support-copyrightviolation.ga

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 7 HTTP transactions. The main IP is 18.159.130.79, located in United States and belongs to AMAZON-02, US. The main domain is support-copyrightviolation.ga.
TLS certificate: Issued by R3 on December 5th 2020. Valid for: 3 months.

This is the only time support-copyrightviolation.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	18.159.130.79 18.159.130.79	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700:10:... 2606:4700:10::6814:2326	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	50.248.110.146 50.248.110.146	7922 (COMCAST-7922) (COMCAST-7922)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
7	6

2 18.159.130.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-130-79.eu-central-1.compute.amazonaws.com

support-copyrightviolation.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:2326 (United States)

ASN13335 (CLOUDFLARENET, US)

pocketnow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.248.110.146 (Greenback, United States)

ASN7922 (COMCAST-7922, US)
PTR: 50-248-110-146-static.hfc.comcastbusiness.net

www.idleair.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	support-copyrightviolation.ga support-copyrightviolation.ga	645 KB
1	wikimedia.org upload.wikimedia.org	46 KB
1	idleair.com www.idleair.com	38 KB
1	pocketnow.com pocketnow.com	65 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	6 KB
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
7	6

	Domain	Requested by
2	support-copyrightviolation.ga	support-copyrightviolation.ga
1	upload.wikimedia.org	support-copyrightviolation.ga
1	www.idleair.com	support-copyrightviolation.ga
1	pocketnow.com	support-copyrightviolation.ga
1	maxcdn.bootstrapcdn.com	support-copyrightviolation.ga
0	cdnjs.cloudflare.com Failed	support-copyrightviolation.ga
7	6

This site contains no links.

Subject Issuer	Validity	Valid
support-copyrightviolation.ga R3	`2020-12-05` - `2021-03-05`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-15` - `2021-08-15`	a year	crt.sh
*.idleair.com AlphaSSL CA - SHA256 - G2	`2020-02-10` - `2022-03-14`	2 years	crt.sh
*.wikipedia.org DigiCert SHA2 High Assurance Server CA	`2020-11-09` - `2021-11-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://support-copyrightviolation.ga/
Frame ID: 0C7BE923D5D7B037D9DACECA2162B79B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

60 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

801 kB
Transfer

821 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
support-copyrightviolation.ga/ 5 KB
2 KB 127ms
27ms Document
text/html 18.159.130.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://support-copyrightviolation.ga/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.159.130.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-130-79.eu-central-1.compute.amazonaws.com
Software: nginx / PHP/7.4.13 PleskLin
Resource Hash: 4ca17f974fb66944b49e477206c92bf0ae6e5917a1fcf3ad988c60ea4fc4433a

Request headers

:method: GET
:authority: support-copyrightviolation.ga
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: nginx
date: Sat, 05 Dec 2020 13:01:06 GMT
content-type: text/html; charset=UTF-8
content-length: 2031
x-powered-by: PHP/7.4.13 PleskLin
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 26 KB
6 KB 22ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

Requested by

Host: support-copyrightviolation.ga
URL: https://support-copyrightviolation.ga/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

/

Resource Hash

936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://support-copyrightviolation.ga/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 05 Dec 2020 13:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:19 GMT
etag: "1544639719"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6079

GET font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 0
0

GET
H2 200 facebook-1.jpg
pocketnow.com/files/2020/04/ 64 KB
65 KB 902ms
877ms Image
image/jpeg 2606:4700:10::6814:2326
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pocketnow.com/files/2020/04/facebook-1.jpg

Requested by

Host: support-copyrightviolation.ga
URL: https://support-copyrightviolation.ga/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:2326 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f179217d4bc88944004cd1bf699cd9f333aa13e5954a6ac4613fc218cc81b3e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://support-copyrightviolation.ga/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 05 Dec 2020 13:01:07 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
content-length: 66046
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge,chrome=1
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 22 Apr 2020 21:09:04 GMT
server: cloudflare
etag: "5ea0b270-101fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cf-request-id: 06d496f3ac0000177e42bb5000000001
accept-ranges: bytes
cf-ray: 5fcdf432ac11177e-FRA

GET
H2 200 fb.gif
support-copyrightviolation.ga/ 642 KB
643 KB 34ms
33ms Image
image/gif 18.159.130.79
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://support-copyrightviolation.ga/fb.gif
Requested by: Host: support-copyrightviolation.ga
URL: https://support-copyrightviolation.ga/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.159.130.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-130-79.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7

Request headers

Referer: https://support-copyrightviolation.ga/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 05 Dec 2020 13:01:06 GMT
last-modified: Sat, 05 Dec 2020 09:36:03 GMT
server: nginx
x-powered-by: PleskLin
etag: "5fcb5483-a06dc"
content-type: image/gif
accept-ranges: bytes
content-length: 657116

GET
H/1.1 200
OK Available-on-iPhone-App-Store-466x139.png
www.idleair.com/wp-content/uploads/2010/12/ 38 KB
38 KB 451ms
142ms Image
image/png 50.248.110.146
COMCAST-7922

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.idleair.com/wp-content/uploads/2010/12/Available-on-iPhone-App-Store-466x139.png

Requested by

Host: support-copyrightviolation.ga
URL: https://support-copyrightviolation.ga/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.248.110.146 Greenback, United States, ASN7922 (COMCAST-7922, US),

Reverse DNS

50-248-110-146-static.hfc.comcastbusiness.net

Software

Apache/2.4.46 (Ubuntu) /

Resource Hash

11ddf837781c413f5f5b47f36f26a24aff89eb3108b632a5baf8ba269d0b2d98

Security Headers

Name	Value
Content-Security-Policy	default-src https: 'unsafe-inline' 'unsafe-eval'; img-src www.idleair.com .googleapis.com .gstatic.com .gravatar.com .google-analytics.com .w3.org data:; font-src data: www.idleair.com .gstatic.com
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://support-copyrightviolation.ga/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 05 Dec 2020 13:00:08 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 04 Dec 2014 22:03:54 GMT
Server: Apache/2.4.46 (Ubuntu)
ETag: "972a-5096b22d3a680"
X-Frame-Options: DENY
Content-Type: image/png
Connection: Keep-Alive
Content-Security-Policy: default-src https: 'unsafe-inline' 'unsafe-eval'; img-src www.idleair.com *.googleapis.com *.gstatic.com *.gravatar.com *.google-analytics.com *.w3.org data:; font-src data: www.idleair.com *.gstatic.com
Strict-Transport-Security: max-age=63072000; includeSubDomains
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 38698
X-XSS-Protection: 1; mode=block

GET
H2 200 1200px-Google_Play_Store_badge_EN.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/7/78/Google_Play_Store_badge_EN.svg/ 46 KB
46 KB 44ms
15ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/7/78/Google_Play_Store_badge_EN.svg/1200px-Google_Play_Store_badge_EN.svg.png

Requested by

Host: support-copyrightviolation.ga
URL: https://support-copyrightviolation.ga/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

563b291698914b44bea65dc21372b0c1ce831382510977aa026c9d1a8f565c38

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

Referer: https://support-copyrightviolation.ga/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Dec 2020 22:07:10 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 53636
x-cache-status: hit-front
x-cache: cp3059 hit, cp3061 hit/54
server-timing: cache;desc="hit-front"
content-length: 46645
x-client-ip: 2a01:4f8:192:5414::2
last-modified: Tue, 17 Sep 2019 10:57:10 GMT
server: ATS/8.0.8
etag: 0b0baeb13a319a86d41b9efaa72c2848
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
x-timestamp: 1568717829.36648
accept-ranges: bytes
timing-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdnjs.cloudflare.com
URL: httpks://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
pocketnow.com
support-copyrightviolation.ga
upload.wikimedia.org
www.idleair.com
cdnjs.cloudflare.com
18.159.130.79
2001:4de0:ac19::1:b:2b
2606:4700:10::6814:2326
2620:0:862:ed1a::2:b
50.248.110.146
11ddf837781c413f5f5b47f36f26a24aff89eb3108b632a5baf8ba269d0b2d98
4ca17f974fb66944b49e477206c92bf0ae6e5917a1fcf3ad988c60ea4fc4433a
563b291698914b44bea65dc21372b0c1ce831382510977aa026c9d1a8f565c38
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
c5879e67a21effd737a9e85338d90d1a000110c8d8da1c1f4d322803e84a28f7
f179217d4bc88944004cd1bf699cd9f333aa13e5954a6ac4613fc218cc81b3e7

support-copyrightviolation.ga Open in urlscan Pro 18.159.130.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

60 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

801 kBTransfer

821 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

support-copyrightviolation.ga Open in urlscan Pro
18.159.130.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

60 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

801 kB
Transfer

821 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!