urlscan.io logo urlscan.io
SecurityTrails logo

evil.com Open in urlscan Pro
66.96.146.129  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nextdoor.app.link/Ur4S6epDs9
Effective URL: http://evil.com/?_branch_match_id=829819684823758891
Submission: On September 02 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 66.96.146.129, located in Burlington, United States and belongs to BIZLAND-SD, US. The main domain is evil.com.
This is the only time evil.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2600:9000:205... 16509 (AMAZON-02)
2 66.96.146.129 29873 (BIZLAND-SD)
2 1
Apex Domain
Subdomains		 Transfer
2 evil.com
evil.com
6 KB
1 app.link
nextdoor.app.link
663 B
2 2
Domain Requested by
2 evil.com evil.com
1 nextdoor.app.link 1 redirects
2 2

This site contains links to these domains. Also see Links.

Domain
www.evil.com
www.who.int
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://evil.com/?_branch_match_id=829819684823758891
Frame ID: 79A4C36C9FFD116D9624B3715C930BCA
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://nextdoor.app.link/Ur4S6epDs9 HTTP 307
    http://evil.com/?_branch_match_id=829819684823758891 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

6 kB
Transfer

6 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nextdoor.app.link/Ur4S6epDs9 HTTP 307
    http://evil.com/?_branch_match_id=829819684823758891 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
evil.com/
Redirect Chain
  • https://nextdoor.app.link/Ur4S6epDs9
  • http://evil.com/?_branch_match_id=829819684823758891
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://evil.com/?_branch_match_id=829819684823758891
Protocol
HTTP/1.1
Server
66.96.146.129 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
129.146.96.66.static.eigbox.net
Software
Apache/2 /
Resource Hash
d2605b1a1081eb27d0639b64cbe27bc0147801bcfeb4838882d53cded0394da1

Request headers

Host
evil.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 02 Sep 2020 21:37:37 GMT
Content-Type
text/html
Content-Length
4973
Connection
keep-alive
Keep-Alive
timeout=30
Server
Apache/2
Last-Modified
Tue, 16 Jun 2020 15:18:23 GMT
ETag
"136d-5a8350dea74e0"
Cache-Control
max-age=3600
Expires
Wed, 02 Sep 2020 22:37:37 GMT
Accept-Ranges
bytes
Age
0

Redirect headers

Content-Length
0
Connection
keep-alive
Server
openresty/1.13.6.2
Date
Wed, 02 Sep 2020 21:37:36 GMT
X-Powered-By
Express
Set-Cookie
_s=7X%2FB4JKb9wp5ennxHh6tnCJFUdk4BbmIEGrwxHo0EeZEA7ZskpHMh0qXSf%2BZab6I; Max-Age=31536000; Domain=.app.link; Path=/; Expires=Thu, 02 Sep 2021 21:37:36 GMT; Secure; SameSite=None
Last-Modified
Wed, 02 Sep 2020 21:37:36 GMT
Location
http://evil.com/?_branch_match_id=829819684823758891
X-Cache
Miss from cloudfront
Via
1.1 7ed7afde326861e358c3c83359e99895.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA6-C1
X-Amz-Cf-Id
2OnTzvvQY4RLY0CGk-bxQbiee7e5oxew9aJ3oUZOI-kwh6yImAnfVw==
20131225_copy(1
evil.com/archives/2013/201312/ 		867 B
867 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://evil.com/archives/2013/201312/20131225_copy(1
Requested by
Host: evil.com
URL: http://evil.com/?_branch_match_id=829819684823758891
Protocol
HTTP/1.1
Server
66.96.146.129 Burlington, United States, ASN29873 (BIZLAND-SD, US),
Reverse DNS
129.146.96.66.static.eigbox.net
Software
Apache/2 /
Resource Hash
dc4ca971c4c7df50c5aaee10082c75563151e4cabff67b0890156b4ea90379e0

Request headers

Referer
http://evil.com/?_branch_match_id=829819684823758891
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 02 Sep 2020 21:37:37 GMT
Last-Modified
Fri, 10 Jan 2020 16:05:10 GMT
Server
Apache/2
Age
0
Content-Type
text/html
Connection
keep-alive
Accept-Ranges
bytes, bytes
Keep-Alive
timeout=30
Content-Length
867

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

evil.com
nextdoor.app.link
2600:9000:2057:3400:19:9934:6a80:93a1
66.96.146.129
d2605b1a1081eb27d0639b64cbe27bc0147801bcfeb4838882d53cded0394da1
dc4ca971c4c7df50c5aaee10082c75563151e4cabff67b0890156b4ea90379e0