term-protec-secure.site Open in urlscan Pro
139.162.44.72 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://term-protec-secure.site/checkpoint.htm
Submission Tags: @ipnigh
Submission: On December 10 via api (December 10th 2019, 10:15:59 pm UTC) from GB

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 139.162.44.72, located in Singapore and belongs to LINODE-AP Linode, LLC, US. The main domain is term-protec-secure.site.

This is the only time term-protec-secure.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
9	139.162.44.72 139.162.44.72	63949 (LINODE-AP...) (LINODE-AP Linode)
1	2a03:2880:f01... 2a03:2880:f01a:5:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK - Facebook)
10	2

9 139.162.44.72 (Singapore)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: kakuna.rapidplex.com

term-protec-secure.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01a:5:face:b00c:0:1 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

external-lhr3-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	term-protec-secure.site term-protec-secure.site	62 KB
1	fbcdn.net external-lhr3-1.xx.fbcdn.net	960 B
10	2

	Domain	Requested by
9	term-protec-secure.site	term-protec-secure.site
1	external-lhr3-1.xx.fbcdn.net	term-protec-secure.site
10	2

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-11-06` - `2020-02-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://term-protec-secure.site/checkpoint.htm
Frame ID: 42CCB46376C529110325428233E17D0F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

10
Requests

10 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

63 kB
Transfer

178 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/?ref=logo
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request checkpoint.htm Show response
term-protec-secure.site/ 5 KB
2 KB 713ms
443ms Document
text/html 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 406d213b5bcb95cbdd56b2c6752899ba362d8d4ef193af0660da730269ce2afa

Request headers

Host: term-protec-secure.site
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 07 Dec 2019 11:54:02 GMT
X-Cache: HIT from Backend
Content-Encoding: gzip

GET
H/1.1 200
OK 1-ko0cSbN1S2P.css
term-protec-secure.site/css/ 36 KB
9 KB 229ms
227ms Stylesheet
text/css 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/css/1-ko0cSbN1S2P.css
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Jun 2019 13:55:46 GMT
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 2-fBxAYxBW8eI.css
term-protec-secure.site/css/ 29 KB
8 KB 442ms
435ms Stylesheet
text/css 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/css/2-fBxAYxBW8eI.css
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Jun 2019 13:57:48 GMT
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 3-pTiS7o2eCja.css
term-protec-secure.site/css/ 58 KB
10 KB 345ms
338ms Stylesheet
text/css 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/css/3-pTiS7o2eCja.css
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 5e4d9e8bb6babae78ea75acd08fb8c2fc094bc7565e15a21e793251b43b87ae6

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Dec 2019 15:03:22 GMT
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 4-2-9N8qo_l-I.css
term-protec-secure.site/css/ 17 KB
5 KB 444ms
437ms Stylesheet
text/css 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/css/4-2-9N8qo_l-I.css
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Jun 2019 16:34:52 GMT
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 5-o-wil6C-n6y.css
term-protec-secure.site/css/ 7 KB
2 KB 433ms
425ms Stylesheet
text/css 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: http://term-protec-secure.site/css/5-o-wil6C-n6y.css
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Jun 2019 16:35:32 GMT
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK F8n3WrEc0r.png
term-protec-secure.site/img/ 6 KB
6 KB 346ms
339ms Image
image/png 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://term-protec-secure.site/img/F8n3WrEc0r.png
Requested by: Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: 91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4

Request headers

Referer: http://term-protec-secure.site/checkpoint.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Last-Modified: Sun, 02 Jul 2017 16:53:22 GMT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6331

GET
H2 200 safe_image.php
external-lhr3-1.xx.fbcdn.net/ 70 B
960 B 80ms
20ms Image
image/png 2a03:2880:f01a:5:face:b00c:0:1
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://external-lhr3-1.xx.fbcdn.net/safe_image.php?d=AQA2_Pb4-pLPsoDq&url=https%3A%2F%2Fpixel.facebook.com%2Fsi%2Fkappa%2F%3FKo%3Dp&_nc_hash=AQBbs84gy-QEmIJ_

Requested by

Host: term-protec-secure.site
URL: http://term-protec-secure.site/checkpoint.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01a:5:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

9997c7e5e190d9933676c6a184c85773eaaca06163ea92deab277104ad710d36

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://term-protec-secure.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-config-version-olb-prod: 658
alt-svc: h3-24=":443"; ma=3600
content-length: 70
x-xss-protection: 0
x-fb-debug: +PS1bP01YJSquCfUc3k4fAFldzzwvtR5rXdlek9AwqiNwElcWVX3If2ni+3UEsdhQQfWUe+HrrqQ9/vA4cVUNQ==
x-fb-trip-id: 420120009
last-modified: Fri, 29 Nov 2019 11:40:15 GMT
x-fb-config-version-slb-prod_regional: 657
date: Tue, 10 Dec 2019 22:15:41 GMT
x-frame-options: DENY
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0
etag: "10dc3ea4d103964018532028697a2987"
timing-allow-origin: *
expires: Fri, 29 Nov 2019 11:40:15 GMT

GET
H/1.1 404
Not Found ccm050L6PDw.png
term-protec-secure.site/rsrc.php/v3/y3/r/ 315 B
315 B 228ms
226ms Image
text/html 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://term-protec-secure.site/rsrc.php/v3/y3/r/ccm050L6PDw.png
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: http://term-protec-secure.site/css/1-ko0cSbN1S2P.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Connection: keep-alive
Content-Length: 315
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK security.png
term-protec-secure.site/img/ 19 KB
19 KB 226ms
225ms Image
image/png 139.162.44.72
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://term-protec-secure.site/img/security.png
Protocol: HTTP/1.1
Server: 139.162.44.72 , Singapore, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: kakuna.rapidplex.com
Software: /
Resource Hash: e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5

Request headers

Referer: http://term-protec-secure.site/css/3-pTiS7o2eCja.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 10 Dec 2019 22:15:41 GMT
Last-Modified: Wed, 12 Jun 2019 16:19:00 GMT
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19461

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

external-lhr3-1.xx.fbcdn.net
term-protec-secure.site
139.162.44.72
2a03:2880:f01a:5:face:b00c:0:1
3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad
406d213b5bcb95cbdd56b2c6752899ba362d8d4ef193af0660da730269ce2afa
501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce
5e4d9e8bb6babae78ea75acd08fb8c2fc094bc7565e15a21e793251b43b87ae6
91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4
9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03
9997c7e5e190d9933676c6a184c85773eaaca06163ea92deab277104ad710d36
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5
ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1

term-protec-secure.site Open in urlscan Pro 139.162.44.72 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

10 Requests

10 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

63 kBTransfer

178 kBSize

0 Cookies

1 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

term-protec-secure.site Open in urlscan Pro
139.162.44.72 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

10 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

63 kB
Transfer

178 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!