urlscan.io logo urlscan.io
SecurityTrails logo

in-located.com Open in urlscan Pro
62.3.58.220  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://in-located.com/lock6/?auth=tsneth
Submission: On December 15 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 62.3.58.220, located in Moscow, Russian Federation and belongs to TIMEHOST-AS, UA. The main domain is in-located.com.
TLS certificate: Issued by R3 on December 3rd 2022. Valid for: 3 months.
This is the only time in-located.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

IP Address AS Autonomous System
8 62.3.58.220 212913 (TIMEHOST-AS)
8 1
Apex Domain
Subdomains		 Transfer
8 in-located.com
in-located.com
240 KB
8 1
Domain Requested by
8 in-located.com in-located.com
8 1

This site contains no links.

Subject Issuer Validity Valid
in-located.com
R3		 2022-12-03 -
2023-03-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://in-located.com/lock6/?auth=tsneth
Frame ID: A7D66349F9DBB2E79F1E493339D5D0AB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Find My iPhone

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • ([\d.]+)/jquery-ui(?:\.min)?\.js
  • jquery-ui.*\.js

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

240 kB
Transfer

903 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
in-located.com/lock6/ 		13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
73597a4a28b068503ea686fac6654df9dd946da3366c1d7c3de4018de54c4a28

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-length
3413
content-type
text/html; charset=utf-8
date
Thu, 15 Dec 2022 15:35:27 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
vary
Accept-Encoding
jquery-1.10.2.js
in-located.com/lock6/src/icloud_page/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/src/icloud_page/jquery-1.10.2.js
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29432
expires
Thu, 22 Dec 2022 15:35:27 GMT
passcode.css
in-located.com/lock6/src/activation_lock/ 		2 KB
724 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/src/activation_lock/passcode.css
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
439f4ed5d5616cdc024227e4985d64d47079599a94b79ec2565f25e6342aead6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
685
expires
Thu, 22 Dec 2022 15:35:27 GMT
heho.js
in-located.com/app/assets/js/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://in-located.com/app/assets/js/heho.js
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
3ccc3ac302b53bc3cfd5c688b5679cef2d9c44e482ea9e796666d4cb917d79ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:06 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
5122
expires
Thu, 22 Dec 2022 15:35:27 GMT
jquery-1.10.2.js
in-located.com/lock6/code.jquery.com/ 		267 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/code.jquery.com/jquery-1.10.2.js
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
8ade6740a1d3cfedf81e28d9250929341207b23a55f1be90ccc26cf6d98e052a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
78778
expires
Thu, 22 Dec 2022 15:35:27 GMT
jquery-ui.js
in-located.com/lock6/code.jquery.com/ui/1.12.1/ 		509 KB
118 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/code.jquery.com/ui/1.12.1/jquery-ui.js
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
4f455eb2ddf2094ee969f470f6bfac7adb4c057e8990a374e9da819e943c777d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
120945
expires
Thu, 22 Dec 2022 15:35:27 GMT
activity-indicator.js
in-located.com/lock6/src/icloud_page_new/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://in-located.com/lock6/src/icloud_page_new/activity-indicator.js
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
9043b20ba471232c4ea62ee23dbe1d499db2da6df7aa733d7396d0d94b8bec67

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Thu, 15 Dec 2022 15:35:27 GMT
content-encoding
br
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2292
expires
Thu, 22 Dec 2022 15:35:27 GMT
next.png
in-located.com/lock6/src/activation_lock/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://in-located.com/lock6/src/activation_lock/next.png
Requested by
Host: in-located.com
URL: https://in-located.com/lock6/?auth=tsneth
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
62.3.58.220 Moscow, Russian Federation, ASN212913 (TIMEHOST-AS, UA),
Reverse DNS
xolodecbiz.ua
Software
/
Resource Hash
fa9dcfe37df0132504fdb3ed8632df800b64023daa5f7fc1338f1ee0126f7b15

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://in-located.com/lock6/?auth=tsneth
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-type
image/png
date
Thu, 15 Dec 2022 15:35:27 GMT
cache-control
public, max-age=604800
last-modified
Wed, 28 Jul 2021 12:43:10 GMT
accept-ranges
bytes
content-length
4390
expires
Thu, 22 Dec 2022 15:35:27 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery object| Geos number| setcolor number| num number| afis function| remove function| changePolyColor function| login

1 Cookies

Domain/Path Name / Value
in-located.com/ Name: PHPSESSID
Value: f7f06a67ed51b47ffb2079ad0ee33fdf