forgetful-districts.000webhostapp.com

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 2a02:4780:dead:3228::1, located in United States and belongs to AWEX, CY. The main domain is forgetful-districts.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.

This is the only time forgetful-districts.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3036::6815:2c08	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2600:9000:20e... 2600:9000:20eb:1e00:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:20e... 2600:9000:20eb:aa00:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	45.126.59.196 45.126.59.196	132647 (IDNIC-PAN...) (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia)
3	2a02:4780:dea... 2a02:4780:dead:3228::1	204915 (AWEX) (AWEX)
1	2606:4700::68... 2606:4700::6812:6b08	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3

1 2606:4700:3036::6815:2c08 (United States)

ASN13335 (CLOUDFLARENET, US)

samo.st	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:1e00:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

kgya8.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:aa00:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

z8c74.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.126.59.196 (Indonesia) 1 redirects

ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)

s.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:4780:dead:3228::1 (United States)

ASN204915 (AWEX, CY)

forgetful-districts.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:6b08 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.000webhost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	000webhostapp.com forgetful-districts.000webhostapp.com	179 KB
2	app.link 2 redirects kgya8.app.link z8c74.app.link	936 B
1	000webhost.com cdn.000webhost.com	2 KB
1	s.id 1 redirects s.id	822 B
1	samo.st samo.st	783 B
5	5

	Domain	Requested by
3	forgetful-districts.000webhostapp.com	samo.st forgetful-districts.000webhostapp.com
1	cdn.000webhost.com	forgetful-districts.000webhostapp.com
1	s.id	1 redirects
1	z8c74.app.link	1 redirects
1	kgya8.app.link	1 redirects
1	samo.st
5	6

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-11` - `2021-08-11`	a year	crt.sh
*.000webhostapp.com RapidSSL RSA CA 2018	`2019-06-11` - `2021-07-10`	2 years	crt.sh
*.000webhost.com Sectigo RSA Domain Validation Secure Server CA	`2020-12-14` - `2022-01-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
Frame ID: D3A3DA8B670E710B078CE15CE347E2D5
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://samo.st/b2q3i Page URL
https://kgya8.app.link/9ieKc1yZqhb HTTP 307
https://z8c74.app.link/lLUC1uwZqhb?_branch_match_id=938196004103156552&utm_medium=marketing HTTP 307
https://s.id/C4Kk9?utm_medium=marketing&_branch_match_id=938196004103156552 HTTP 301
https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

5
Requests

100 %
HTTPS

83 %
IPv6

5
Domains

6
Subdomains

3
IPs

2
Countries

182 kB
Transfer

183 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_content=footer_img

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://samo.st/b2q3i Page URL
https://kgya8.app.link/9ieKc1yZqhb HTTP 307
https://z8c74.app.link/lLUC1uwZqhb?_branch_match_id=938196004103156552&utm_medium=marketing HTTP 307
https://s.id/C4Kk9?utm_medium=marketing&_branch_match_id=938196004103156552 HTTP 301
https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 b2q3i
samo.st/ 296 B
783 B 165ms
146ms Document
text/html 2606:4700:3036::6815:2c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://samo.st/b2q3i
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:2c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: samo.st
:scheme: https
:path: /b2q3i
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 23:06:24 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 0af678cb93000064013935b000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9ElrKMaT93GYflU2mZZFq6I9YuOmHLyUiyz6aICnXo%2BuUwb2azBovw3j93%2BBZ8cKhn3zSGG6z0cAgw2C9aqMpdfAe6kRiv4az4Qv8lm91IJWv2dbiy39VKYid1b%2FxwMWWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 666a90bf5d776401-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2

200

Primary Request index2.php Show response
forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/
Redirect Chain

https://kgya8.app.link/9ieKc1yZqhb
https://z8c74.app.link/lLUC1uwZqhb?_branch_match_id=938196004103156552&utm_medium=marketing
https://s.id/C4Kk9?utm_medium=marketing&_branch_match_id=938196004103156552
https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/

6 KB
3 KB

350ms
113ms

Document
text/html

2a02:4780:dead:3228::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/

Requested by

Host: samo.st
URL: https://samo.st/b2q3i

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:3228::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

566ef9177a33f9b5b4473c689780684da8b5a91b3b0494f7bb7c16a669a3929d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: forgetful-districts.000webhostapp.com
:scheme: https
:path: /08978745678699976876543mt/1/index2.php?https://www.google.com/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://samo.st/b2q3i

Response headers

date: Mon, 28 Jun 2021 23:06:26 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=o0pnfeh72ovl6mn2e0p4ga6ml1; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
server: awex
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-request-id: d1ed32fcadca2ab3c27bca79acd54028
content-encoding: gzip

Redirect headers

Server: nginx/1.18.0
Date: Mon, 28 Jun 2021 23:06:25 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 143
Connection: keep-alive
Location: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
Strict-Transport-Security: max-age=63072000
Referrer-Policy: no-referrer
Content-Security-Policy: upgrade-insecure-requests
Feature-Policy: geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()

GET
H2 200 svg.png
forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/run/ 170 KB
171 KB 109ms
107ms Image
image/png 2a02:4780:dead:3228::1
AWEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/run/svg.png

Requested by

Host: forgetful-districts.000webhostapp.com
URL: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:3228::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

839298fa7fd2293c6a7942a45d795893713e68d3b027be22b4f6a00b7e023144

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /08978745678699976876543mt/1/run/svg.png
pragma: no-cache
cookie: PHPSESSID=o0pnfeh72ovl6mn2e0p4ga6ml1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: forgetful-districts.000webhostapp.com
referer: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 23:06:26 GMT
x-content-type-options: nosniff
last-modified: Sat, 26 Jun 2021 14:41:22 GMT
server: awex
content-type: image/png
accept-ranges: bytes
content-length: 174580
x-xss-protection: 1; mode=block
x-request-id: fd6e6295e6f5931faf4148bbc91e8caa

GET
H2 200 captcha.php
forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/run/ 5 KB
5 KB 327ms
326ms Image
image/jpeg 2a02:4780:dead:3228::1
AWEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/run/captcha.php?rand=1774816352

Requested by

Host: forgetful-districts.000webhostapp.com
URL: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:3228::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

850422688650e75e9498871194cc3331e03701c8f615e68ffb96bed5178ef50f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /08978745678699976876543mt/1/run/captcha.php?rand=1774816352
pragma: no-cache
cookie: PHPSESSID=o0pnfeh72ovl6mn2e0p4ga6ml1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: forgetful-districts.000webhostapp.com
referer: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Jun 2021 23:06:26 GMT
x-content-type-options: nosniff
server: awex
content-type: image/jpeg
cache-control: no-store, no-cache, must-revalidate
content-length: 4686
x-xss-protection: 1; mode=block
x-request-id: 0ca6d155c67b14a8ab573dee1ded87cd
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ 2 KB
2 KB 72ms
46ms Image
image/webp 2606:4700::6812:6b08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png

Requested by

Host: forgetful-districts.000webhostapp.com
URL: https://forgetful-districts.000webhostapp.com/08978745678699976876543mt/1/index2.php?https://www.google.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:6b08 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forgetful-districts.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 23:06:26 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1887
cf-polished: origFmt=png, origSize=2046
content-disposition: inline; filename="footer-powered-by-000webhost-white2.webp"
cf-bgj: imgq:100,h2pri
x-hostinger-datacenter: srv
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1696
x-xss-protection: 1; mode=block
last-modified: Thu, 10 Jun 2021 14:55:20 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "60c227d8-7fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
content-type: image/webp
vary: Accept
cache-control: public, max-age=14400
x-hostinger-node: nl-srv-cdn2
cf-request-id: 0af678d32e00002488bcbea000000001
accept-ranges: bytes
cf-ray: 666a90cb787d2488-FRA
expires: Tue, 29 Jun 2021 03:06:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			forgetful-districts.000webhostapp.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: o0pnfeh72ovl6mn2e0p4ga6ml1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
forgetful-districts.000webhostapp.com
kgya8.app.link
s.id
samo.st
z8c74.app.link
2600:9000:20eb:1e00:19:9934:6a80:93a1
2600:9000:20eb:aa00:19:9934:6a80:93a1
2606:4700:3036::6815:2c08
2606:4700::6812:6b08
2a02:4780:dead:3228::1
45.126.59.196
566ef9177a33f9b5b4473c689780684da8b5a91b3b0494f7bb7c16a669a3929d
839298fa7fd2293c6a7942a45d795893713e68d3b027be22b4f6a00b7e023144
850422688650e75e9498871194cc3331e03701c8f615e68ffb96bed5178ef50f
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

forgetful-districts.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:3228::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

83 %IPv6

5 Domains

6 Subdomains

3 IPs

2 Countries

182 kBTransfer

183 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

1 Cookies

Indicators

forgetful-districts.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:3228::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

83 %
IPv6

5
Domains

6
Subdomains

3
IPs

2
Countries

182 kB
Transfer

183 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!