violations-advertising.help

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3031::ac43:95e4, located in United States and belongs to CLOUDFLARENET, US. The main domain is violations-advertising.help.
TLS certificate: Issued by GTS CA 1P5 on December 10th 2023. Valid for: 3 months.

This is the only time violations-advertising.help was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3031::ac43:95e4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
4	2606:4700:303... 2606:4700:3030::ac43:c139	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

2 2606:4700:3031::ac43:95e4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

violations-advertising.help	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3030::ac43:c139 (United States)

ASN13335 (CLOUDFLARENET, US)

botkworm.asyu.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	asyu.de botkworm.asyu.de	81 KB
2	violations-advertising.help 1 redirects violations-advertising.help	1 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 324	21 KB
6	3

	Domain	Requested by
4	botkworm.asyu.de	violations-advertising.help botkworm.asyu.de
2	violations-advertising.help	1 redirects
1	cdn.jsdelivr.net	violations-advertising.help
6	3

This site contains no links.

Subject Issuer	Validity	Valid
violations-advertising.help GTS CA 1P5	`2023-12-10` - `2024-03-09`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
asyu.de GTS CA 1P5	`2024-01-22` - `2024-04-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://violations-advertising.help/
Frame ID: 980D31208B7EA18D700138E828B65B5C
Requests: 2 HTTP requests in this frame

Frame: https://botkworm.asyu.de/
Frame ID: BDFDDF6A2814B69D2966BCE47484A93B
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

violations-advertising.help

Page URL History Show full URLs

http://violations-advertising.help/ HTTP 301
https://violations-advertising.help/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

103 kB
Transfer

244 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://violations-advertising.help/ HTTP 301
https://violations-advertising.help/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
violations-advertising.help/
Redirect Chain

http://violations-advertising.help/
https://violations-advertising.help/

748 B
827 B

662ms
570ms

Document
text/html

2606:4700:3031::ac43:95e4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://violations-advertising.help/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:95e4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f94d9e0b6b548b31ed7feda4eb6885188a4adcadb2bebda6008c0cb288457ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 84de8149cba74bd8-BUF
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 31 Jan 2024 02:25:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WcIKgyZp50y3FoKPTAqYPoBMvpm5GenlBxtUo6DvBr10kBLx4legjYWFlnPuUEm%2Bz2gSQTK1kNaoHFqQfBfinWkuG5yWZMpbHUhhks8fXt5fTcu6gGRJk%2Bg120q6uU7VhYOSS6ZlTUUUKc1yoqrPNFimGOPNCWmKQs0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

CF-RAY: 84de8148dd424bc6-BUF
Cache-Control: max-age=3600
Connection: keep-alive
Date: Wed, 31 Jan 2024 02:25:36 GMT
Expires: Wed, 31 Jan 2024 03:25:36 GMT
Location: https://violations-advertising.help/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eP%2FUXbXGUU4U118iKXDV6zS0ExN2yP1AIhWyM%2Fkp7kCHHRX5%2FfMrwyL9t416uHMa6Awg4yX6XhLy3p6L20B7%2FKNwE8bw%2Fg6ALpzhdfDtsFW6mSsU%2FwunsKWT3wImKEBGNtnVMnPrtNOL6FtAQm2P%2FonpEvym5fVJweY%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/gh/penguasa-de/de@main/ 118 KB
21 KB 116ms
46ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/penguasa-de/de@main/bootstrap.min.css

Requested by

Host: violations-advertising.help
URL: https://violations-advertising.help/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

4194fb4472202061ab0db48cd8908fdfc09e95ee60edd654cac0c4e5cef31806

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://violations-advertising.help/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 31 Jan 2024 02:25:36 GMT
x-content-type-options: nosniff
content-encoding: br
age: 34365
x-jsd-version: main
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 21191
x-served-by: cache-fra-etou8220065-FRA, cache-ewr18172-EWR
x-jsd-version-type: branch
etag: W/"1d971-csHKU8+zexcbroKPl8kUrk+yAh4"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
botkworm.asyu.de/ Frame BDFD 10 KB
5 KB 1099ms
595ms Document
text/html 2606:4700:3030::ac43:c139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://botkworm.asyu.de/
Requested by: Host: violations-advertising.help
URL: https://violations-advertising.help/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 774a7a620778c4f91207e8867aa1b6b7b2ea0f197b7c4236eea0996d29985ac6

Request headers

Referer: https://violations-advertising.help/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 84de815168e34bd5-BUF
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 31 Jan 2024 02:25:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fN0OCjuIrqyBp%2FVCwRfDxafu%2FwnPSs7KGgeaSDv4LNiIJiCX949puLckFbFMApHe9ZGLv4XTdJMUJOhFlAcfSTL2BnE0AGw1O5DdsyqvP39kIk%2FKwdWOVeDofVhP0XnK4cagjvNV0PF%2BPeeGcey4"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 style-info.css
botkworm.asyu.de/css/info/ Frame BDFD 39 KB
9 KB 831ms
830ms Stylesheet
text/css 2606:4700:3030::ac43:c139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://botkworm.asyu.de/css/info/style-info.css
Requested by: Host: botkworm.asyu.de
URL: https://botkworm.asyu.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a19685dd02320285f9953a7b42b797311af3758f3939f835b19a32e22b6ceb08

Request headers

accept-language: en-US,en;q=0.9
Referer: https://botkworm.asyu.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:25:38 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 13 Jan 2023 19:23:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjvtH3b6rmpTzIvKkZ3Pm6zRTMpU9iolWUWA3D5az6wwBjCdi5AR2GYUUHE2WqnvWdQf%2FGhIpL6TR51G3nByjrBFWHo4P1ucLB%2F5rKwtDNT3uFvHdDNbJtm6HpOxDlBMWFHVPCWAZDzzTP6LP3KW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 84de81552a734bd5-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 interview.css
botkworm.asyu.de/css/info/ Frame BDFD 10 KB
2 KB 538ms
537ms Stylesheet
text/css 2606:4700:3030::ac43:c139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://botkworm.asyu.de/css/info/interview.css
Requested by: Host: botkworm.asyu.de
URL: https://botkworm.asyu.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fd50347aea7eb925101489f56e47fcb26a87a6990fa15ed94bd3696c2e127c5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://botkworm.asyu.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:25:38 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 01 Sep 2022 13:15:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dpijR9Wm251J2IzMm8eRqNQxshNGWx%2BzidSeNzmhJor9vnPfeT%2FEpxFMQrBF3GhS3Zyp4iWtvRjBo3kyzTSQstkqoorUI6w3s%2BBhAmJDxTWviYp8qdxp%2BRjdP8nSMxIXLXUl9wSgUGf%2FzwiYD31R"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 84de81552a754bd5-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 inF0loCk.png
botkworm.asyu.de/img/ Frame BDFD 65 KB
66 KB 572ms
572ms Image
image/png 2606:4700:3030::ac43:c139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://botkworm.asyu.de/img/inF0loCk.png
Requested by: Host: botkworm.asyu.de
URL: https://botkworm.asyu.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 579688068d5233880af95e437cd2761356187ca24b446fc02f2719eff5741382

Request headers

accept-language: en-US,en;q=0.9
Referer: https://botkworm.asyu.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:25:38 GMT
cf-cache-status: MISS
last-modified: Fri, 13 Jan 2023 19:14:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ay%2Bif6u6xbVuJTvSpqP%2B8LNfXb%2BSYA0ZLt1HKoU7sYLYYVB9xpVYxHJ10%2B4vQRRuyGeARyejXd1QROFnNF3B6KpBawGIIf8G2wuHxJBl6GLNlrZp7KbXTNE0J1fBi5%2BFyI0KgWP%2BDeIqEarpw%2BUB"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 84de81552a774bd5-BUF
alt-svc: h3=":443"; ma=86400
content-length: 67059

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

botkworm.asyu.de
cdn.jsdelivr.net
violations-advertising.help
2606:4700:3030::ac43:c139
2606:4700:3031::ac43:95e4
2a04:4e42:600::485
4194fb4472202061ab0db48cd8908fdfc09e95ee60edd654cac0c4e5cef31806
4fd50347aea7eb925101489f56e47fcb26a87a6990fa15ed94bd3696c2e127c5
579688068d5233880af95e437cd2761356187ca24b446fc02f2719eff5741382
774a7a620778c4f91207e8867aa1b6b7b2ea0f197b7c4236eea0996d29985ac6
9f94d9e0b6b548b31ed7feda4eb6885188a4adcadb2bebda6008c0cb288457ab
a19685dd02320285f9953a7b42b797311af3758f3939f835b19a32e22b6ceb08

violations-advertising.help Open in urlscan Pro 2606:4700:3031::ac43:95e4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

103 kBTransfer

244 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

violations-advertising.help Open in urlscan Pro
2606:4700:3031::ac43:95e4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

103 kB
Transfer

244 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!