alert3fbb0-seeagreetoterms.biz.id Open in urlscan Pro
70.39.90.16  Malicious Activity! Public Scan

URL: http://alert3fbb0-seeagreetoterms.biz.id/
Submission: On June 27 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 70.39.90.16, located in Denver, United States and belongs to SHARKTECH, US. The main domain is alert3fbb0-seeagreetoterms.biz.id.
This is the only time alert3fbb0-seeagreetoterms.biz.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 70.39.90.16 46844 (SHARKTECH)
2 2a04:4e42:600... 54113 (FASTLY)
1 104.21.235.69 13335 (CLOUDFLAR...)
5 3
Apex Domain
Subdomains
Transfer
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
54 KB
2 alert3fbb0-seeagreetoterms.biz.id
alert3fbb0-seeagreetoterms.biz.id
69 KB
1 iili.io
iili.io — Cisco Umbrella Rank: 43490
3 KB
5 3
Domain Requested by
2 cdn.jsdelivr.net alert3fbb0-seeagreetoterms.biz.id
2 alert3fbb0-seeagreetoterms.biz.id
1 iili.io alert3fbb0-seeagreetoterms.biz.id
5 3

This site contains no links.

Subject Issuer Validity Valid
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh
iili.io
E1
2024-06-01 -
2024-08-30
3 months crt.sh

This page contains 1 frames:

Primary Page: http://alert3fbb0-seeagreetoterms.biz.id/
Frame ID: 1EFB2850C8FAB343040AEB478EE921AE
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Pаgе Help Suрроrt Team

Page URL History Show full URLs

  1. http://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
    https://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
    http://alert3fbb0-seeagreetoterms.biz.id/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

5
Requests

60 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

127 kB
Transfer

344 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
    https://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
    http://alert3fbb0-seeagreetoterms.biz.id/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
alert3fbb0-seeagreetoterms.biz.id/
Redirect Chain
  • http://alert3fbb0-seeagreetoterms.biz.id/
  • https://alert3fbb0-seeagreetoterms.biz.id/
  • http://alert3fbb0-seeagreetoterms.biz.id/
8 KB
3 KB
Document
General
Full URL
http://alert3fbb0-seeagreetoterms.biz.id/
Protocol
HTTP/1.1
Server
70.39.90.16 Denver, United States, ASN46844 (SHARKTECH, US),
Reverse DNS
paul.baae.org
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
20796d9437416caaf0047341e918da97b336978d0f3d78556d5844f0b5abd105

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=31536000
Content-Encoding
gzip
Content-Length
2672
Content-Type
text/html
Date
Thu, 27 Jun 2024 20:54:51 GMT
ETag
"4b16bf228dc7da1:0"
Last-Modified
Wed, 26 Jun 2024 05:53:14 GMT
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-Powered-By
ASP.NET

Redirect headers

Location
http://alert3fbb0-seeagreetoterms.biz.id/
Non-Authoritative-Reason
HttpsUpgrades
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/
189 KB
30 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css
Requested by
Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
http://alert3fbb0-seeagreetoterms.biz.id/
Origin
http://alert3fbb0-seeagreetoterms.biz.id
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 27 Jun 2024 20:54:52 GMT
x-content-type-options
nosniff
content-encoding
br
age
1854977
x-jsd-version
5.2.0-beta1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
30281
x-served-by
cache-fra-etou8220113-FRA, cache-mxp6920-MXP
x-jsd-version-type
version
etag
W/"2f3f9-YnOsGiPXmhIvAi9qh8W3XCz6/Do"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
J6cGg99.png
iili.io/
3 KB
3 KB
Image
General
Full URL
https://iili.io/J6cGg99.png
Requested by
Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.235.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
http://alert3fbb0-seeagreetoterms.biz.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 20:54:52 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
121643
alt-svc
h3=":443"; ma=86400
content-length
2987
last-modified
Tue, 14 May 2024 12:14:34 GMT
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3nBU8LfWIt6ZdeU%2B4Ltn2LM1ehaOGY3OLWoOwA7ybx%2FFHpHmwq0r5J2JXm6NSp0gzyoCbdlbo7IXnDoSdO%2BTFLUNzZGdACAaLU5qV7oufkk2QaRfprTt97Dl"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
89a855b06b681e0c-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/
78 KB
24 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/bootstrap.bundle.min.js
Requested by
Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2515e37eee31f5ef3d659b21dcc84dc6ea732b06872da51078b5b526de34c0c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
http://alert3fbb0-seeagreetoterms.biz.id/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 27 Jun 2024 20:54:52 GMT
x-content-type-options
nosniff
content-encoding
br
age
1885266
x-jsd-version
5.2.0-beta1
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
24445
x-served-by
cache-fra-eddf8230137-FRA, cache-mxp6924-MXP
x-jsd-version-type
version
etag
W/"1377e-a0uYWpCr16scLjX/O4dNB8+EEO4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
meta_logo_icon_214665.ico
alert3fbb0-seeagreetoterms.biz.id/img/
66 KB
66 KB
Other
General
Full URL
http://alert3fbb0-seeagreetoterms.biz.id/img/meta_logo_icon_214665.ico
Protocol
HTTP/1.1
Server
70.39.90.16 Denver, United States, ASN46844 (SHARKTECH, US),
Reverse DNS
paul.baae.org
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
39e97584b4390e1d77866903ca5f0afb31e51138ad227a3fca83dc8c4fbe2932

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://alert3fbb0-seeagreetoterms.biz.id/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Thu, 27 Jun 2024 20:54:51 GMT
Last-Modified
Tue, 14 May 2024 12:19:30 GMT
Server
Microsoft-IIS/10.0
ETag
"0f578f8f8a5da1:0"
X-Powered-By
ASP.NET
Content-Type
image/x-icon
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
67646

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence number| uidEvent object| bootstrap

0 Cookies