moderation.msp-scammers.fr Open in urlscan Pro
54.204.238.15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://msp-scammers.fr/
Effective URL:
https://moderation.msp-scammers.fr/
Submission: On April 26 via api (April 26th 2024, 10:02:59 am UTC) from LU — Scanned from FR

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 54.204.238.15, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is moderation.msp-scammers.fr.
TLS certificate: Issued by R3 on April 2nd 2024. Valid for: 3 months.

This is the only time moderation.msp-scammers.fr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2001:8d8:100f... 2001:8d8:100f:f000::200	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
2	54.204.238.15 54.204.238.15	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:211... 2600:9000:211e:da00:7:59dd:7880:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
10	5

1 2001:8d8:100f:f000::200 (Germany) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

msp-scammers.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.204.238.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-238-15.compute-1.amazonaws.com

moderation.msp-scammers.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:da00:7:59dd:7880:93a1 (United States)

ASN16509 (AMAZON-02, US)

images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	msp-scammers.fr 1 redirects msp-scammers.fr moderation.msp-scammers.fr	147 KB
1	gstatic.com fonts.gstatic.com	22 KB
1	wixmp.com images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com — Cisco Umbrella Rank: 17799	17 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	841 B
0	Failed function sub() { [native code] }. Failed
10	5

	Domain	Requested by
2	moderation.msp-scammers.fr
1	fonts.gstatic.com	fonts.googleapis.com
1	images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com	moderation.msp-scammers.fr
1	fonts.googleapis.com	moderation.msp-scammers.fr
1	msp-scammers.fr	1 redirects
0	invalid Failed	moderation.msp-scammers.fr
10	6

This site contains links to these domains. Also see Links.

Domain
carrd.co

Subject Issuer	Validity	Valid
moderation.msp-scammers.fr R3	`2024-04-02` - `2024-07-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-08` - `2024-07-01`	3 months	crt.sh
*.wixmp.com Sectigo RSA Domain Validation Secure Server CA	`2023-12-25` - `2024-06-22`	6 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-04-08` - `2024-07-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://moderation.msp-scammers.fr/
Frame ID: 926C7250E2BC605457E0E08371D4D738
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

S.E

Page URL History Show full URLs

http://msp-scammers.fr/ HTTP 307
https://msp-scammers.fr/ HTTP 307
http://msp-scammers.fr/ HTTP 302
https://moderation.msp-scammers.fr/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

50 %
HTTPS

80 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

186 kB
Transfer

234 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://carrd.co/build?ref=auto
Title: Made with Carrd

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://msp-scammers.fr/ HTTP 307
https://msp-scammers.fr/ HTTP 307
http://msp-scammers.fr/ HTTP 302
https://moderation.msp-scammers.fr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
moderation.msp-scammers.fr/
Redirect Chain

http://msp-scammers.fr/
https://msp-scammers.fr/
http://msp-scammers.fr/
https://moderation.msp-scammers.fr/

145 KB
146 KB

323ms
100ms

Document
text/html

54.204.238.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://moderation.msp-scammers.fr/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.204.238.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-204-238-15.compute-1.amazonaws.com
Software: uvicorn /
Resource Hash: 06737d271760ee6a4e51b6c63ffecfc467d69c83aa4e1f13c231a2822d1e2f05

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

Connection: keep-alive
Content-Length: 148485
Content-Type: text/html; charset=utf-8
Date: Fri, 26 Apr 2024 10:02:53 GMT
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1714125773&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=zK4EsQKMSlj2q2gBNUKKgkDmSx%2BWYrxt9MS8BCZCPGk%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1714125773&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=zK4EsQKMSlj2q2gBNUKKgkDmSx%2BWYrxt9MS8BCZCPGk%3D
Server: uvicorn
Via: 1.1 vegur

Redirect headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: text/html
Date: Fri, 26 Apr 2024 10:02:53 GMT
Keep-Alive: timeout=15
Location: https://moderation.msp-scammers.fr
Server: Apache

GET /
invalid/ 0
0

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
841 B 99ms
37ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?display=swap&family=Martian+Mono:ital,wght@0,200;0,600;1,200;1,600

Requested by

Host: moderation.msp-scammers.fr
URL: https://moderation.msp-scammers.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f27cdf64fa30b50996c2ce0fe903a92d881501c43b316970e009c105565eb4f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://moderation.msp-scammers.fr/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Fri, 26 Apr 2024 10:02:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Fri, 26 Apr 2024 10:02:54 GMT

GET /
invalid/ 0
0

GET
H2 200 edited_anime_pfp_by_colthedeveloper_dezlfk3-fullview.jpg
images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/f/79ab98ce-0229-4913-b844-33b9dab85cf6/dezlfk3-d7c837d8-e2e3-4e4b-8152-8fe86f759755.png/v1/fill/w_571,h_440,q_80,strp/ 17 KB
17 KB 162ms
36ms Image
image/jpeg 2600:9000:211e:da00:7:59dd:7880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/f/79ab98ce-0229-4913-b844-33b9dab85cf6/dezlfk3-d7c837d8-e2e3-4e4b-8152-8fe86f759755.png/v1/fill/w_571,h_440,q_80,strp/edited_anime_pfp_by_colthedeveloper_dezlfk3-fullview.jpg?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1cm46YXBwOjdlMGQxODg5ODIyNjQzNzNhNWYwZDQxNWVhMGQyNmUwIiwiaXNzIjoidXJuOmFwcDo3ZTBkMTg4OTgyMjY0MzczYTVmMGQ0MTVlYTBkMjZlMCIsIm9iaiI6W1t7ImhlaWdodCI6Ijw9NDQwIiwicGF0aCI6IlwvZlwvNzlhYjk4Y2UtMDIyOS00OTEzLWI4NDQtMzNiOWRhYjg1Y2Y2XC9kZXpsZmszLWQ3YzgzN2Q4LWUyZTMtNGU0Yi04MTUyLThmZTg2Zjc1OTc1NS5wbmciLCJ3aWR0aCI6Ijw9NTcxIn1dXSwiYXVkIjpbInVybjpzZXJ2aWNlOmltYWdlLm9wZXJhdGlvbnMiXX0.I2I70EfCte4MYXu9-3Gn7FnVLS7pxlxO-4mcLl1kTKM
Requested by: Host: moderation.msp-scammers.fr
URL: https://moderation.msp-scammers.fr/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:da00:7:59dd:7880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d6f538a88ac8f4aafc9136962ecb2a8d253eda6886aae9a688ebac40281de92e

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://moderation.msp-scammers.fr/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

x-seen-by: image-manipulator-78db47bd87-mpwld
date: Mon, 22 Apr 2024 18:02:35 GMT
via: 1.1 google, 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 316819
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
x-amz-cf-id: P0KeErODiDa9KCungnAs7C4hmxUYZpyENw916RKvdOAwfi8y_qOAIw==
content-length: 17089
wix-tracer: 2fSypN2bL1rMpsWiUTqN8czIqHu

GET /
invalid/ 0
0

GET
DATA 200
OK truncated
/ 35 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a0927b6db0bfd4a5091a8167322bf02efba44e56940945a42b1078fe431d748

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6010939654d3b864eddba461694a72eede5812ba21ff0291cdcf1fc69070691e

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 2V0PKIcADoYhV6w87xrTKjs4CYElh_VS9YA4TlTnaTq9wXulPFk.woff2
fonts.gstatic.com/s/martianmono/v3/ 21 KB
22 KB 90ms
27ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/martianmono/v3/2V0PKIcADoYhV6w87xrTKjs4CYElh_VS9YA4TlTnaTq9wXulPFk.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?display=swap&family=Martian+Mono:ital,wght@0,200;0,600;1,200;1,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ff4a574eb3b4adabe011e80a534fde0f8bf303d4a8e1bb6681ce5b5e30aba86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://moderation.msp-scammers.fr
Accept-Language: fr-FR,fr;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 24 Apr 2024 11:56:53 GMT
x-content-type-options: nosniff
age: 165961
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21660
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 18:18:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Apr 2025 11:56:53 GMT

GET
H/1.1 404
Not Found favicon.ico
moderation.msp-scammers.fr/ 18 B
704 B 104ms
98ms Other
text/plain 54.204.238.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://moderation.msp-scammers.fr/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.204.238.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-204-238-15.compute-1.amazonaws.com
Software: uvicorn /
Resource Hash: 739e3da4d1b298800721f9456cf16ce627973250c04a518f94906cec0ff8e6c3

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://moderation.msp-scammers.fr/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Mobile/15E148 Safari/604.1

Response headers

Date: Fri, 26 Apr 2024 10:02:53 GMT
Via: 1.1 vegur
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Server: uvicorn
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1714125774&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=6k%2FwFRxYmMjevxadtguzMGTnqKkDuUyMpC4ZroVaEWY%3D"}]}
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Content-Length: 18
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1714125774&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&s=6k%2FwFRxYmMjevxadtguzMGTnqKkDuUyMpC4ZroVaEWY%3D

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: invalid
URL: chrome-extension://invalid/

Domain: invalid
URL: chrome-extension://invalid/

Domain: invalid
URL: chrome-extension://invalid/

Domain: invalid
URL: chrome-extension://invalid/

Domain: invalid
URL: chrome-extension://invalid/

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __REQUESTLY__ function| _scrollToTop

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: chrome-extension://invalid/ Message: Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network	error	URL: https://moderation.msp-scammers.fr/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com
invalid
moderation.msp-scammers.fr
msp-scammers.fr
invalid
2001:8d8:100f:f000::200
2600:9000:211e:da00:7:59dd:7880:93a1
2a00:1450:4001:812::200a
2a00:1450:4001:82b::2003
54.204.238.15
06737d271760ee6a4e51b6c63ffecfc467d69c83aa4e1f13c231a2822d1e2f05
5ff4a574eb3b4adabe011e80a534fde0f8bf303d4a8e1bb6681ce5b5e30aba86
6010939654d3b864eddba461694a72eede5812ba21ff0291cdcf1fc69070691e
739e3da4d1b298800721f9456cf16ce627973250c04a518f94906cec0ff8e6c3
7a0927b6db0bfd4a5091a8167322bf02efba44e56940945a42b1078fe431d748
d6f538a88ac8f4aafc9136962ecb2a8d253eda6886aae9a688ebac40281de92e
f27cdf64fa30b50996c2ce0fe903a92d881501c43b316970e009c105565eb4f9

moderation.msp-scammers.fr Open in urlscan Pro 54.204.238.15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

50 %HTTPS

80 %IPv6

5 Domains

6 Subdomains

5 IPs

2 Countries

186 kBTransfer

234 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

moderation.msp-scammers.fr Open in urlscan Pro
54.204.238.15 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

50 %
HTTPS

80 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

186 kB
Transfer

234 kB
Size

0
Cookies

10 HTTP transactions
2 data transactions