fitnessandsocialapps.com Open in urlscan Pro
69.73.185.25  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 Page URL
2. http://itexpertiza.ru/wp-content/index2.html?aa002 Page URL
3. https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	VDhUxhWZJj Show response t.co/	345 B 583 B	164ms 131ms	Document text/html	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 80c2cb31d06eb5de261893da0c7b1471e9d4c55787fe3ff9afa21f0566ae4e44 Security Headers Name Value Content-Security-Policy referrer always; Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Mon, 23 Aug 2021 14:05:16 GMT vary Origin server tsa_o expires Mon, 23 Aug 2021 14:10:16 GMT set-cookie muc=5434d7df-b265-4e82-8cda-8b2217629252; Max-Age=63072000; Expires=Wed, 23 Aug 2023 14:05:16 GMT; Domain=t.co; Secure; SameSite=None content-type text/html; charset=utf-8 cache-control private,max-age=300 content-length 215 referrer-policy unsafe-url content-encoding gzip x-xss-protection 0 content-security-policy referrer always; strict-transport-security max-age=0 x-connection-hash 9887ac31b0cdea23ca5516caca91aff00fa9fcb3d7801dd3415522c689401130
GET H/1.1	200 OK	index2.html Show response itexpertiza.ru/wp-content/	895 B 674 B	206ms 72ms	Document text/html	2a00:f940:2:2:1:1:0:254 AS-REG
General Check archive.org Show headers Download Go to Full URL http://itexpertiza.ru/wp-content/index2.html?aa002 Requested by Host: t.co URL: https://t.co/VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 Protocol HTTP/1.1 Server 2a00:f940:2:2:1:1:0:254 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash 806bada567b1098f5f9bb70677595dbc6dbb5d2931ee1e892f296dea49121aee Request headers Host itexpertiza.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer https://t.co/VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer https://t.co/VDhUxhWZJj?amp=1?211912192021121921191219202112192119121920211219212119121920211219211912192021121921191219202112192121191219202112192119121920211219211912192021121921 Response headers Server nginx Date Mon, 23 Aug 2021 14:05:17 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip
GET H2	200	giphy.gif media.giphy.com/media/xUPGciQ9ZEKWnEUXYI/	22 KB 22 KB	40ms 8ms	Image image/gif	199.232.194.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://media.giphy.com/media/xUPGciQ9ZEKWnEUXYI/giphy.gif Requested by Host: itexpertiza.ru URL: http://itexpertiza.ru/wp-content/index2.html?aa002 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.194.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash fbb523c75a42174634cb71d514f513e9546e327130f59c1ef9a5342a0e719392 Security Headers Name Value Strict-Transport-Security max-age=15465600 Request headers Referer http://itexpertiza.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Mon, 23 Aug 2021 14:05:17 GMT via 1.1 varnish, 1.1 varnish age 76694 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 22112 x-served-by cache-bwi5158-BWI, cache-hhn4023-HHN last-modified Tue, 19 Mar 2019 01:30:10 GMT x-timer S1629727517.153502,VS0,VE1 etag "60778a01174cddfebebf54aa7f47cb12" strict-transport-security max-age=15465600 content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-cache-hits 1, 1
GET H/1.1	200 OK	Primary Request Cookie set / Show response fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/	389 B 742 B	635ms 421ms	Document text/html	69.73.185.25 NTHL
General Check archive.org Show headers Download Go to Full URL https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.73.185.25 , United States, ASN11042 (NTHL, US), Reverse DNS vps.demskigroup.com Software Apache / Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers Host fitnessandsocialapps.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer http://itexpertiza.ru/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer http://itexpertiza.ru/ Response headers Date Mon, 23 Aug 2021 14:05:17 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie cazanova=bff4721ce6c11ca733517e1dc7f031393a5206db; expires=Mon, 23-Aug-2021 16:05:17 GMT; Max-Age=7200; path=/; HttpOnly Vary Accept-Encoding Content-Encoding gzip Content-Length 262 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	captcha.js Show response fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/assets/js/	118 KB 42 KB	146ms 145ms	Script application/javascript	69.73.185.25 NTHL
General Check archive.org Show headers Download Go to Full URL https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/assets/js/captcha.js Requested by Host: fitnessandsocialapps.com URL: https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.73.185.25 , United States, ASN11042 (NTHL, US), Reverse DNS vps.demskigroup.com Software Apache / Resource Hash 0d4a37bae155121fce6f09ae7e6a08e0f50d9e3e5fc6c7ddbdc8c2f1295783a8 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host fitnessandsocialapps.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept */* Cache-Control no-cache Sec-Fetch-Dest script Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Cookie cazanova=bff4721ce6c11ca733517e1dc7f031393a5206db Connection keep-alive Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Mon, 23 Aug 2021 14:05:17 GMT Content-Encoding gzip Last-Modified Mon, 07 Sep 2020 11:01:30 GMT Server Apache ETag "ab804b8-1d72f-5aeb724035680-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43150
GET H/1.1	200 OK	Cookie set captcha.png fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/	6 KB 6 KB	327ms 326ms	Image image/png	69.73.185.25 NTHL
General Check archive.org Show headers Download Go to Show image Full URL https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/captcha.png?_1629727520177 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.73.185.25 , United States, ASN11042 (NTHL, US), Reverse DNS vps.demskigroup.com Software Apache / Resource Hash 76fea9dd35741098c6643ed1e17b3e1fe4c6a8181af49e7bfc5fbe305ea76361 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host fitnessandsocialapps.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Connection keep-alive Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Aug 2021 14:05:20 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Content-Type image/png Set-Cookie cazanova=16ce0753c8a290f2e1f889b927087f2a17eda449; expires=Mon, 23-Aug-2021 16:05:20 GMT; Max-Age=7200; path=/; HttpOnly Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 6166 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	KeyBank-logo.png fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/	27 KB 27 KB	322ms 114ms	Image image/png	69.73.185.25 NTHL
General Check archive.org Show headers Download Go to Show image Full URL https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/KeyBank-logo.png Requested by Host: fitnessandsocialapps.com URL: https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 69.73.185.25 , United States, ASN11042 (NTHL, US), Reverse DNS vps.demskigroup.com Software Apache / Resource Hash 241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host fitnessandsocialapps.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ Connection keep-alive Referer https://fitnessandsocialapps.com/wp-content/uploads/2021/keyx6/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Mon, 23 Aug 2021 14:05:20 GMT Content-Encoding gzip Last-Modified Mon, 07 Sep 2020 10:44:54 GMT Server Apache ETag "ab804d2-6c62-5aeb6e8a59580-gzip" Vary Accept-Encoding Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 27523

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: KeyBank (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fitnessandsocialapps.com/	1970-01-19 20:42:14	Name: cazanova Value: bff4721ce6c11ca733517e1dc7f031393a5206db

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fitnessandsocialapps.com
itexpertiza.ru
media.giphy.com
t.co
104.244.42.133
199.232.194.2
2a00:f940:2:2:1:1:0:254
69.73.185.25
0d4a37bae155121fce6f09ae7e6a08e0f50d9e3e5fc6c7ddbdc8c2f1295783a8
241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29
76fea9dd35741098c6643ed1e17b3e1fe4c6a8181af49e7bfc5fbe305ea76361
806bada567b1098f5f9bb70677595dbc6dbb5d2931ee1e892f296dea49121aee
80c2cb31d06eb5de261893da0c7b1471e9d4c55787fe3ff9afa21f0566ae4e44
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793
fbb523c75a42174634cb71d514f513e9546e327130f59c1ef9a5342a0e719392