tengicungduoc.website Open in urlscan Pro
147.189.141.33 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://tengicungduoc.website/next.php
Effective URL:
https://tengicungduoc.website/next.php
Submission Tags: @ecarlesi threat phishing meta Search All
Submission: On September 27 via api (September 27th 2024, 4:16:42 am UTC) from IT — Scanned from GB

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 147.189.141.33, located in Wolverhampton, United Kingdom and belongs to VELOXSERV, GB. The main domain is tengicungduoc.website.
TLS certificate: Issued by localhost on November 10th 2009. Valid for: 10 years.

This is the only time tengicungduoc.website was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
9	147.189.141.33 147.189.141.33		3170 (VELOXSERV) (VELOXSERV)
1	2a04:4e42:200... 2a04:4e42:200::649		54113 (FASTLY) (FASTLY)
10	2

9 147.189.141.33 (Wolverhampton, United Kingdom)

ASN3170 (VELOXSERV, GB)

tengicungduoc.website	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tengicungduoc.website tengicungduoc.website	517 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 851	31 KB
10	2

	Domain	Requested by
9	tengicungduoc.website	tengicungduoc.website
1	code.jquery.com	tengicungduoc.website
10	2

This site contains no links.

Subject Issuer	Validity	Valid
localhost localhost	`2009-11-10` - `2019-11-08`	10 years	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://tengicungduoc.website/next.php
Frame ID: B02384A35C6819476177677E87BBA751
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Privacy Policy

Page URL History Show full URLs

http://tengicungduoc.website/next.php HTTP 307
https://tengicungduoc.website/next.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

10 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

548 kB
Transfer

602 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://tengicungduoc.website/next.php HTTP 307
https://tengicungduoc.website/next.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request next.php Show response tengicungduoc.website/ Redirect Chain http://tengicungduoc.website/next.php https://tengicungduoc.website/next.php	20 KB 20 KB	157ms 70ms	Document text/html	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / PHP/8.2.12 Resource Hash `a364fd3662e6dcc6595a12d57de62681a8115d86583ca8fdb719ea4d318527a5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Fri, 27 Sep 2024 04:16:33 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Transfer-Encoding chunked X-Powered-By PHP/8.2.12 Redirect headers Location https://tengicungduoc.website/next.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	custom.css tengicungduoc.website/static/themes/	17 KB 18 KB	60ms 36ms	Stylesheet text/css	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/static/themes/custom.css Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `bcd6ece8b8beea5f2c555d699dda6dfb28d7b7d3387d8e6936038f27d95889b6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "45e0-60c8dde7e38c0" Connection Keep-Alive Accept-Ranges bytes Content-Length 17888 Keep-Alive timeout=5, max=99 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:15:23 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	link_custom.css tengicungduoc.website/static/themes/	3 KB 3 KB	105ms 44ms	Stylesheet text/css	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/static/themes/link_custom.css Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `a158314b8c627edac9b16d26cf93e69ad827a5933c61cfefadbc8a4396f60cce` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "a9c-60c8de01a3580" Connection Keep-Alive Accept-Ranges bytes Content-Length 2716 Keep-Alive timeout=5, max=98 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:15:50 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	animate.css tengicungduoc.website/static/themes/	98 KB 99 KB	154ms 85ms	Stylesheet text/css	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/static/themes/animate.css Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `e5aa5beb37365524995a5bcf595d5cf5f5b06c6fd45cb73a590a4da2fa751324` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "18951-60c8de11d9bc0" Connection Keep-Alive Accept-Ranges bytes Content-Length 100689 Keep-Alive timeout=5, max=100 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:16:07 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	app.cad2193a277eb5a4ec97d5295f5120bd.css tengicungduoc.website/static/css/	255 KB 256 KB	155ms 85ms	Stylesheet text/css	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/static/css/app.cad2193a277eb5a4ec97d5295f5120bd.css Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `1b7428d41c2833a4c9b79e26cf9615c430dbba420fbd0d965a8c090be59b9169` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "3fd4d-60c8de25e0b00" Connection Keep-Alive Accept-Ranges bytes Content-Length 261453 Keep-Alive timeout=5, max=100 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:16:28 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	index-ZU7tKWJA.css tengicungduoc.website/assets/	42 KB 42 KB	154ms 83ms	Stylesheet text/css	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/assets/index-ZU7tKWJA.css Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `ee9f3d153b95d6515c9c417767550d4f60ae0f71e942c0f5a24760e2f82c9a87` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://tengicungduoc.website Referer https://tengicungduoc.website/next.php Response headers ETag "a81e-614c5c5fbaa0a" Connection Keep-Alive Accept-Ranges bytes Content-Length 43038 Keep-Alive timeout=5, max=100 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 29 Mar 2024 05:18:42 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H2	200	jquery-3.6.4.min.js Show response code.jquery.com/	88 KB 31 KB	84ms 25ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.4.min.js Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/ Response headers content-encoding gzip etag W/"28feccc0-15ec3" age 5001675 x-cache HIT, HIT date Fri, 27 Sep 2024 04:16:38 GMT content-type application/javascript; charset=utf-8 last-modified Fri, 18 Oct 1991 12:00:00 GMT x-cache-hits 174187, 11213 x-served-by cache-lga21953-LGA, cache-man4143-MAN vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=604800 x-timer S1727410598.394995,VS0,VE0 cross-origin-resource-policy cross-origin via 1.1 varnish, 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 31011 server nginx
GET H/1.1	200 OK	main.js Show response tengicungduoc.website/assets/	5 KB 6 KB	155ms 84ms	Script text/javascript	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/assets/main.js Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `19cc95ef05623e349096f23419c1ce96a7208669e8a0f90f1ee1e8f59ed7d3e8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "151b-6230727fce6fa" Connection Keep-Alive Accept-Ranges bytes Content-Length 5403 Keep-Alive timeout=5, max=100 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Thu, 26 Sep 2024 15:11:42 GMT Content-Type text/javascript Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	facebook.png tengicungduoc.website/static/uploads/	39 KB 39 KB	97ms 85ms	Image image/png	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Show image Full URL https://tengicungduoc.website/static/uploads/facebook.png Requested by Host: tengicungduoc.website URL: https://tengicungduoc.website/next.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `f0500eb244f873f52aa984dea9f4993dfaa505425b555b80265de6b526353057` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "9b3c-60c8e2c933c40" Connection Keep-Alive Accept-Ranges bytes Content-Length 39740 Keep-Alive timeout=5, max=100 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:37:13 GMT Content-Type image/png Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
GET H/1.1	200 OK	logo.png tengicungduoc.website/static/uploads/	35 KB 35 KB	42ms 42ms	Other image/png	147.189.141.33 VELOXSERV
General Check archive.org Show headers Download Go to Full URL https://tengicungduoc.website/static/uploads/logo.png Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 147.189.141.33 Wolverhampton, United Kingdom, ASN3170 (VELOXSERV, GB), Reverse DNS Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 / Resource Hash `62ebfab29cdf3c417eb48e9c429133d6c4d1b8ddb27fc14820a57b9d5a617ae8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://tengicungduoc.website/next.php Response headers ETag "8b20-60c8e2130ce80" Connection Keep-Alive Accept-Ranges bytes Content-Length 35616 Keep-Alive timeout=5, max=99 Date Fri, 27 Sep 2024 04:16:33 GMT Last-Modified Fri, 15 Dec 2023 15:34:02 GMT Content-Type image/png Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| validateInput function| showPasswordForm function| closePopup function| getUserIP function| checkPassword

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://tengicungduoc.website/next.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
tengicungduoc.website
147.189.141.33
2a04:4e42:200::649
19cc95ef05623e349096f23419c1ce96a7208669e8a0f90f1ee1e8f59ed7d3e8
1b7428d41c2833a4c9b79e26cf9615c430dbba420fbd0d965a8c090be59b9169
62ebfab29cdf3c417eb48e9c429133d6c4d1b8ddb27fc14820a57b9d5a617ae8
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a158314b8c627edac9b16d26cf93e69ad827a5933c61cfefadbc8a4396f60cce
a364fd3662e6dcc6595a12d57de62681a8115d86583ca8fdb719ea4d318527a5
bcd6ece8b8beea5f2c555d699dda6dfb28d7b7d3387d8e6936038f27d95889b6
e5aa5beb37365524995a5bcf595d5cf5f5b06c6fd45cb73a590a4da2fa751324
ee9f3d153b95d6515c9c417767550d4f60ae0f71e942c0f5a24760e2f82c9a87
f0500eb244f873f52aa984dea9f4993dfaa505425b555b80265de6b526353057