Submitted URL: https://s.id/ahtizx
Effective URL: https://lz.ubpages.com/okum/
Submission: On July 10 via manual from TH — Scanned from DE

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 3.69.136.55, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is lz.ubpages.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 13th 2023. Valid for: a year.
This is the only time lz.ubpages.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 3.69.136.55 16509 (AMAZON-02)
2 52.222.174.51 16509 (AMAZON-02)
2 2600:9000:210... 16509 (AMAZON-02)
3 52.222.250.226 16509 (AMAZON-02)
1 34.198.74.222 14618 (AMAZON-AES)
10 6
Apex Domain
Subdomains
Transfer
5 cloudfront.net
d1wbjksx0xxdn3.cloudfront.net
d9hhrg4mnvzow.cloudfront.net
36 KB
2 unbounce.com
builder-assets.unbounce.com — Cisco Umbrella Rank: 20443
37 KB
1 ub-analytics.com
events.ub-analytics.com — Cisco Umbrella Rank: 28135
282 B
1 ubpages.com
lz.ubpages.com
7 KB
1 s.id
s.id — Cisco Umbrella Rank: 121907
543 B
10 5
Domain Requested by
3 d9hhrg4mnvzow.cloudfront.net lz.ubpages.com
2 d1wbjksx0xxdn3.cloudfront.net lz.ubpages.com
d1wbjksx0xxdn3.cloudfront.net
2 builder-assets.unbounce.com lz.ubpages.com
1 events.ub-analytics.com lz.ubpages.com
1 lz.ubpages.com
1 s.id 1 redirects
10 6

This site contains no links.

Subject Issuer Validity Valid
*.ubpages.com
Sectigo RSA Domain Validation Secure Server CA
2023-06-13 -
2024-07-13
a year crt.sh
*.unbounce.com
Amazon RSA 2048 M01
2023-02-21 -
2024-02-07
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
*.ub-analytics.com
Amazon RSA 2048 M01
2023-03-11 -
2024-04-08
a year crt.sh

This page contains 1 frames:

Primary Page: https://lz.ubpages.com/okum/
Frame ID: 05B112924858D2CDC906D6578E1D9F30
Requests: 11 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://s.id/ahtizx HTTP 302
    https://lz.ubpages.com/okum/ Page URL

Page Statistics

10
Requests

90 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

81 kB
Transfer

267 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s.id/ahtizx HTTP 302
    https://lz.ubpages.com/okum/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lz.ubpages.com/okum/
Redirect Chain
  • https://s.id/ahtizx
  • https://lz.ubpages.com/okum/
36 KB
7 KB
Document
General
Full URL
https://lz.ubpages.com/okum/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
3.69.136.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-69-136-55.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
5b97b7709947dc9c3a0c2773f0a86ef19174210a0a484138a6c3027d895d271a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
6740
content-location
https://lz.ubpages.com/okum/
content-type
text/html; charset=utf-8
date
Mon, 10 Jul 2023 11:13:48 GMT
etag
"a:10620e915fff49cfbb376d5339d12339"
link
<https://lz.ubpages.com/okum/>; rel="canonical"
x-proxy-backend
page-server
x-unbounce-pageid
ee27b686-1e12-11ee-8ae1-0242dc6d7787
x-unbounce-variant
a
x-unbounce-visitorid
10620e91-5fff-49cf-bb37-6d5339d12339

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=30
cf-cache-status
DYNAMIC
cf-ray
7e4861255aac4d2b-FRA
content-length
0
date
Mon, 10 Jul 2023 11:13:48 GMT
location
https://lz.ubpages.com/okum/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nFpl%2FO1apbgOFDgTL5B5mmpHzmlAInS5jl2MV90Q2VF6hwKGGGvGjzvYg71wzDDdBPf11%2F9QXAzTLR0Pkmw5WcpKD6pW1p23DcAZp%2BG6PAtfvE2GnGCPN7fYcdligqru44o%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
main-7b78720.z.css
builder-assets.unbounce.com/published-css/
15 KB
3 KB
Stylesheet
General
Full URL
https://builder-assets.unbounce.com/published-css/main-7b78720.z.css
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.174.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-174-51.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7b787207f29ffd5672ab91b95f681b387b4d6433081cc8b47070f1d564827863

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 21 May 2023 01:02:31 GMT
content-encoding
gzip
via
1.1 e36c32cacca3348932522b77d9a47dca.cloudfront.net (CloudFront)
x-amz-version-id
Hi0GplZUCMAlUo2d3AkAvO_Jy02q1fIj
x-amz-cf-pop
CDG50-P2
age
4356679
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
2902
last-modified
Mon, 13 Mar 2023 16:18:47 GMT
server
AmazonS3
etag
"15295835030f315ea1ec0147abd5ea63"
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
Tc4QPvk1PB39G64y4O7yuMMsIVxkxB6E76sFl_DnGOQR2SPGUp3b3w==
ub.js
d1wbjksx0xxdn3.cloudfront.net/
5 KB
2 KB
Script
General
Full URL
https://d1wbjksx0xxdn3.cloudfront.net/ub.js?1687799037
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:7200:b:3165:13c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3537c6a36fae2d2132581b7915d51e1ed268ae146f5df18a84def7ed594fbe15

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 17:24:21 GMT
content-encoding
gzip
via
1.1 043fc2faaa02eeb59193e3fa300adb6a.cloudfront.net (CloudFront)
x-amz-version-id
DrDbRvFA9mO1umKMKkGWhgl31YCzXh7a
x-amz-cf-pop
AMS1-C1
age
1187369
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1864
last-modified
Mon, 26 Jun 2023 16:59:10 GMT
server
AmazonS3
etag
"118cee1e64f6b283233c55aee7da10da"
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
jWOgef_oLOO0c9Fccj74ctpDee9vzBYvMVU7muF8b1EItraKzkBVqg==
main.bundle-b8bce47.z.js
builder-assets.unbounce.com/published-js/
104 KB
33 KB
Script
General
Full URL
https://builder-assets.unbounce.com/published-js/main.bundle-b8bce47.z.js
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.174.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-174-51.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b8bce47ffa43bc0b835f83d09167cabac1a62e85241aa806d826a0909d5bf7ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 04 Jul 2023 18:22:52 GMT
content-encoding
gzip
via
1.1 e36c32cacca3348932522b77d9a47dca.cloudfront.net (CloudFront)
x-amz-version-id
Z.WbuyCoilnUdm7ymqWQhG0_enogTBjk
x-amz-cf-pop
CDG50-P2
age
492658
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
33784
last-modified
Tue, 04 Jul 2023 18:02:44 GMT
server
AmazonS3
etag
"a58eb6cf7e4cffa8041bdd43da1f4791"
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
-zN9uNUY89ktlruNic2V-uNo-dpuaOLwxh8EMVnkAaIevovgVKq44w==
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/gif
sp-2.14.0.js
d1wbjksx0xxdn3.cloudfront.net/
98 KB
30 KB
Script
General
Full URL
https://d1wbjksx0xxdn3.cloudfront.net/sp-2.14.0.js
Requested by
Host: d1wbjksx0xxdn3.cloudfront.net
URL: https://d1wbjksx0xxdn3.cloudfront.net/ub.js?1687799037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2104:7200:b:3165:13c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2e8292b18fc2acc297e1aa6acc6abe05136604137e744ba1b49984df330562bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 17:20:26 GMT
content-encoding
gzip
via
1.1 043fc2faaa02eeb59193e3fa300adb6a.cloudfront.net (CloudFront)
x-amz-version-id
0Jz2Bo4sfVFEftEdSoFX9n5OCEdIO6kj
x-amz-cf-pop
AMS1-C1
age
1187604
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
30399
last-modified
Mon, 26 Jun 2023 16:59:50 GMT
server
AmazonS3
etag
"73de733c308b8b5e44d2a6242dc4bd99"
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
CMto4L_ceiD9ieCAA1Ug1RReQKv72knLQAQYTiI4bGjxT3rcalVU8g==
fb4bb318-537e-45f5-b225-470b7d34a317
https://lz.ubpages.com/
5 KB
0
Stylesheet
General
Full URL
blob:https://lz.ubpages.com/fb4bb318-537e-45f5-b225-470b7d34a317
Requested by
Host: builder-assets.unbounce.com
URL: https://builder-assets.unbounce.com/published-js/main.bundle-b8bce47.z.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9af91bb0b9327c5bc74760fed3cd024dbde1c5b90ede3fab5c8c54850e757994

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Length
5611
Content-Type
text/css
n3tdr-11111_108w049000000000000028.png
d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/
2 KB
3 KB
Image
General
Full URL
https://d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/n3tdr-11111_108w049000000000000028.png
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.250.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-250-226.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
da35f868375c08d5e0d69658957f4bdaa6f992a833f8ae2203deaa5eb667bcf6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 10:43:36 GMT
x-amz-version-id
RJWelrLh9IZ0KX20nQQ2JsqumLGkpUOx
via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
last-modified
Mon, 10 Jul 2023 02:22:43 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P3
age
1814
etag
"7fe665dba7c4ec97ac1ef62598779113"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31557600
accept-ranges
bytes
content-length
2435
x-amz-cf-id
MaBZLpo19jIUF1UFOQsoeB-Ds4tYpMP4AQQudyZ3kFM6B1uRI1oYWA==
bvy9d1-annotation-2023-04-23-231313_100u00k000000000000028.png
d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/
252 B
672 B
Image
General
Full URL
https://d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/bvy9d1-annotation-2023-04-23-231313_100u00k000000000000028.png
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.250.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-250-226.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4b88c66181c2419b5601e923de20499e969f99cb1ba919dd43f7d593bae10bca

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 10:43:36 GMT
x-amz-version-id
OamsW_hFCBJrcSJgivmEmz6_AhaRkdOU
via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
last-modified
Mon, 10 Jul 2023 02:22:43 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P3
age
1814
etag
"c6d59d2c110ed4067004d1a5565c2f1b"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31557600
accept-ranges
bytes
content-length
252
x-amz-cf-id
6mgGwcXUU7mhE4cc54ENNuvqrASxfPivhpRkZAVrXMqThygS4-GeXw==
z0oqso-annotation-2023-04-23-235314_100d00d000000000000028.png
d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/
215 B
636 B
Image
General
Full URL
https://d9hhrg4mnvzow.cloudfront.net/lz.ubpages.com/okum/z0oqso-annotation-2023-04-23-235314_100d00d000000000000028.png
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.250.226 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-250-226.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4d0d4ba012a7260046956f0281b3be7d8dfa05a053559894f849b52f343c7e38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 10:43:36 GMT
x-amz-version-id
YqKyxCKl20oYMqbpWZlRTeZdMR1aZuVE
via
1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
last-modified
Mon, 10 Jul 2023 02:22:43 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P3
age
1814
etag
"1b634d9cc234376c06494beb898c8a91"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31557600
accept-ranges
bytes
content-length
215
x-amz-cf-id
xhd8mpMQKZGc9ZyrQv1_qUlkL7LQY7yOwCzxYHlu0cDkGhW_LEqrGw==
i
events.ub-analytics.com/
43 B
282 B
Image
General
Full URL
https://events.ub-analytics.com/i?stm=1688987629131&e=pv&url=https%3A%2F%2Flz.ubpages.com%2Fokum%2F&tv=js-2.14.0&tna=sp-ub&aid=landing_page&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1600x1200&cd=24&eid=fbc9bc50-6f78-4288-af04-d2b94fa553a1&dtm=1688987629129&vp=1600x1200&ds=1600x1200&vid=1&sid=6836b4c2-0e96-4ec8-925a-774f39cd404f&duid=3ee2bc20-bd31-48b6-95d2-6e3821fa68aa&uid=10620e91-5fff-49cf-bb37-6d5339d12339&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoianNfdHJhY2tlcl9jb250ZXh0X3YxLjEuanNvbiIsImRhdGEiOnsicGFnZUlkIjoiZWUyN2I2ODYtMWUxMi0xMWVlLThhZTEtMDI0MmRjNmQ3Nzg3IiwidmFyaWFudElkIjoiYSIsImV2ZW50VHlwZSI6InZpc2l0IiwiZXZlbnRNZXRhZGF0YSI6W10sInJvdXRpbmdTdHJhdGVneSI6InNpbmdsZSJ9fV19
Requested by
Host: lz.ubpages.com
URL: https://lz.ubpages.com/okum/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.74.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-74-222.compute-1.amazonaws.com
Software
akka-http/10.2.9 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://lz.ubpages.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 11:13:49 GMT
server
akka-http/10.2.9
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin
*
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
43

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend object| ub object| module object| UnbounceSnowplowNamespace function| ubSnowplow function| setImmediate function| clearImmediate boolean| VimeoPlayerResizeEmbeds_ function| ownKeys function| _objectSpread function| _defineProperty function| _typeof object| Snowplow

3 Cookies

Domain/Path Name / Value
lz.ubpages.com/okum/ Name: ubpv
Value: a%2Cee27b686-1e12-11ee-8ae1-0242dc6d7787
lz.ubpages.com/ Name: ubvs
Value: 10620e91-5fff-49cf-bb37-6d5339d12339
.ubpages.com/ Name: ubvt
Value: v2%7C10620e91-5fff-49cf-bb37-6d5339d12339%7Cee27b686-1e12-11ee-8ae1-0242dc6d7787%3Aa%3Asingle