fr.sslsecureproxy.com
Open in
urlscan Pro
51.38.232.44
Malicious Activity!
Public Scan
Submission: On December 14 via api from GB
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 19th 2019. Valid for: 3 months.
This is the only time fr.sslsecureproxy.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 51.38.232.44 51.38.232.44 | 16276 (OVH) (OVH) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
5 | 2606:4700:30:... 2606:4700:30::681c:14b8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 192.229.233.25 192.229.233.25 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
1 | 52.1.22.171 52.1.22.171 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
4 | 107.189.165.17 107.189.165.17 | 53755 (IOFLOOD) (IOFLOOD - Input Output Flood LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:808::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
18 | 8 |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
code.jquery.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.serveuk7.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
platform.twitter.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-1-22-171.compute-1.amazonaws.com
www.easycounter.com |
ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com |
ASN53755 (IOFLOOD - Input Output Flood LLC, US)
PTR: service.brought.to.you.by.uk7.org
servecontent.net |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
serveuk7.com
www.serveuk7.com |
11 KB |
4 |
servecontent.net
servecontent.net |
2 KB |
3 |
sslsecureproxy.com
fr.sslsecureproxy.com |
45 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
facebook.com
www.facebook.com |
|
1 |
easycounter.com
www.easycounter.com |
2 KB |
1 |
twitter.com
platform.twitter.com |
29 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
18 | 8 |
Domain | Requested by | |
---|---|---|
5 | www.serveuk7.com |
fr.sslsecureproxy.com
|
4 | servecontent.net |
www.serveuk7.com
fr.sslsecureproxy.com |
3 | fr.sslsecureproxy.com |
fr.sslsecureproxy.com
|
2 | www.google-analytics.com |
fr.sslsecureproxy.com
|
1 | www.facebook.com |
fr.sslsecureproxy.com
|
1 | www.easycounter.com |
fr.sslsecureproxy.com
|
1 | platform.twitter.com |
fr.sslsecureproxy.com
|
1 | code.jquery.com |
fr.sslsecureproxy.com
|
18 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
twitter.com |
www.sslsecureproxy.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.4everproxy.com Let's Encrypt Authority X3 |
2019-11-19 - 2020-02-17 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
sni204398.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-20 - 2020-02-26 |
6 months | crt.sh |
*.twimg.com DigiCert SHA2 High Assurance Server CA |
2019-11-12 - 2020-11-18 |
a year | crt.sh |
easycounter.com Let's Encrypt Authority X3 |
2019-11-25 - 2020-02-23 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2019-12-06 - 2020-03-05 |
3 months | crt.sh |
servecontent.net Let's Encrypt Authority X3 |
2019-11-11 - 2020-02-09 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2019-11-13 - 2020-02-05 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://fr.sslsecureproxy.com/direct/aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2ltcHJlc3Npb24ucGhwL2ZhMTUyNWYyZjE1ZDk0Lz9hcGlfa2V5PTI2MDg5MDU0NzExNSZsaWQ9MTE1JnBheWxvYWQ9JTdCJTIyc291cmNlJTIyJTNBJTIyanNzZGslMjIlN0Q-
Frame ID: 844512A75F641414CCFCD18A9CAFFF40
Requests: 15 HTTP requests in this frame
Frame:
https://www.facebook.com/plugins/like.php?locale=en_US&href=https%3A%2F%2Fwww.facebook.com%2F4everproxy&width=99&layout=button&action=like&show_faces=false&share=true&height=65&appId
Frame ID: E4217F03E61E266BE36F28C6702A3843
Requests: 1 HTTP requests in this frame
Frame:
https://servecontent.net/content/www/delivery/afr.php?zoneid=9&target=_blank&cb=INSERT_RANDOM_NUMBER_HERE
Frame ID: B3AFCC3A7073288D10C13E5EB9EF6B06
Requests: 1 HTTP requests in this frame
Frame:
https://servecontent.net/content/www/delivery/afr.php?zoneid=8&cb=INSERT_RANDOM_NUMBER_HERE
Frame ID: 082DED9FAE5D514E5BD55914A19810D4
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Follow @foreverproxy
Search URL Search Domain Scan URL
Title: Tweet
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2ltcHJlc3Npb24ucGhwL2ZhMTUyNWYyZjE1ZDk0Lz9hcGlfa2V5PTI2MDg5MDU0NzExNSZsaWQ9MTE1JnBheWxvYWQ9JTdCJTIyc291cmNlJTIyJTNBJTIyanNzZGslMjIlN0Q-
fr.sslsecureproxy.com/direct/ |
33 KB 34 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.1.min.js
code.jquery.com/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9e612c6e0ef0495e2af138b341df5391.js
www.serveuk7.com/public/cache/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
widgets.js
platform.twitter.com/ |
95 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HGTYg7QchuykeuNtc0dibBZZ8WAC9_XLDSeuQvMbik68C58dBmDxNYOTImE4qq1wbBT~DLQg7Z5QVlo2w_pFXw--
fr.sslsecureproxy.com/secure/ |
809 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3zU~k1qKllUABBK4KXLK5tXWdVoiclpM9HdcrHYhRT0Wn4PUvtGCqZsDgmQRTDuOImNzZ3af7pmBg6eyiKFgtw--
fr.sslsecureproxy.com/secure/ |
10 KB 10 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
counter.php
www.easycounter.com/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
innerHeaderBg.png
www.serveuk7.com/themes/default/@img/ |
187 B 273 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like.php
www.facebook.com/plugins/ Frame E421 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framedLogo.png
www.serveuk7.com/themes/sslsecureproxy_com/@img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
submit.png
www.serveuk7.com/themes/default/@img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
innerOptions.png
www.serveuk7.com/themes/default/@img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ajs.php
servecontent.net/content/www/delivery/ |
609 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lg.php
servecontent.net/content/www/delivery/ |
43 B 528 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
afr.php
servecontent.net/content/www/delivery/ Frame B3AF |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
afr.php
servecontent.net/content/www/delivery/ Frame 082D |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate undefined| $ function| jQuery function| foreverJQ object| foreverBrowser function| fixInputPlaceholders function| base64_decode object| foreverHelper function| foreverUrlIsProxified function| foreverProxifyUrl function| foreverProxifyLocation_href function| foreverProxifyLocation_replace function| foreverProxifyLocation_assign object| __twttrll object| twttr object| __twttr string| data string| m3_u number| m3_r string| OX_630fb6aa string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
servecontent.net/ | Name: OAGEO Value: DE%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C |
|
servecontent.net/ | Name: OAID Value: e8889a2e1aecb6086959903195265898 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15552000; preload |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fr.sslsecureproxy.com
platform.twitter.com
servecontent.net
www.easycounter.com
www.facebook.com
www.google-analytics.com
www.serveuk7.com
107.189.165.17
192.229.233.25
2001:4de0:ac19::1:b:3b
2606:4700:30::681c:14b8
2a00:1450:4001:808::200e
2a03:2880:f11c:8083:face:b00c:0:25de
51.38.232.44
52.1.22.171
085628c013234c5a8d239bc91b63b78b1e16ac228485596b22bd885f0f24e6d4
0d7deb70cb01006836b504629c85f954ac9159327886c8e3a56f1c9c43c32159
0e45cf63d22b18a68c84386087c5624922d6e8d9366ebbb7872adbc7f7b4febb
2089ec48244306090ade67ae51ad70b46df4b55a3556a80b1f9c082bd38cd1d5
3b7b594a16c3a3860cf47672b4979a2e5f92a95022f9d96cc5bf292fda9a54dd
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
82f420005cd31fab6b4ab016a07d623e8f5773de90c526777de5ba91e9be3b4d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
bd3a3af0129cd0fe978372f92a83dc1b1f5ab7daf9209e357b8126fb6114da9a
d5dc13c4c800816dfeefbe7c4dadc87ac7fb3e79c77e391c28c49497d94e996f
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9d9a70ec7418a19cd6152cc1b8cc41e744cc6e6557d02e401592223673c174d
ff6a67b5b4c91cf683b9168393ce7aa41d64326a40b928809cdf7e15d0b3c8b8