item-seller-view-listing-5850441.17435200.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3030::6815:567f, located in United States and belongs to CLOUDFLARENET, US. The main domain is item-seller-view-listing-5850441.17435200.com.
TLS certificate: Issued by WE1 on July 8th 2024. Valid for: 3 months.

This is the only time item-seller-view-listing-5850441.17435200.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2 4	2606:4700:303... 2606:4700:3030::6815:567f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 4	2606:4700:303... 2606:4700:3037::ac43:ceaa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2

4 2606:4700:3030::6815:567f (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

item-seller-view-listing-5850441.17435200.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3037::ac43:ceaa (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

news.ucantea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ucantea.com 3 redirects news.ucantea.com	1 KB
4	17435200.com 2 redirects item-seller-view-listing-5850441.17435200.com	3 KB
3	2

	Domain	Requested by
4	news.ucantea.com	3 redirects item-seller-view-listing-5850441.17435200.com
4	item-seller-view-listing-5850441.17435200.com	2 redirects
3	2

This site contains no links.

Subject Issuer	Validity	Valid
17435200.com WE1	`2024-07-08` - `2024-10-06`	3 months	crt.sh
ucantea.com WE1	`2024-07-08` - `2024-10-06`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://item-seller-view-listing-5850441.17435200.com/dir/
Frame ID: 125FE109880554549CA8A3C4F094987B
Requests: 2 HTTP requests in this frame

Frame: https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/public/
Frame ID: 2D6E8A7FB0BC90B7429D2F410CF6E5A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Listings

Page URL History Show full URLs

https://item-seller-view-listing-5850441.17435200.com/dir HTTP 301
https://item-seller-view-listing-5850441.17435200.com/dir/ Page URL

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1 kB
Transfer

1 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://item-seller-view-listing-5850441.17435200.com/dir HTTP 301
https://item-seller-view-listing-5850441.17435200.com/dir/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://item-seller-view-listing-5850441.17435200.com/dir/dash_url.php HTTP 302
https://news.ucantea.com/ HTTP 302
https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb HTTP 301
https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/ HTTP 302
https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/public/

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response item-seller-view-listing-5850441.17435200.com/dir/ Redirect Chain https://item-seller-view-listing-5850441.17435200.com/dir https://item-seller-view-listing-5850441.17435200.com/dir/	497 B 585 B	32ms 31ms	Document text/html	2606:4700:3030::6815:567f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://item-seller-view-listing-5850441.17435200.com/dir/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:567f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.33 Resource Hash `9aaa19f05428dd4ce915826a1e433f4cc132d172873f1e8927e4bcbde7234c49` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8a3d931e08140eaa-AMS content-encoding br content-type text/html; charset=UTF-8 date Mon, 15 Jul 2024 23:36:26 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iyoNLf67RC4rwno3NGzsRZYT7%2FUHhfkSemo4Iuwl1WpuykT76Wghu%2FmitSM2JK4D%2BulVGJZYZmCzYHEkTCI6NDsalTahbtYB5OG7XkD9ZzjkPT%2BEL95o7F7RM7v3pG8CR0JkbOOwZspZgGZQ3JeE%2BEkrXI4EEsCYr7lxas9p4btXREPlpQ871IqPnD4%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/7.3.33 Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8a3d931ddff40eaa-AMS content-type text/html date Mon, 15 Jul 2024 23:36:26 GMT location https://item-seller-view-listing-5850441.17435200.com/dir/ nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cNE9Ob%2Bah38L9EGxvLrlWWkNyp6pYY1DPFGjk7dxhAW9nzpjVpIay6ToNuqyJ5ymV1Cg%2F%2F2OhB2MKFKNNQy3Il0xt0c9BnITyzsMYiE4xURiG6H2CYsMzqx3aWY39G1n%2FE03aSkiQnb0GdJ%2BSPiY8XeGwVIfShD7GlLArnaIgxc7J0C%2FyJEDQ21JCNA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	/ news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/public/ Frame 2D6E Redirect Chain https://item-seller-view-listing-5850441.17435200.com/dir/dash_url.php https://news.ucantea.com/ https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/ https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/public/?	0 0	39ms 39ms	Document text/html	2606:4700:3037::ac43:ceaa CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://news.ucantea.com/.20dd48298045c922472d1e485e1b82cb/public/? Requested by Host: item-seller-view-listing-5850441.17435200.com URL: https://item-seller-view-listing-5850441.17435200.com/dir/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:ceaa , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.33 Resource Hash Request headers Referer https://item-seller-view-listing-5850441.17435200.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8a3d93224811a000-AMS content-encoding br content-type text/html; charset=UTF-8 date Mon, 15 Jul 2024 23:36:27 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yLvF0ugoP%2FdJ9g3wjdzTAvpQ0zKNhH5UGARzCb5uiwVwXQwzliT2fRagzZewJ5k7%2Faviuj9PTdZ8KCczIivrbxd%2FQo6G8LGVsTwYv%2BLBX3hzBopPjm50cIrJZIrnu9IV0w4j5%2FOicbkJ%2B%2FABDmbR"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/7.3.33 Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 8a3d9321ffeea000-AMS content-type text/html; charset=UTF-8 date Mon, 15 Jul 2024 23:36:27 GMT location public/? nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FeaZXZUjLksEVUUoUG79rX5L63JETzRvryX5VvtOFfKK4hUyqdqfW9gP6rwoRtlnDtAfbFbJDM9K5Lcs5pU9d2sWFb3e2SqE6FIxJFGXX%2BlKTHZqPOXg42T1lmXSFAHNygfQ3lep26GwiEgsKU36"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.33
GET H3	404	favicon.ico item-seller-view-listing-5850441.17435200.com/	796 B 914 B	29ms 28ms	Other text/html	2606:4700:3030::6815:567f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://item-seller-view-listing-5850441.17435200.com/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:567f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400` Request headers Referer https://item-seller-view-listing-5850441.17435200.com/dir/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers pragma no-cache date Mon, 15 Jul 2024 23:36:27 GMT content-encoding br cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TEYaW9JGODBxkIcebH6iVSA6aR2%2FXjePrqFSoc6m5Gg4UPErysrB0jch9%2FBFNIVK6u46q866AwjEaBS7t6%2FDUxyAFlvj7ImA6gdCVk%2BrJPLNzuqmFZpau9JuO2qZt%2BvjWNoAaDv91nSN0PJu38nS3JKZY1IXa1tN5rUT9ojCREgJZNlQB4AXbNbPSCc%3D"}],"group":"cf-nel","max_age":604800} content-type text/html cache-control private, no-cache, no-store, must-revalidate, max-age=0 cf-ray 8a3d93232b8e0a79-AMS alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://item-seller-view-listing-5850441.17435200.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

item-seller-view-listing-5850441.17435200.com
news.ucantea.com
2606:4700:3030::6815:567f
2606:4700:3037::ac43:ceaa
9aaa19f05428dd4ce915826a1e433f4cc132d172873f1e8927e4bcbde7234c49
c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400

item-seller-view-listing-5850441.17435200.com Open in urlscan Pro 2606:4700:3030::6815:567f Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

1 kBTransfer

1 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

item-seller-view-listing-5850441.17435200.com Open in urlscan Pro
2606:4700:3030::6815:567f Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1 kB
Transfer

1 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!