policy-twitter.com Open in urlscan Pro
23.111.184.119 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://policy-twitter.com/
Effective URL:
http://policy-twitter.com/login.php
Submission Tags: tweet @bumbl3r #phishing Search All
Submission: On January 15 via api (January 15th 2023, 11:21:01 am UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 23.111.184.119, located in Tampa, United States and belongs to HVC-AS, US. The main domain is policy-twitter.com.

This is the only time policy-twitter.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Twitter (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
1 9	23.111.184.119 23.111.184.119		29802 (HVC-AS) (HVC-AS)
8	1

9 23.111.184.119 (Tampa, United States) 1 redirects

ASN29802 (HVC-AS, US)
PTR: zeus.hosterbox.com

policy-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	policy-twitter.com 1 redirects policy-twitter.com	79 KB
8	1

	Domain	Requested by
9	policy-twitter.com	1 redirects policy-twitter.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://policy-twitter.com/login.php
Frame ID: 8BD7EA92614BAC072C3D8654B7F7229D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Twitter

Page URL History Show full URLs

http://policy-twitter.com/ HTTP 302
http://policy-twitter.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

79 kB
Transfer

320 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://policy-twitter.com/ HTTP 302
http://policy-twitter.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response policy-twitter.com/ Redirect Chain http://policy-twitter.com/ http://policy-twitter.com/login.php	4 KB 4 KB	237ms 231ms	Document text/html	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `661414e3da678fdea4b8d73dd9b36f7fc6d298e455df89c137a0af80e5689f82` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sun, 15 Jan 2023 11:20:55 GMT Keep-Alive timeout=1, max=29 Server Apache Transfer-Encoding chunked Redirect headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sun, 15 Jan 2023 11:20:54 GMT Keep-Alive timeout=1, max=30 Location login.php Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	jquery-3.6.0.min.js Show response policy-twitter.com/js/	87 KB 31 KB	171ms 169ms	Script application/javascript	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/js/jquery-3.6.0.min.js Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Fri, 10 Dec 2021 02:13:54 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 30902
GET H/1.1	200 OK	jquery.redirect.js Show response policy-twitter.com/js/	6 KB 2 KB	168ms 163ms	Script application/javascript	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/js/jquery.redirect.js Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Fri, 10 Dec 2021 04:30:54 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=28 Content-Length 2178
GET H/1.1	200 OK	login.js Show response policy-twitter.com/js/	623 B 661 B	339ms 166ms	Script application/javascript	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/js/login.js Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `b126d9a214a72de525e4092536f8b196706433328d7bf122c295937d4ba99a10` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Fri, 10 Dec 2021 12:39:08 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 323
GET H/1.1	200 OK	bootstrap.min.js Show response policy-twitter.com/bootstrap/js/	61 KB 15 KB	340ms 168ms	Script application/javascript	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/bootstrap/js/bootstrap.min.js Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `4b24eee82c2b7ce85ace76193e8a25570dabc6863b94a60a42fa9bb6a37ddc72` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Thu, 28 Oct 2021 16:25:08 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 15286
GET H/1.1	200 OK	bootstrap.min.css policy-twitter.com/bootstrap/css/	158 KB 24 KB	681ms 511ms	Stylesheet text/css	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/bootstrap/css/bootstrap.min.css Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Thu, 28 Oct 2021 16:25:08 GMT Server Apache Vary Accept-Encoding Content-Type text/css Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 24150
GET H/1.1	200 OK	style.css policy-twitter.com/css/	2 KB 873 B	334ms 164ms	Stylesheet text/css	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Full URL http://policy-twitter.com/css/style.css Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `a31468a8bcc6a38df3e647708976a861d3579155082a3dc8ec193a58b73f7d38` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:55 GMT Content-Encoding gzip Last-Modified Fri, 10 Dec 2021 10:11:38 GMT Server Apache Vary Accept-Encoding Content-Type text/css Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 549
GET H/1.1	200 OK	twitter.png policy-twitter.com/img/	787 B 1 KB	161ms 160ms	Image image/png	23.111.184.119 HVC-AS
General Check archive.org Show headers Download Go to Show image Full URL http://policy-twitter.com/img/twitter.png Requested by Host: policy-twitter.com URL: http://policy-twitter.com/login.php Protocol HTTP/1.1 Server 23.111.184.119 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS zeus.hosterbox.com Software Apache / Resource Hash `a6cdb2fe9d4f3c136d30f4e57f96a0aa063ddb093c1c6fefcf3943eee3e834b7` Request headers accept-language fi-FI,fi;q=0.9 Referer http://policy-twitter.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Sun, 15 Jan 2023 11:20:56 GMT Content-Encoding gzip Last-Modified Fri, 10 Dec 2021 03:55:52 GMT Server Apache Vary Accept-Encoding Content-Type image/png Cache-Control max-age=3600, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=29 Content-Length 810

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Twitter (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

policy-twitter.com
23.111.184.119
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
4b24eee82c2b7ce85ace76193e8a25570dabc6863b94a60a42fa9bb6a37ddc72
661414e3da678fdea4b8d73dd9b36f7fc6d298e455df89c137a0af80e5689f82
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98
a31468a8bcc6a38df3e647708976a861d3579155082a3dc8ec193a58b73f7d38
a6cdb2fe9d4f3c136d30f4e57f96a0aa063ddb093c1c6fefcf3943eee3e834b7
b126d9a214a72de525e4092536f8b196706433328d7bf122c295937d4ba99a10
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

policy-twitter.com Open in urlscan Pro 23.111.184.119 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

79 kBTransfer

320 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

policy-twitter.com Open in urlscan Pro
23.111.184.119 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

79 kB
Transfer

320 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!