urlscan.io logo urlscan.io
SecurityTrails logo

lnc01lv2i5pbw7.ydns.eu Open in urlscan Pro
185.53.211.61  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php#confirm-page-container-navigation
Effective URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Submission: On October 20 via api from NL — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.53.211.61, located in Poplar, United Kingdom and belongs to CLOUDWEBMANAGE-UK-1, US. The main domain is lnc01lv2i5pbw7.ydns.eu.
This is the only time lnc01lv2i5pbw7.ydns.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
5 185.53.211.61 210329 (CLOUDWEBM...)
2 104.16.89.20 13335 (CLOUDFLAR...)
1 142.250.181.234 15169 (GOOGLE)
8 3
Apex Domain
Subdomains		 Transfer
5 ydns.eu
lnc01lv2i5pbw7.ydns.eu
146 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 373
53 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 405
31 KB
8 3
Domain Requested by
5 lnc01lv2i5pbw7.ydns.eu lnc01lv2i5pbw7.ydns.eu
2 cdn.jsdelivr.net lnc01lv2i5pbw7.ydns.eu
1 ajax.googleapis.com lnc01lv2i5pbw7.ydns.eu
8 3

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-09-28 -
2023-12-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Frame ID: 0797DAC0A53738E4DB6E164428729103
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Help Support

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

38 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

229 kB
Transfer

855 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request confirms.php
lnc01lv2i5pbw7.ydns.eu/ 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
HTTP/1.1
Server
185.53.211.61 Poplar, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, US),
Reverse DNS
Software
nginx-rc /
Resource Hash
ab08f01463f22ccd57115a20935d45707329320027653c07aab86d1c733b04e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
it-IT,it;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 20 Oct 2023 19:41:25 GMT
Server
nginx-rc
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/ 		189 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://lnc01lv2i5pbw7.ydns.eu/
Origin
http://lnc01lv2i5pbw7.ydns.eu
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 20 Oct 2023 19:41:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
20776060
x-jsd-version
5.2.0-beta1
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230038-FRA, cache-yyz4541-YYZ
x-jsd-version-type
version
server
cloudflare
etag
W/"2f3f9-YnOsGiPXmhIvAi9qh8W3XCz6/Do"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iJ6%2FvLMKVwDpHL63Wu4nQg%2Fyc7ZqhLRN4REwkRp%2F6QCOVbdE8T4WzqDvlZB31TykoPvv%2BwsP8hjvdvGAM1PRHFY78n1CIzEDQPsBRa6rMqi9jJgM%2Fmk2N1dVI4nr3bGJSuo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
8193bcf9aac80e4a-MXP
3.css
lnc01lv2i5pbw7.ydns.eu/css/ 		45 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://lnc01lv2i5pbw7.ydns.eu/css/3.css
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
HTTP/1.1
Server
185.53.211.61 Poplar, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, US),
Reverse DNS
Software
nginx-rc /
Resource Hash
3a56c06795eed899bb11ab46a1cd7b554584d9969748b4a65240a28b4df48694
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/confirms.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Fri, 20 Oct 2023 19:41:25 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 Oct 2023 23:43:23 GMT
Server
nginx-rc
ETag
W/"6531bf1b-b2a0"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Sun, 19 Nov 2023 19:41:25 GMT
2.css
lnc01lv2i5pbw7.ydns.eu/css/ 		447 KB
134 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://lnc01lv2i5pbw7.ydns.eu/css/2.css
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
HTTP/1.1
Server
185.53.211.61 Poplar, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, US),
Reverse DNS
Software
nginx-rc /
Resource Hash
b5cf737e2071d23e4c4f110c42591443a7c4ed1c5f8d5fe536d6c1ab6d873d2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/confirms.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Fri, 20 Oct 2023 19:41:25 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 Oct 2023 23:43:23 GMT
Server
nginx-rc
ETag
W/"6531bf1b-6fa0a"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Sun, 19 Nov 2023 19:41:25 GMT
intro.png
lnc01lv2i5pbw7.ydns.eu/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lnc01lv2i5pbw7.ydns.eu/img/intro.png
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
HTTP/1.1
Server
185.53.211.61 Poplar, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, US),
Reverse DNS
Software
nginx-rc /
Resource Hash
9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/confirms.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Fri, 20 Oct 2023 19:41:25 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 Oct 2023 23:43:26 GMT
Server
nginx-rc
ETag
"6531bf1e-bab"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2987
X-XSS-Protection
1; mode=block
Expires
Sun, 19 Nov 2023 19:41:25 GMT
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/ 		78 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/bootstrap.bundle.min.js
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2515e37eee31f5ef3d659b21dcc84dc6ea732b06872da51078b5b526de34c0c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Fri, 20 Oct 2023 19:41:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
20776066
x-jsd-version
5.2.0-beta1
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230137-FRA, cache-jnb7022-JNB
x-jsd-version-type
version
server
cloudflare
etag
W/"1377e-a0uYWpCr16scLjX/O4dNB8+EEO4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M8EOjfjtLokI8GgAbw%2BA0Odnc49PELJSdVh6zaVeKCr9p%2BTYWkbiPLWxHMahvZMePfxY7Q%2FKvvh%2BzSM3F4jZfcKt8J%2FmCJfTGOYtcx3hEdhl%2Bh%2FcM8CbSpKvt83jFBkUDPs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
8193bcf9ac6a4c54-MXP
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.234 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f10.1e100.net
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 19 Oct 2023 12:17:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
113048
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 18 Oct 2024 12:17:17 GMT
popup.js
lnc01lv2i5pbw7.ydns.eu/ 		748 B
738 B 		Script
General
Check archive.org
Download Go to
Full URL
http://lnc01lv2i5pbw7.ydns.eu/popup.js
Requested by
Host: lnc01lv2i5pbw7.ydns.eu
URL: http://lnc01lv2i5pbw7.ydns.eu/confirms.php
Protocol
HTTP/1.1
Server
185.53.211.61 Poplar, United Kingdom, ASN210329 (CLOUDWEBMANAGE-UK-1, US),
Reverse DNS
Software
nginx-rc /
Resource Hash
abac6a81aef8e7bdcda65f686218fa36945f7724e7ae8ceebfdce661b79b9390
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://lnc01lv2i5pbw7.ydns.eu/confirms.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Fri, 20 Oct 2023 19:41:25 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 19 Oct 2023 23:43:19 GMT
Server
nginx-rc
ETag
W/"6531bf17-2ec"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
X-Frame-Options
SAMEORIGIN
Cache-Control
max-age=2592000
Connection
keep-alive
X-XSS-Protection
1; mode=block
Expires
Sun, 19 Nov 2023 19:41:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| mousedwn number| uidEvent object| bootstrap function| $ function| jQuery function| open_facebook function| tutup_facebook function| showFbPassword function| hideFbPassword

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block