soy998.com
Open in
urlscan Pro
91.199.90.131
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On April 16 via api from US
Summary
This is the only time soy998.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 91.199.90.131 91.199.90.131 | 60458 (ASN-XTUDI...) (ASN-XTUDIONET) | |
1 | 64.90.42.103 64.90.42.103 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
1 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST) | |
3 | 4 |
ASN26347 (DREAMHOST-AS, US)
PTR: apache2-sith.sthelens.dreamhost.com
mega-scripts.icu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
amung.us
whos.amung.us |
30 B |
1 |
mega-scripts.icu
mega-scripts.icu |
83 KB |
1 |
soy998.com
soy998.com |
3 KB |
3 | 3 |
Domain | Requested by | |
---|---|---|
1 | whos.amung.us |
soy998.com
|
1 | mega-scripts.icu |
soy998.com
|
1 | soy998.com | |
3 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.mega-scripts.icu R3 |
2021-04-09 - 2021-07-08 |
3 months | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://soy998.com/wAWx6nA2j0
Frame ID: 303C04D51D049B72D8FE0AFD1E75C9E0
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
wAWx6nA2j0
soy998.com/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
mega-scripts.icu/ |
239 KB 83 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
30 B 30 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| bannedips string| ip object| handleips string| d object| dom string| back boolean| ignoreHistoryChange boolean| ignoreHashChange string| kon object| _$_f395 string| head string| bod0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mega-scripts.icu
soy998.com
whos.amung.us
64.90.42.103
67.202.94.94
91.199.90.131
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
80b8ed10acab8a4043c73402faf683e49f8a1d588f8e8c9ee18a9ba6d2d9d75b
822e7a86c04e7ad5ed0043a812792531455603783eff011ade7ef7c776297723
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855