darling-you.pages.dev
Open in
urlscan Pro
172.66.44.74
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On July 15 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by WE1 on July 11th 2024. Valid for: 3 months.
This is the only time darling-you.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 172.66.44.74 172.66.44.74 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2.16.96.33 2.16.96.33 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
7 | 142.250.184.225 142.250.184.225 | 15169 (GOOGLE) (GOOGLE) | |
18 | 4 |
ASN16625 (AKAMAI-AS, US)
PTR: a2-16-96-33.deploy.static.akamaitechnologies.com
res.cloudinary.com |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f1.1e100.net
cdn.ampproject.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 382 |
110 KB |
6 |
cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 4280 |
757 KB |
6 |
pages.dev
1 redirects
darling-you.pages.dev |
36 KB |
18 | 3 |
Domain | Requested by | |
---|---|---|
7 | cdn.ampproject.org |
darling-you.pages.dev
cdn.ampproject.org |
6 | res.cloudinary.com | |
6 | darling-you.pages.dev |
1 redirects
darling-you.pages.dev
|
18 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
ndasmu.site |
Subject Issuer | Validity | Valid | |
---|---|---|---|
darling-you.pages.dev WE1 |
2024-07-11 - 2024-10-09 |
3 months | crt.sh |
*.cloudinary.com Go Daddy Secure Certificate Authority - G2 |
2023-12-18 - 2025-01-13 |
a year | crt.sh |
misc-sni.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://darling-you.pages.dev/?paper=TOTO%20KOI
Frame ID: F03E1352234337BCC2FB8BD8244D4054
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
SLOT GACOR ยป Daftar & Login Agen Situs Judi Slot Online Deposit Pulsa Tanpa PotonganPage URL History Show full URLs
- https://darling-you.pages.dev/?paper=TOTO%20KOI Page URL
-
https://darling-you.pages.dev/cdn-cgi/phish-bypass?atok=ifuJDcXOwtSy5ypEt8At081ojeZsKMZ5SaIJW55wYMA-172107...
HTTP 301
https://darling-you.pages.dev/?paper=TOTO%20KOI Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: DAFTAR
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://darling-you.pages.dev/?paper=TOTO%20KOI Page URL
-
https://darling-you.pages.dev/cdn-cgi/phish-bypass?atok=ifuJDcXOwtSy5ypEt8At081ojeZsKMZ5SaIJW55wYMA-1721075133-0.0.1.1-%2F%3Fpaper%3DTOTO%2520KOI
HTTP 301
https://darling-you.pages.dev/?paper=TOTO%20KOI Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
darling-you.pages.dev/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
darling-you.pages.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
darling-you.pages.dev/cdn-cgi/images/ |
452 B 541 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
darling-you.pages.dev/ |
62 KB 14 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sgacor1.png
res.cloudinary.com/dciulsm9u/image/upload/v1717830116/ |
138 KB 139 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slotgacor-1.jpg
res.cloudinary.com/dciulsm9u/image/upload/v1716548344/ |
603 KB 604 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
darling-you.pages.dev/ Redirect Chain
|
62 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sgacor1.png
res.cloudinary.com/dciulsm9u/image/upload/v1717830116/ |
138 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slotgacor-1.jpg
res.cloudinary.com/dciulsm9u/image/upload/v1716548344/ |
603 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v0.mjs
cdn.ampproject.org/ |
223 KB 62 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-carousel-0.1.mjs
cdn.ampproject.org/v0/ |
33 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-install-serviceworker-0.1.mjs
cdn.ampproject.org/v0/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-youtube-0.1.mjs
cdn.ampproject.org/v0/ |
31 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-accordion-0.1.mjs
cdn.ampproject.org/v0/ |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-auto-lightbox-0.1.mjs
cdn.ampproject.org/rtv/012406131415000/v0/ |
7 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eg8bv70ednllcydpmmf4.webp
res.cloudinary.com/dciulsm9u/image/upload/v1712640192/favicon/ |
14 KB 15 KB |
Other
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-lightbox-gallery-0.1.mjs
cdn.ampproject.org/rtv/012406131415000/v0/ |
56 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eg8bv70ednllcydpmmf4.webp
res.cloudinary.com/dciulsm9u/image/upload/v1712640192/favicon/ |
14 KB 0 |
Other
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| AMP object| AMP_CONFIG object| AMP_EXP object| __AMP_LOG object| __AMP_ERRORS function| __AMP_REPORT_ERROR object| __AMP_TOP object| __AMP_SERVICES object| __AMP__EXPERIMENT_TOGGLES object| __AMP_MODE boolean| __AMP_TAG object| __AMP_EXTENDED_ELEMENTS function| __AMP_BASE_CE_CLASS1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.darling-you.pages.dev/ | Name: __cf_mw_byp Value: ifuJDcXOwtSy5ypEt8At081ojeZsKMZ5SaIJW55wYMA-1721075133-0.0.1.1-/?paper=TOTO%20KOI |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.ampproject.org
darling-you.pages.dev
res.cloudinary.com
142.250.184.225
172.66.44.74
2.16.96.33
0bdd0b0c570ddb33b64cd10996b5a75d022046b21e0fdf3a9eb202aeb10be1ac
112150e5c6f2d2049e0dc2db39014a5257e988434cdc7120bb11ab403eccdba0
169ee25989cebd5409c0cd5d89ae7d3019bbc6f03ab7558167c6a12c7e6e8f6b
28fc5aafc2a6512b40a3f5ad395c890ccf6281dddc934d3843ffc6beda937dfb
5b048995239389eace0a45abda4e1dc55459b8ab924ddc8410d2f7d64f860613
68964469203a15ae4fc4c65b16883511ab4334ef8f8bcd69660d5786aac7e7a7
82a83d371708d9df49f213ebc3e87992f59f2011870ac8323b6ec67764da1abf
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
936507d6214760d9688b303cf39ce5aff5eaf6bd44c3760bb08cd3c43fc6ce99
c39e4e83fa7569cdb38fb49adfd590d4a0b0463c8952ac3464d0a581b48a40a4
c5cd6ba9787bd2e949e1e59a38c4b78f5df6d46aa5669f4aa37d640cb6eb59ed
d71cf7542f04b81900dcedceb0adeb4d4117db4c8735c7ea47701575012b84a3
e95f5a1167caa6533fcc55859b8341d37fc1eb20b1e831a14de10e469f2c5392
ec9a5d9df4e1d015cca7ef1d16b6715446aa4441efe1a69c6a35cdcf4cc9b955
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016