www.moneytiktok.tk Open in urlscan Pro
2a03:6f00:1:2::5c35:7487  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.moneytiktok.tk/	24 KB 10 KB	124ms 43ms	Document text/html	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash 4ee466f9dd2174b77938f21405105b9127818dda180347db5285374a2d33ac98 Request headers :method GET :authority www.moneytiktok.tk :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx/1.16.1 date Mon, 01 Mar 2021 10:39:27 GMT content-type text/html; charset=utf-8 vary Accept-Encoding last-modified Mon, 01 Mar 2021 08:01:14 GMT etag W/"6031-5bc75059659f7" content-encoding gzip
GET H2	200	loading.gif www.moneytiktok.tk/img/	23 KB 23 KB	41ms 40ms	Image image/gif	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.moneytiktok.tk/img/loading.gif Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash 6f17dbea8b6db5fd570d0a498b3a082691979671adf03ac1aa3c20697ec8296e Request headers Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 10:39:27 GMT last-modified Sat, 27 Feb 2021 18:57:27 GMT server nginx/1.16.1 etag "603a9617-5c95" content-type image/gif cache-control max-age=2678400 accept-ranges bytes content-length 23701 expires Thu, 01 Apr 2021 10:39:27 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.0/	84 KB 30 KB	26ms 7ms	Script text/javascript	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.0/jquery.min.js Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 24 Feb 2021 12:26:24 GMT content-encoding gzip x-content-type-options nosniff age 425583 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30089 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 24 Feb 2022 12:26:24 GMT
GET H2	200	sofiapro-regular.otf www.moneytiktok.tk/fonts/	155 KB 155 KB	71ms 71ms	Font application/octet-stream	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL https://www.moneytiktok.tk/fonts/sofiapro-regular.otf Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash e145b1a56b822a1f604021905dc0c661a5447c13a569b6424be2abc8c140b668 Request headers Origin https://www.moneytiktok.tk Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 10:39:27 GMT last-modified Sat, 27 Feb 2021 18:57:24 GMT server nginx/1.16.1 accept-ranges bytes etag "26bf4-5bc55f48d4bf3" content-length 158708
GET DATA	200 OK	truncated /	521 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1565f93098b6935add0af93015b436b72d37b85973bb3b4ed8bde279f1f0dedf Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cc1058f0f690b91d486b7f8e6da82692fe16dd4dd407304088a7d526576039d4 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	hidePassword.svg www.moneytiktok.tk/img/	801 B 983 B	41ms 40ms	Image image/svg+xml	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.moneytiktok.tk/img/hidePassword.svg Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash 0e33144028c0206ade61f8aaab12bf2cd7a1b2abbbcf5036d487a7cae16be9bc Request headers Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 10:39:29 GMT last-modified Sat, 27 Feb 2021 18:57:26 GMT server nginx/1.16.1 etag "603a9616-321" content-type image/svg+xml cache-control max-age=2678400 accept-ranges bytes content-length 801 expires Thu, 01 Apr 2021 10:39:29 GMT
GET H2	200	Proxima-Nova-Regular.otf www.moneytiktok.tk/fonts/	134 KB 134 KB	165ms 164ms	Font application/octet-stream	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL https://www.moneytiktok.tk/fonts/Proxima-Nova-Regular.otf Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash 21387d49779e6ad4ce969a865eb7543619aa37f3bd9c3243018340b08b774e3e Request headers Origin https://www.moneytiktok.tk Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 10:39:29 GMT last-modified Sat, 27 Feb 2021 18:57:23 GMT server nginx/1.16.1 accept-ranges bytes etag "218dc-5bc55f47b2b64" content-length 137436
GET H2	200	Proxima-Nova-Bold.otf www.moneytiktok.tk/fonts/	138 KB 139 KB	87ms 87ms	Font application/octet-stream	2a03:6f00:1:2::5c35:7487 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL https://www.moneytiktok.tk/fonts/Proxima-Nova-Bold.otf Requested by Host: www.moneytiktok.tk URL: https://www.moneytiktok.tk/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:6f00:1:2::5c35:7487 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.16.1 / Resource Hash b1fb6db7fb9b71519ef57c1352cd8510e9789110fbc780103a2becfa850bb79d Request headers Origin https://www.moneytiktok.tk Referer https://www.moneytiktok.tk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 10:39:29 GMT last-modified Sat, 27 Feb 2021 18:57:22 GMT server nginx/1.16.1 accept-ranges bytes etag "22970-5bc55f4732c8c" content-length 141680

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TikTok (Social Network)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
www.moneytiktok.tk
2a00:1450:4001:82a::200a
2a03:6f00:1:2::5c35:7487
0e33144028c0206ade61f8aaab12bf2cd7a1b2abbbcf5036d487a7cae16be9bc
1565f93098b6935add0af93015b436b72d37b85973bb3b4ed8bde279f1f0dedf
21387d49779e6ad4ce969a865eb7543619aa37f3bd9c3243018340b08b774e3e
4ee466f9dd2174b77938f21405105b9127818dda180347db5285374a2d33ac98
6f17dbea8b6db5fd570d0a498b3a082691979671adf03ac1aa3c20697ec8296e
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
b1fb6db7fb9b71519ef57c1352cd8510e9789110fbc780103a2becfa850bb79d
cc1058f0f690b91d486b7f8e6da82692fe16dd4dd407304088a7d526576039d4
e145b1a56b822a1f604021905dc0c661a5447c13a569b6424be2abc8c140b668