msgg-serves.surge.sh Open in urlscan Pro
188.166.132.94 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://msgg-serves.surge.sh/?uri=go
Effective URL:
https://msgg-serves.surge.sh/?uri=go
Submission: On December 18 via automatic, source openphish (December 18th 2024, 1:06:04 am UTC) — Scanned from SE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 188.166.132.94, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is msgg-serves.surge.sh.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 19th 2024. Valid for: a year.

This is the only time msgg-serves.surge.sh was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
3	188.166.132.94 188.166.132.94	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	13.32.99.97 13.32.99.97	16509 (AMAZON-02) (AMAZON-02)
3	91.134.82.79 91.134.82.79	16276 (OVH OVH SAS) (OVH OVH SAS)
1	193.252.133.109 193.252.133.109	8891 (Orange S.A.) (Orange S.A.)
8	4

3 188.166.132.94 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

msgg-serves.surge.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-97.fra60.r.cloudfront.net

openfpcdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.134.82.79 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3243807.ip-91-134-82.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.252.133.109 (France)

ASN8891 (Orange S.A., FR)
PTR: vip-cachehttp-https-prod-poole-soi.m0.fti.net

cdn.woopic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ibb.co i.ibb.co — Cisco Umbrella Rank: 14048	50 KB
3	surge.sh msgg-serves.surge.sh	53 KB
1	woopic.com cdn.woopic.com — Cisco Umbrella Rank: 299510	2 KB
1	openfpcdn.io openfpcdn.io — Cisco Umbrella Rank: 18621	5 KB
8	4

	Domain	Requested by
3	i.ibb.co
3	msgg-serves.surge.sh	msgg-serves.surge.sh
1	cdn.woopic.com
1	openfpcdn.io	msgg-serves.surge.sh
8	4

This site contains no links.

Subject Issuer	Validity	Valid
*.surge.sh Sectigo RSA Domain Validation Secure Server CA	`2024-04-19` - `2025-05-18`	a year	crt.sh
openfpcdn.io Amazon RSA 2048 M02	`2024-11-27` - `2025-12-27`	a year	crt.sh
ibb.co E6	`2024-10-21` - `2025-01-19`	3 months	crt.sh
cdn.woopic.com DigiCert TLS RSA SHA256 2020 CA1	`2024-10-09` - `2025-06-26`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://msgg-serves.surge.sh/?uri=go
Frame ID: 5A093F90B2BF9D1D8E48B8C3AAA7BDE3
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Identifiez-vous

Page URL History Show full URLs

http://msgg-serves.surge.sh/?uri=go HTTP 307
https://msgg-serves.surge.sh/?uri=go Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

110 kB
Transfer

228 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://msgg-serves.surge.sh/?uri=go HTTP 307
https://msgg-serves.surge.sh/?uri=go Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
msgg-serves.surge.sh/
Redirect Chain

http://msgg-serves.surge.sh/?uri=go
https://msgg-serves.surge.sh/?uri=go

546 B
987 B

140ms
41ms

Document
text/html

188.166.132.94
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://msgg-serves.surge.sh/?uri=go
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Surge /
Resource Hash: d52de7061d1938b86c5e1bd487206537a4d590fe6fec268835fe62bc94e41bfa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Age: 22004427
Cache-Control: public, max-age=0, must-revalidate
Connection: close
Content-Length: 546
Content-Type: text/html; charset=UTF-8
Date: Wed, 18 Dec 2024 01:05:58 GMT
ETag: "d52de7061d1938b86c5e1bd487206537a4d590fe6fec268835fe62bc94e41bfa"
Response-Time: 2ms
Server: Surge
Surge-Cache: HIT
Surge-Stamp: 1815::1710378020838-d4cb596a03e4f1f96c0d57291e241c5a
Vary: Accept-Encoding

Redirect headers

Location: https://msgg-serves.surge.sh/?uri=go
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK main.828c730a.js Show response
msgg-serves.surge.sh/static/js/ 154 KB
49 KB 96ms
32ms Script
application/javascript 188.166.132.94
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://msgg-serves.surge.sh/static/js/main.828c730a.js
Requested by: Host: msgg-serves.surge.sh
URL: https://msgg-serves.surge.sh/?uri=go
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Surge /
Resource Hash: 7f6323c5aa3c282b7ae14dd45ea39970eb92c76d20f9852007e8fcd18115e45b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/?uri=go

Response headers

Transfer-Encoding: chunked
Surge-Cache: HIT
Cache-Control: public, max-age=0, must-revalidate
Content-Encoding: gzip
ETag: "7f6323c5aa3c282b7ae14dd45ea39970eb92c76d20f9852007e8fcd18115e45b"
Surge-Stamp: 12605::1710378020838-04ec196e3e218ca93a5821361f8980e9
Age: 5661
Connection: close
Response-Time: 1ms
Accept-Ranges: bytes
Date: Wed, 18 Dec 2024 01:05:59 GMT
Content-Type: application/javascript; charset=UTF-8
Vary: Accept-Encoding
Server: Surge

GET
H/1.1 200
OK main.ed8470a3.css
msgg-serves.surge.sh/static/css/ 8 KB
3 KB 79ms
16ms Stylesheet
text/css 188.166.132.94
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://msgg-serves.surge.sh/static/css/main.ed8470a3.css
Requested by: Host: msgg-serves.surge.sh
URL: https://msgg-serves.surge.sh/?uri=go
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.166.132.94 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Surge /
Resource Hash: f2b517123135e30e3c7b33039d29985b76b96b026e53f6d1776eb9ed4929bd8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/?uri=go

Response headers

Transfer-Encoding: chunked
Surge-Cache: HIT
Cache-Control: public, max-age=0, must-revalidate
Content-Encoding: gzip
ETag: "f2b517123135e30e3c7b33039d29985b76b96b026e53f6d1776eb9ed4929bd8a"
Surge-Stamp: 1815::1710378020838-1925c18ff00f3d4233c6fe461baa0b7e
Age: 5661
Connection: close
Response-Time: 1ms
Accept-Ranges: bytes
Date: Wed, 18 Dec 2024 01:05:59 GMT
Content-Type: text/css; charset=UTF-8
Vary: Accept-Encoding
Server: Surge

GET
H2 200 v1 Show response
openfpcdn.io/botd/ 15 KB
5 KB 87ms
11ms Script
text/javascript 13.32.99.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://openfpcdn.io/botd/v1

Requested by

Host: msgg-serves.surge.sh
URL: https://msgg-serves.surge.sh/static/js/main.828c730a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.97 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-97.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://msgg-serves.surge.sh
Referer: https://msgg-serves.surge.sh/

Response headers

content-encoding: gzip
etag: W/"5co2cnhGrt59+8B+iLKwJesMrpA"
age: 292
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hUn5QrhsOk8LRxanr5jvXZ7jTYUgbGdEcP6n0I8ZWzfPz2qt-7MErQ==
date: Wed, 18 Dec 2024 01:01:08 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=577299, s-maxage=10967
cross-origin-resource-policy: cross-origin
via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P3
server: CloudFront

GET
H2 200 logo.png
i.ibb.co/LnPhyQX/ 154 B
399 B 139ms
64ms Image
image/png 91.134.82.79
OVH OVH SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/LnPhyQX/logo.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.134.82.79 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3243807.ip-91-134-82.eu
Software: openresty /
Resource Hash: 5c9dd76fcf98815c4943596fd37ea4ca030708222f057cd87595efedc26eee08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/

Response headers

cache-control: max-age=315360000, public
access-control-allow-methods: GET, OPTIONS
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 154
date: Wed, 18 Dec 2024 01:05:59 GMT
content-type: image/png
last-modified: Tue, 26 Dec 2023 10:36:28 GMT
server: openresty

GET
H2 200 img.png
i.ibb.co/Xpwn492/ 41 KB
41 KB 101ms
26ms Image
image/png 91.134.82.79
OVH OVH SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/Xpwn492/img.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.134.82.79 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3243807.ip-91-134-82.eu
Software: openresty /
Resource Hash: d19e3ecb996b1a18a5fbb8084ad4ae73fbdd62337f0d00f6863fe926d906a5e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/

Response headers

cache-control: max-age=315360000, public
access-control-allow-methods: GET, OPTIONS
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41608
date: Wed, 18 Dec 2024 01:05:59 GMT
content-type: image/png
last-modified: Tue, 26 Dec 2023 10:36:28 GMT
server: openresty

GET
H2 200 image.png
i.ibb.co/LxMg6R0/ 9 KB
9 KB 89ms
14ms Image
image/png 91.134.82.79
OVH OVH SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/LxMg6R0/image.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.134.82.79 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3243807.ip-91-134-82.eu
Software: openresty /
Resource Hash: d2c2b5dcb89fe90e81c1f1e03cb8690ce6a4051fc17fa14b5f9ae1b7bfd3bac2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/

Response headers

cache-control: max-age=315360000, public
access-control-allow-methods: GET, OPTIONS
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8863
date: Wed, 18 Dec 2024 01:05:59 GMT
content-type: image/png
last-modified: Sat, 09 Mar 2024 00:46:06 GMT
server: openresty

GET
H/1.1 200
OK apple-touch-icon-57x57.png
cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/captcha-front-2.6.0/_next/static/icons/ 1 KB
2 KB 183ms
31ms Other
image/png 193.252.133.109
Orange S.A.

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/captcha-front-2.6.0/_next/static/icons/apple-touch-icon-57x57.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 193.252.133.109 , France, ASN8891 (Orange S.A., FR),
Reverse DNS: vip-cachehttp-https-prod-poole-soi.m0.fti.net
Software: nginx /
Resource Hash: d10e9fb14c237853695c22f807ae9b3e9e767da7d045b74b7f789141603795e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://msgg-serves.surge.sh/

Response headers

Etag: a3722abd827a2158dfc9837b77aedbcd
Age: 36716
X-Object-Meta-Mtime: 1706024118.995997
X-Trans-Id: tx6533a585004d4a2fa1aa3-006761908a
X-Cache: HIT
Date: Wed, 18 Dec 2024 01:05:59 GMT
Last-Modified: Tue, 23 Jan 2024 15:35:28 GMT
Content-Type: image/png
x-server: mts
Vary: Origin,Accept-Encoding
Cache-Control: max-age=31536000
Connection: keep-alive
X-Timestamp: 1706024127.35555
Allow: GET, HEAD
X-Mid: pr4m
Accept-Ranges: bytes
Content-Length: 1114
Server: nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://msgg-serves.surge.sh/?uri=go Message: [GroupMarkerNotSet(crbug.com/242999)!:A08088047C160000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
recommendation	verbose	URL: https://msgg-serves.surge.sh/?uri=go Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.woopic.com
i.ibb.co
msgg-serves.surge.sh
openfpcdn.io
13.32.99.97
188.166.132.94
193.252.133.109
91.134.82.79
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
5c9dd76fcf98815c4943596fd37ea4ca030708222f057cd87595efedc26eee08
7f6323c5aa3c282b7ae14dd45ea39970eb92c76d20f9852007e8fcd18115e45b
d10e9fb14c237853695c22f807ae9b3e9e767da7d045b74b7f789141603795e5
d19e3ecb996b1a18a5fbb8084ad4ae73fbdd62337f0d00f6863fe926d906a5e4
d2c2b5dcb89fe90e81c1f1e03cb8690ce6a4051fc17fa14b5f9ae1b7bfd3bac2
d52de7061d1938b86c5e1bd487206537a4d590fe6fec268835fe62bc94e41bfa
f2b517123135e30e3c7b33039d29985b76b96b026e53f6d1776eb9ed4929bd8a

msgg-serves.surge.sh Open in urlscan Pro 188.166.132.94 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

110 kBTransfer

228 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

msgg-serves.surge.sh Open in urlscan Pro
188.166.132.94 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

110 kB
Transfer

228 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!