urlscan.io logo urlscan.io
SecurityTrails logo

v.havas8.com Open in urlscan Pro
45.61.132.224  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://v.havas8.com/
Effective URL: https://v.havas8.com/index/user/login.html
Submission: On July 03 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 45.61.132.224, located in Las Vegas, United States and belongs to ROUTERHOSTING, US. The main domain is v.havas8.com.
TLS certificate: Issued by R11 on July 2nd 2024. Valid for: 3 months.
This is the only time v.havas8.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: TikTok Shop (Retail)

Domain & IP information

IP Address AS Autonomous System
1 10 45.61.132.224 14956 (ROUTERHOS...)
1 65.20.81.207 20473 (AS-CHOOPA)
10 3
Apex Domain
Subdomains		 Transfer
10 havas8.com
v.havas8.com
217 KB
1 work4444.com
hua.work4444.com
9 KB
10 2
Domain Requested by
10 v.havas8.com 1 redirects v.havas8.com
1 hua.work4444.com v.havas8.com
10 2

This site contains no links.

Subject Issuer Validity Valid
v.havas8.com
R11		 2024-07-02 -
2024-09-30		 3 months crt.sh
hua.work4444.com
R10		 2024-07-01 -
2024-09-29		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://v.havas8.com/index/user/login.html
Frame ID: A456CC6F18A1153219EA76162DAC2F37
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Შესვლა

Page URL History Show full URLs

  1. https://v.havas8.com/ HTTP 301
    https://v.havas8.com/index/user/login.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+flat-ui(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

230 kB
Transfer

573 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://v.havas8.com/ HTTP 301
    https://v.havas8.com/index/user/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.html
v.havas8.com/index/user/
Redirect Chain
  • https://v.havas8.com/
  • https://v.havas8.com/index/user/login.html
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
a39a92e11686501a48718cd9903ee6ca653dee839e6fd680e598c1346b3c238d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store, no-cache, must-revalidate no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 03 Jul 2024 12:19:32 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

cache-control
no-cache,must-revalidate no-cache
content-type
text/html; charset=utf-8
date
Wed, 03 Jul 2024 12:19:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
/index/user/login.html
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
app.css
v.havas8.com/logo/ 		37 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/logo/app.css
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
adb0dc444f85220e3a14b195214880b0007c37776a2371c4b9b9505e4842a328
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:45 GMT
server
nginx
etag
W/"64e0adc1-943a"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
iconfont.css
v.havas8.com/logo/ 		8 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/logo/iconfont.css
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
7cacd438aa0c20dc37f54d304140d49306a321a838316a9229384f1ce659ba73
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:50 GMT
server
nginx
etag
W/"64e0adc6-1fab"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
flat-ui.css
v.havas8.com/logo/ 		156 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/logo/flat-ui.css
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
6bef9f28d74953dccb0bcbf79d16bb7aace79238882fefd5b31ecb748f2fbd4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:49 GMT
server
nginx
etag
W/"64e0adc5-26ea7"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
bootstrap.min.css
v.havas8.com/logo/ 		141 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/logo/bootstrap.min.css
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
7ce7ff1f9877309dc6e87b662ea280fa876690e2104dec9f82a0c15c9f27f285
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:47 GMT
server
nginx
etag
W/"64e0adc3-2356c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
icon_lang.png
v.havas8.com/logo/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://v.havas8.com/logo/icon_lang.png
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
5b38eea9b4eaf70edfc7ee1609d5b89fd44f58c65fcc111f094d8141ebbc2451
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:51 GMT
server
nginx
etag
W/"64e0adc7-9c3"
vary
Accept-Encoding
x-cache
HIT
content-type
image/png
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
3f5e924917e99056.png
hua.work4444.com/upload/063da7d30dfb1c91/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hua.work4444.com/upload/063da7d30dfb1c91/3f5e924917e99056.png
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
65.20.81.207 Mumbai, India, ASN20473 (AS-CHOOPA, US),
Reverse DNS
65.20.81.207.vultrusercontent.com
Software
nginx /
Resource Hash
c0b8abf20962de51438f541f7b1d4d8f0d24af65348800a3e3eeefa48bc603d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:33 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 02 Jul 2024 08:40:56 GMT
server
nginx
etag
"6683bd18-2203"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
8707
expires
Fri, 02 Aug 2024 12:19:33 GMT
jquery-1.11.3.min.js
v.havas8.com/logo/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/logo/jquery-1.11.3.min.js
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sat, 19 Aug 2023 11:55:53 GMT
server
nginx
etag
W/"64e0adc9-176d5"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:32 GMT
newLogin.png
v.havas8.com/douyin/ 		107 KB
94 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://v.havas8.com/douyin/newLogin.png
Requested by
Host: v.havas8.com
URL: https://v.havas8.com/index/user/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
0ed8e8bbc30a49c9a54949760d44101779608d22761207e6e7ffc964c0d59601
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:33 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 13 Mar 2024 07:44:44 GMT
server
nginx
etag
W/"65f1596c-1aaed"
vary
Accept-Encoding
x-cache
HIT
content-type
image/png
cache-control
max-age=60
expires
Wed, 03 Jul 2024 12:20:33 GMT
truncated
/ 		5 KB
5 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1e0b37e2e8fd4e762978926eb039af2a4f6e7c7d2f937961953c372dc7e3f9d

Request headers

Referer
Origin
https://v.havas8.com
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
favicon.ico
v.havas8.com/ 		12 KB
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://v.havas8.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.61.132.224 Las Vegas, United States, ASN14956 (ROUTERHOSTING, US),
Reverse DNS
Software
nginx /
Resource Hash
f1eff40ca74ef3471e7a148f564bb74d95454885320df9ad51bc441c991ab1bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://v.havas8.com/index/user/login.html
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 12:19:35 GMT
strict-transport-security
max-age=31536000
last-modified
Sun, 05 Jan 2020 13:07:52 GMT
server
nginx
etag
"5e11dfa8-2e49"
content-type
image/x-icon
cache-control
no-cache
accept-ranges
bytes
content-length
11849

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TikTok Shop (Retail)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
v.havas8.com/ Name: sdce59ead
Value: neod9vohin8scdg35rc84l9gu4

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://v.havas8.com/index/user/login.html
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000