support-market-ai.support-ai.cfd
Open in
urlscan Pro
37.221.110.56
Malicious Activity!
Public Scan
Submitted URL: http://support-market-ai.support-ai.cfd/uaia.php
Effective URL: https://support-market-ai.support-ai.cfd/uaia.php
Submission Tags: @ecarlesi possiblethreat phishing facebook Search All
Submission: On December 22 via api from IT — Scanned from CA
Effective URL: https://support-market-ai.support-ai.cfd/uaia.php
Submission Tags: @ecarlesi possiblethreat phishing facebook Search All
Submission: On December 22 via api from IT — Scanned from CA
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 9 HTTP transactions.
The main IP is 37.221.110.56, located in
Montreal, Canada and
belongs to HIVE-DATA-CENTER, CA.
The main domain is support-market-ai.support-ai.cfd.
TLS certificate: Issued by R11 on December 22nd 2024. Valid for: 3 months.
This is the only time support-market-ai.support-ai.cfd was scanned on urlscan.io!
TLS certificate: Issued by R11 on December 22nd 2024. Valid for: 3 months.
This is the only time support-market-ai.support-ai.cfd was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 37.221.110.56 37.221.110.56 | 33185 (HIVE-DATA...) (HIVE-DATA-CENTER) | |
| 1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
| 1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
| 9 | 4 |
6
37.221.110.56
(Montreal, Canada)
ASN33185 (HIVE-DATA-CENTER, CA)
PTR: xBQppt.gamersportal.org
ASN33185 (HIVE-DATA-CENTER, CA)
PTR: xBQppt.gamersportal.org
| support-market-ai.support-ai.cfd |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
support-ai.cfd
support-market-ai.support-ai.cfd |
78 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 847 |
31 KB |
| 1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318 |
19 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
15 KB |
| 9 | 4 |
| Domain | Requested by | |
|---|---|---|
| 6 | support-market-ai.support-ai.cfd |
support-market-ai.support-ai.cfd
|
| 1 | code.jquery.com |
support-market-ai.support-ai.cfd
|
| 1 | cdn.jsdelivr.net |
support-market-ai.support-ai.cfd
|
| 1 | cdnjs.cloudflare.com |
support-market-ai.support-ai.cfd
|
| 9 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| facebook.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| markett.support-ais.com R11 |
2024-12-22 - 2025-03-22 |
3 months | crt.sh |
| cdnjs.cloudflare.com WE1 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://support-market-ai.support-ai.cfd/uaia.php
Frame ID: E0975EC64A354FA03F823704FCE5EAE8
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Restriction InformationPage URL History Show full URLs
-
http://support-market-ai.support-ai.cfd/uaia.php
HTTP 307
https://support-market-ai.support-ai.cfd/uaia.php Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
SweetAlert2
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /npm/sweetalert2@([\d.]+)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://facebook.com/communitystandards/
Title: For more information on the reason for account deactivation, please visit Community Standards.
Title: For more information on the reason for account deactivation, please visit Community Standards.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://support-market-ai.support-ai.cfd/uaia.php
HTTP 307
https://support-market-ai.support-ai.cfd/uaia.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
uaia.php
support-market-ai.support-ai.cfd/ Redirect Chain
|
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cocc.css
support-market-ai.support-ai.cfd/asset/ |
41 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmm.css
support-market-ai.support-ai.cfd/asset/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chongf12.js
support-market-ai.support-ai.cfd/hethong/ |
446 B 377 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/ |
82 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sweetalert2@11
cdn.jsdelivr.net/npm/ |
71 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
new.png
support-market-ai.support-ai.cfd/hethong/ |
65 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
support-market-ai.support-ai.cfd/ |
279 B 329 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
support-market-ai.support-ai.cfd
104.17.24.14
2a04:4e42:200::485
2a04:4e42:600::649
37.221.110.56
13308f6c6e19ee38a0be6bef2a0f7cb8683778f9824b4911b2a26cc8bd8eea69
579688068d5233880af95e437cd2761356187ca24b446fc02f2719eff5741382
658e4d9e42c89c0bdd6efbe09d345bbae9ffc18eed6000d23c74feea8d58c0e4
94c520ac9e35aadd6d449357ab69c5a111da02efe07bce28e5a60c744d375a35
9912a9154c510429fa1b8087ed8b3ec90ef2c55b97a7dca6440e2a21789de740
a361e7885c36bacb3fd9cb068da207c3b9329962cac022d06e28923939f575e8
be4607a6dcff84bde41bd1d5a651aeb8a246a51277d5fb71906520e2e9437829
f654ee0653346cb9b2e6070e399798a6a332feea19671d71abb064c4fcdbfd23
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e