JYJd0RUns10%2B1V%2Bl1%2BvdWiL1rrTcchnTamWfmxCia2Lb"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7524aa497decbb56-FRA expires Tue, 19 Sep 2023 12:19:05 GMT
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash acd437203c2d90b424cf0b78a027df5c25389c302960e8bcea3208c870a2a486 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	expiry.php Show response ungabunga.lol/d/	1 B 174 B	493ms 167ms	XHR text/html	68.65.120.250 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://ungabunga.lol/d/expiry.php?token=e347cdf00641e4d535f620b76527fb01dcaf2907 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.120.250 Petersburg, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server105-4.web-hosting.com Software LiteSpeed / PHP/7.4.30 Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Request headers Accept */* Referer https://c-be7.pages.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Thu, 29 Sep 2022 12:19:06 GMT content-encoding br server LiteSpeed x-powered-by PHP/7.4.30 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * x-turbo-charged-by LiteSpeed content-length 5
GET H2	200	trace Show response www.cloudflare.com/cdn-cgi/	310 B 450 B	68ms 19ms	XHR text/plain	2606:4700::6810:7c60 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.cloudflare.com/cdn-cgi/trace Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7c60 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 29f9aedbd4eb0535761ce443487bcd54ece11db216c83803bd18e31c5d4438b9 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Accept */* Referer https://c-be7.pages.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Thu, 29 Sep 2022 12:19:05 GMT content-encoding gzip x-content-type-options nosniff server cloudflare x-frame-options DENY content-type text/plain access-control-allow-origin * cache-control no-cache cf-ray 7524aa4a481b910a-FRA expires Thu, 01 Jan 1970 00:00:01 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| _0x1495 function| _0x17d531 string| redirect_after function| _0x2448 function| makeid string| url_string object| url object| c string| api function| _0x22ad2e function| _0x4596 function| _0x3fa7

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	info	URL: https://c-be7.pages.dev/(Line 199) Message: Autofocus processing was blocked because a document already has a focused element.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c-be7.pages.dev
cdnjs.cloudflare.com
lamonv.com
ungabunga.lol
www.cloudflare.com
198.54.126.19
2606:4700:310c::ac42:2cfa
2606:4700::6810:7c60
2606:4700::6811:190e
68.65.120.250
29f9aedbd4eb0535761ce443487bcd54ece11db216c83803bd18e31c5d4438b9
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
acd437203c2d90b424cf0b78a027df5c25389c302960e8bcea3208c870a2a486
bea0f678b4c16c56ba4d48ab57720178996d91b2bc1e7e3f57af0c39704cb842
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff3f8bd97ce067cd0f0348a2f8142e7940e7c6b83badff7b48cd37f8381b32da