getconfirmpage2023.biz.id Open in urlscan Pro
205.144.171.228  Malicious Activity! Public Scan

URL: http://getconfirmpage2023.biz.id/
Submission: On September 05 via api from US — Scanned from IT

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 205.144.171.228, located in United States and belongs to WEBWEB-HK International Trade Centre, HK. The main domain is getconfirmpage2023.biz.id.
This is the only time getconfirmpage2023.biz.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 205.144.171.228 55778 (WEBWEB-HK...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 162.19.58.160 16276 (OVH)
5 3
Apex Domain
Subdomains
Transfer
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 320
54 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 11569
3 KB
1 getconfirmpage2023.biz.id
getconfirmpage2023.biz.id
2 KB
5 3
Domain Requested by
3 cdn.jsdelivr.net getconfirmpage2023.biz.id
1 i.ibb.co getconfirmpage2023.biz.id
1 getconfirmpage2023.biz.id
5 3

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-02 -
2024-05-01
a year crt.sh
ibb.co
R3
2023-08-10 -
2023-11-08
3 months crt.sh

This page contains 1 frames:

Primary Page: http://getconfirmpage2023.biz.id/
Frame ID: C098CD6E8DBB0B035A831010D57AF419
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Security Step

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

5
Requests

80 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

59 kB
Transfer

280 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
getconfirmpage2023.biz.id/
8 KB
2 KB
Document
General
Full URL
http://getconfirmpage2023.biz.id/
Protocol
HTTP/1.1
Server
205.144.171.228 , United States, ASN55778 (WEBWEB-HK International Trade Centre, HK),
Reverse DNS
205-144-171-228.alchemy.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
bc7fb7e4bc08cf535a4a1ec7286b3cc51a150308243d2fb2a5f471da4caeb2d9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
it-IT,it;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=31536000
Content-Encoding
gzip
Content-Length
2188
Content-Type
text/html
Date
Tue, 05 Sep 2023 15:20:40 GMT
ETag
"012c16a61dfd91:0"
Last-Modified
Mon, 04 Sep 2023 18:55:48 GMT
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-Powered-By
ASP.NET
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.1/dist/css/
191 KB
29 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.1/dist/css/bootstrap.min.css
Requested by
Host: getconfirmpage2023.biz.id
URL: http://getconfirmpage2023.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2933c96348a4eae7cbbf8f280ca0981586a9b5c097ef952b996cad7d28f2fad0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://getconfirmpage2023.biz.id/
Origin
http://getconfirmpage2023.biz.id
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 05 Sep 2023 15:20:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1541649
x-jsd-version
5.2.1
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230088-FRA, cache-yyz4562-YYZ
x-jsd-version-type
version
server
cloudflare
etag
W/"2fbaa-t81XpP1qH65hJhUPQn7yFzlyk+Q"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SG3403RFZT6kk4mnaS8ZKRNFiFsbQ%2BAcH8DXO6bigWA5Y3z0CqH99m3%2BLGbI4QS6AtAPAiW8G3V%2BXNIqx58tQcDrehTzq7zLETOdscLU1lRL3afOk6GufI1a2phis1WSKw6Dspty4AUUfNeTUP4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
801f752728c74bf7-MXP
intro.png
i.ibb.co/q5G4hmd/
3 KB
3 KB
Image
General
Full URL
https://i.ibb.co/q5G4hmd/intro.png
Requested by
Host: getconfirmpage2023.biz.id
URL: http://getconfirmpage2023.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.58.160 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3096649.ip-162-19-58.eu
Software
nginx /
Resource Hash
9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://getconfirmpage2023.biz.id/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 05 Sep 2023 15:20:40 GMT
last-modified
Tue, 06 Jun 2023 11:11:35 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
2987
expires
Thu, 31 Dec 2037 23:55:55 GMT
popper.min.js
cdn.jsdelivr.net/npm/@popperjs/core@2.11.6/dist/umd/
20 KB
8 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.6/dist/umd/popper.min.js
Requested by
Host: getconfirmpage2023.biz.id
URL: http://getconfirmpage2023.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
051a8137b75880006ab58f47778ca713ed6c967130faba043c5cd0ed34517dc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://getconfirmpage2023.biz.id/
Origin
http://getconfirmpage2023.biz.id
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 05 Sep 2023 15:20:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1538997
x-jsd-version
2.11.6
content-encoding
br
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230136-FRA, cache-bma1654-BMA
x-jsd-version-type
version
server
cloudflare
etag
W/"4e7f-YDO5/9GsCmSrp3VxzVXmgduuK5k"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CL%2BUg4vdOU9XU5htAhoVoJ09jhwC8VvwC9BMC%2BpBLh5JYFfhoF8KuIsyAra%2BhbcwxVGM8LzIqt6YxGPZamYdUfZ02bs0guSkLgKTTgHwlDUcWz8NhNii9kDVYLHEpEOxg18YOSNkAkT1mvK%2FgLo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
801f752728c84bf7-MXP
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.1/dist/js/
59 KB
17 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.1/dist/js/bootstrap.min.js
Requested by
Host: getconfirmpage2023.biz.id
URL: http://getconfirmpage2023.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90879f20631e90d048bc1e002d7795273add7e3a5ae1252bebe3c9e0179ca833
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://getconfirmpage2023.biz.id/
Origin
http://getconfirmpage2023.biz.id
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 05 Sep 2023 15:20:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1533665
x-jsd-version
5.2.1
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230071-FRA, cache-yyz4558-YYZ
x-jsd-version-type
version
server
cloudflare
etag
W/"ec19-Rb6MoLrn5biCRLcY1BM8aqvTDNg"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6NshyNrNd07zz%2BVYzw2pEcH1MdrEkz7%2B00OF73wL0jGKksUYyiyCEeCOMR6wAHdPCVJTrAgsiQs6EKX0AtgazZzgiLkUEFgb7x10PsHCg6zO3b%2FCDijhAqMQVclotnOTVFMuE9x85V%2Fxeu1Nv8o%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
801f752728c94bf7-MXP

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Popper number| uidEvent object| bootstrap

0 Cookies