app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link
Open in
urlscan Pro
139.162.53.28
Malicious Activity!
Public Scan
URL:
http://app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/Info_help.php?/pages_recovery_disable=rec/
Submission: On October 22 via api from NL — Scanned from IT
Submission: On October 22 via api from NL — Scanned from IT
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 9 HTTP transactions.
The main IP is 139.162.53.28, located in
Singapore and
belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG.
The main domain is app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link.
This is the only time app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link was scanned on urlscan.io!
This is the only time app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 139.162.53.28 139.162.53.28 | 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud) | |
| 1 | 142.250.186.106 142.250.186.106 | 15169 (GOOGLE) (GOOGLE) | |
| 3 | 142.250.185.227 142.250.185.227 | 15169 (GOOGLE) (GOOGLE) | |
| 9 | 3 |
5
139.162.53.28
(Singapore)
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 139-162-53-28.ip.linodeusercontent.com
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 139-162-53-28.ip.linodeusercontent.com
| app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link |
1
142.250.186.106
(United States)
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net
| fonts.googleapis.com |
3
142.250.185.227
(United States)
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net
| fonts.gstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
temp-site.link
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link |
164 KB |
| 3 |
gstatic.com
fonts.gstatic.com |
43 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 49 |
920 B |
| 9 | 3 |
| Domain | Requested by | |
|---|---|---|
| 5 | app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link |
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link
|
| 3 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link
|
| 9 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2023-09-28 - 2023-12-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/Info_help.php?/pages_recovery_disable=rec/
Frame ID: 6107DCE32E7F094EFD9806A0400D6BE3
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Service PolicyDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
Info_help.php
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/css/ |
158 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/css/ |
97 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
martambuah.png
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/img/ |
109 KB 110 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sigm.jpeg
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link/img/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
6 KB 920 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v20/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4iCv6KVjbNBYlgoCjC3jsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v20/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v20/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| mousedwn0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app-hodkie228jahbava.6vyp5ngaax-v1p3z1lrg4ye.p.temp-site.link
fonts.googleapis.com
fonts.gstatic.com
139.162.53.28
142.250.185.227
142.250.186.106
0903c47e44202c72ad2ee0563b2a05b063bf3cacfe050a4ce5775658e680cab9
310f43dcf89e7e2126985250d62f18207e0b481057279af831869128209ea884
50a904ea94307d040e791dd1a5d28f678a23e11582f9e9f380b67e6f8f2ff0ef
7760b7a07a154b900ace3b13f53360f05255e3f9332fa702cff0e01af1331694
9acff11d75749203c75c205db3e72fbf684b26181241219985100f7c2e96eb61
b4256b342b4e020cf299351736c24859aae325ec184db113199b79b03b953186
c0bc26da9499372e6b55886d4f2040de764391ecc9cefdd8a5df0284a345120e
d577198130d641e753e3d89a453ffcc7650e4f40b62cd0063ab152f8e55443b0
f333e1585f5495ef86fb36a5ccbc84efbc2ff3c56d95411618688fd2cdd9cbb7