x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app Open in urlscan Pro
2604:1380:4601:6205:5000:64ff:fe6d:c8c2  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/	3 KB 4 KB	223ms 126ms	Document text/html	2604:1380:4601:6205:5000:64ff:fe6d:c8c2 PACKET
General Check archive.org Show headers Download Go to Full URL https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2604:1380:4601:6205:5000:64ff:fe6d:c8c2 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS Software nginx/1.21.3 / Resource Hash 71fc09b603806cb6905ab9c0ae3af7014d2e3641542959f4a6327f64379b547a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Cookie access-control-allow-methods HEAD, GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length,Content-Range access-control-max-age 600 content-encoding gzip content-type text/html date Wed, 28 Sep 2022 13:51:58 GMT ic-certificate certificate=:2dn3o2R0cmVlgwGDAYMBgwJIY2FuaXN0ZXKDAYMBggRYIGVoY0Yr4fJYm20h8q91hfXoRFk4Ao5iulI4jtkZqi/DgwGCBFggiGnzcCmaQqhSw8Ph9YVc1iha/5bxookSmX1bCrDMzymDAYMBggRYIM+vD9ZxkIS7b1SpVK+vX2STmDDjwSCWfgLyxVdJrOgsgwGDAYMBgwGCBFggjUeEF1yAV6UPecQUhodIRTEDkcbmbha55eT2Oeje/w2DAYMBgwGDAYMCSgAAAAAAcBXnAQGDAYMBgwGDAk5jZXJ0aWZpZWRfZGF0YYIDWCA4+HwyrJFXEvb9MB8dF99YdvofJDDMvpCr7+GrGPaJ4YIEWCCDxWvxTd49KN5mxpK1/J2X6d2YW2rXKw/m+E6KjfPcsoIEWCDwR+afFan49YUZxxXt4HwemJ8JLbvnr6DAhdVycBwokoIEWCBfluH1JoY1y6BRnQM7d2SdXvBwEokOw/974mWzLAIaMIIEWCBwWv4QagT7Bght56HI2rX6l5bCKpQpTuyGfndPbjXaJoIEWCAdQ7em7mlMppC5L0QrzhtW5e8G9TYrUNBPaCK9tR+GdIIEWCDQHm1XY+YWNqbRtVlmB9DoGeFBOh4C5IJrlGjdxjnlHoIEWCCz2Ul8uQUUn26YpN2e1+LAdFF6M6FiZa4eIgxx75m9FIIEWCBbKlfiz8zqNBBv2WC2pNctWRS2b2OBSwmO0459aPIeroIEWCDWZMowWNSNKDhAEAiwxLYPqqN+7HcNt6Xa4igkNEfsD4IEWCAR7GZFcWysTIPXfQVDlFEUuuqBVo+U6YVnNsGgDpmJzIIEWCBF6EOqYGpoc48KcatzWPIy4BokqRHOR7fAdLRLA7ZiqIIEWCCnvizAMWQndIkSsbQJdRDMAm3vSVRETh8RlcGuCUZT8oIEWCAOMmrEBeCQQr36c3Hslny7cj07oVGRbWDTDD+KkApyT4IEWCDM8Q17tzAD8r4T47TLO55ltEX5qS9H29zL21hLAJsPYYMBggRYIN5zNFXD9hBhNGYqRgLjaOysxnJ9+na3QEAtulMdGWQkgwJEdGltZYIDSb2igoL+0MKMF2lzaWduYXR1cmVYMI5TVVBYfpY8cDmBFCkqYPdXTv8V9mDukXFLAnri2roqSzJxOzudUUCtnf8FVpyYn2pkZWxlZ2F0aW9uomlzdWJuZXRfaWRYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCa2NlcnRpZmljYXRlWQJX2dn3omR0cmVlgwGCBFggg59mK6nAMfhRByEQR1EdxMuEINzhswQMVIwnDOYGTEODAYMCRnN1Ym5ldIMBgwGDAYIEWCCC25A9dzqfIMBsVVn+ztbhqv6zKO+tGkizMWOhB3uGXIMBggRYIEZqcChs+azpgBylPiKvbuBZoJT9YEmGBtSEtoVAWDB9gwGCBFggagzQgbJohggv5MU6t01+o/KKM6CPd+xSm1JtpoC4lGeDAYMCWB1FF4tmpAek1ZwKTWczvaLOPzfBEbQlfsQZCPT4AoMBgwJPY2FuaXN0ZXJfcmFuZ2VzggNYG9nZ94GCSgAAAAAAcAAAAQFKAAAAAAB///8BAYMCSnB1YmxpY19rZXmCA1iFMIGCMB0GDSsGAQQBgtx8BQMBAgEGDCsGAQQBgtx8BQMCAQNhAJVfUvc8LexZpjeylOULk0211t4p5zu8+E59hqSsQbrXtTn5gXreiRaWHZ3Wv5JXAQ1YVxVuj+aq/Pb9BoeV5wvTOZs0ETAMnMyOug0GjBDkz7b04n0ZWx6teF1hjrOTuYIEWCAAm+bqf6+s6PfCS94lWkfuSudBPVAeM77aP3K1oe9ONoIEWCB3iEGM3zmswsJXHveM9YA5XCZ4sDN7PP6TlDhm8Fh/poIEWCAthWu6e2yAFxzo5dEhu35EULNWWmRNkTXp/liEKBwfuYMCRHRpbWWCA0m82+Xsj42/jBdpc2lnbmF0dXJlWDCpQ/JVFjEG6bMvLC26UIiDxSiuB2/D9H2HwjeTMJZq4UB7E1dIrKyOaDxttSuMac8=:, tree=:2dn3gwJLaHR0cF9hc3NldHODAksvaW5kZXguaHRtbIIDWCBx/Am2A4BstpBaucCuOvcBTS42QVQpWfSmMn9kN5tUeg==: server nginx/1.21.3
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/	85 KB 28 KB	95ms 43ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app URL: https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Wed, 28 Sep 2022 13:51:58 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 8957797 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27433 last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1538f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6bf6QO8pmxcV1AYrK9mNf2O727lM4R65LBGvwUArBnvDC79ZsZdOg%2BB%2FM3omJFxD6wu1XHL52hUfVl5M4T9yTWNDVokRD8dctGYOu12OdYEf2CUff01z1WqBtQQZ5THxPzpwRZalo3sMjJG3g4%2BYgom"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 751cf4f68d11b89d-AMS expires Mon, 18 Sep 2023 13:51:58 GMT
GET		/ x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Frame EC1A	0 0
GET H2	200	/ x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/	3 KB 3 KB	136ms 136ms	Image text/html	2604:1380:4601:6205:5000:64ff:fe6d:c8c2 PACKET
General Check archive.org Show headers Download Go to Show image Full URL https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Requested by Host: x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app URL: https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2604:1380:4601:6205:5000:64ff:fe6d:c8c2 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS Software nginx/1.21.3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers date Wed, 28 Sep 2022 13:51:58 GMT content-encoding gzip server nginx/1.21.3 ic-certificate certificate=:2dn3o2R0cmVlgwGDAYMBgwJIY2FuaXN0ZXKDAYMBggRYIGVoY0Yr4fJYm20h8q91hfXoRFk4Ao5iulI4jtkZqi/DgwGCBFggiGnzcCmaQqhSw8Ph9YVc1iha/5bxookSmX1bCrDMzymDAYMBggRYIM+vD9ZxkIS7b1SpVK+vX2STmDDjwSCWfgLyxVdJrOgsgwGDAYMBgwGCBFggjUeEF1yAV6UPecQUhodIRTEDkcbmbha55eT2Oeje/w2DAYMBgwGDAYMCSgAAAAAAcBXnAQGDAYMBgwGDAk5jZXJ0aWZpZWRfZGF0YYIDWCA4+HwyrJFXEvb9MB8dF99YdvofJDDMvpCr7+GrGPaJ4YIEWCCDxWvxTd49KN5mxpK1/J2X6d2YW2rXKw/m+E6KjfPcsoIEWCDwR+afFan49YUZxxXt4HwemJ8JLbvnr6DAhdVycBwokoIEWCBfluH1JoY1y6BRnQM7d2SdXvBwEokOw/974mWzLAIaMIIEWCBwWv4QagT7Bght56HI2rX6l5bCKpQpTuyGfndPbjXaJoIEWCAdQ7em7mlMppC5L0QrzhtW5e8G9TYrUNBPaCK9tR+GdIIEWCDQHm1XY+YWNqbRtVlmB9DoGeFBOh4C5IJrlGjdxjnlHoIEWCCz2Ul8uQUUn26YpN2e1+LAdFF6M6FiZa4eIgxx75m9FIIEWCBbKlfiz8zqNBBv2WC2pNctWRS2b2OBSwmO0459aPIeroIEWCDWZMowWNSNKDhAEAiwxLYPqqN+7HcNt6Xa4igkNEfsD4IEWCAR7GZFcWysTIPXfQVDlFEUuuqBVo+U6YVnNsGgDpmJzIIEWCBF6EOqYGpoc48KcatzWPIy4BokqRHOR7fAdLRLA7ZiqIIEWCCnvizAMWQndIkSsbQJdRDMAm3vSVRETh8RlcGuCUZT8oIEWCAOMmrEBeCQQr36c3Hslny7cj07oVGRbWDTDD+KkApyT4IEWCDM8Q17tzAD8r4T47TLO55ltEX5qS9H29zL21hLAJsPYYMBggRYIN5zNFXD9hBhNGYqRgLjaOysxnJ9+na3QEAtulMdGWQkgwJEdGltZYIDSb2igoL+0MKMF2lzaWduYXR1cmVYMI5TVVBYfpY8cDmBFCkqYPdXTv8V9mDukXFLAnri2roqSzJxOzudUUCtnf8FVpyYn2pkZWxlZ2F0aW9uomlzdWJuZXRfaWRYHUUXi2akB6TVnApNZzO9os4/N8ERtCV+xBkI9PgCa2NlcnRpZmljYXRlWQJX2dn3omR0cmVlgwGCBFggPgEEJx4zdatFFbi8rUXwOD8cog5RFSrnLT8lvAdItQeDAYMCRnN1Ym5ldIMBgwGDAYIEWCCC25A9dzqfIMBsVVn+ztbhqv6zKO+tGkizMWOhB3uGXIMBggRYIEZqcChs+azpgBylPiKvbuBZoJT9YEmGBtSEtoVAWDB9gwGCBFggagzQgbJohggv5MU6t01+o/KKM6CPd+xSm1JtpoC4lGeDAYMCWB1FF4tmpAek1ZwKTWczvaLOPzfBEbQlfsQZCPT4AoMBgwJPY2FuaXN0ZXJfcmFuZ2VzggNYG9nZ94GCSgAAAAAAcAAAAQFKAAAAAAB///8BAYMCSnB1YmxpY19rZXmCA1iFMIGCMB0GDSsGAQQBgtx8BQMBAgEGDCsGAQQBgtx8BQMCAQNhAJVfUvc8LexZpjeylOULk0211t4p5zu8+E59hqSsQbrXtTn5gXreiRaWHZ3Wv5JXAQ1YVxVuj+aq/Pb9BoeV5wvTOZs0ETAMnMyOug0GjBDkz7b04n0ZWx6teF1hjrOTuYIEWCAAm+bqf6+s6PfCS94lWkfuSudBPVAeM77aP3K1oe9ONoIEWCB3iEGM3zmswsJXHveM9YA5XCZ4sDN7PP6TlDhm8Fh/poIEWCAthWu6e2yAFxzo5dEhu35EULNWWmRNkTXp/liEKBwfuYMCRHRpbWWCA0nA4MnuqI2/jBdpc2lnbmF0dXJlWDCzXJ22Efp8CP8nRcT9c+1pDf1yrFF0z8FVnpFosJ246zgGd0bzz67AxJR2WywQfp0=:, tree=:2dn3gwJLaHR0cF9hc3NldHODAksvaW5kZXguaHRtbIIDWCBx/Am2A4BstpBaucCuOvcBTS42QVQpWfSmMn9kN5tUeg==: access-control-max-age 600 access-control-allow-methods HEAD, GET, POST, OPTIONS content-type text/html access-control-allow-origin * access-control-expose-headers Content-Length,Content-Range access-control-allow-credentials true access-control-allow-headers DNT,User-Agent,X-Requested-With,If-None-Match,If-Modified-Since,Cache-Control,Content-Type,Range,Cookie
GET H2	400	/ logo.clearbit.com/	0 0	317ms 196ms	Image text/plain	13.224.222.13 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logo.clearbit.com/ Requested by Host: x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app URL: https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.222.13 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-222-13.lhr61.r.cloudfront.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36 Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app

URL

https://x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://logo.clearbit.com/ Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
logo.clearbit.com
x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app
x4xor-zqaaa-aaaad-qcxtq-cai.raw.ic0.app
13.224.222.13
2604:1380:4601:6205:5000:64ff:fe6d:c8c2
2606:4700::6811:190e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
71fc09b603806cb6905ab9c0ae3af7014d2e3641542959f4a6327f64379b547a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855