www.kbydt.com Open in urlscan Pro
103.151.217.95 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3cN65Mj
Effective URL:
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enou...
Submission: On June 21 via manual (June 21st 2021, 6:59:21 am UTC) from IL

Summary HTTP 5 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 103.151.217.95, located in China and belongs to NANBIAN-VPSORGLOBAL-AS VPSOR-GLOBAL, CN. The main domain is www.kbydt.com.
TLS certificate: Issued by TrustAsia TLS RSA CA on September 27th 2020. Valid for: a year.

This is the only time www.kbydt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Investment Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
2	103.151.217.95 103.151.217.95	138538 (NANBIAN-V...) (NANBIAN-VPSORGLOBAL-AS VPSOR-GLOBAL)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	4

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.151.217.95 (China)

ASN138538 (NANBIAN-VPSORGLOBAL-AS VPSOR-GLOBAL, CN)

www.kbydt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cloudflare.com cdnjs.cloudflare.com	28 KB
2	kbydt.com www.kbydt.com	773 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com	17 KB
1	bit.ly 1 redirects bit.ly	349 B
5	4

	Domain	Requested by
2	cdnjs.cloudflare.com	www.kbydt.com
2	www.kbydt.com	www.kbydt.com
1	stackpath.bootstrapcdn.com	www.kbydt.com
1	bit.ly	1 redirects
5	4

This site contains links to these domains. Also see Links.

Domain
maxitdokuen.info

Subject Issuer	Validity	Valid
www.kbydt.com TrustAsia TLS RSA CA	`2020-09-27` - `2021-09-27`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon
Frame ID: 5F2A43D42006CA18C6C5F35C5A97FBA4
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/3cN65Mj HTTP 301
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingi... Page URL
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingi... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

818 kB
Transfer

2033 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://maxitdokuen.info/?offerId=37&pid=s50v57&sub1=3
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3cN65Mj HTTP 301
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest Page URL
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3cN65Mj HTTP 301
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest

5 HTTP transactions
20 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

index.php Show response
www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/
Redirect Chain

https://bit.ly/3cN65Mj
https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest

5 KB
2 KB

1449ms
771ms

Document
text/html

103.151.217.95
NANBIAN-VPSORGLOB...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.151.217.95 , China, ASN138538 (NANBIAN-VPSORGLOBAL-AS VPSOR-GLOBAL, CN),
Reverse DNS
Software: nginx /
Resource Hash: 8f099e5612aeec06242e9f9ae9acfe044d7d03a6e6e4f6181b3abdbd20ff0c86

Request headers

:method: GET
:authority: www.kbydt.com
:scheme: https
:path: /.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Mon, 21 Jun 2021 06:58:57 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip

Redirect headers

server: nginx
date: Mon, 21 Jun 2021 06:58:55 GMT
content-type: text/html; charset=utf-8
content-length: 257
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest
referrer-policy: unsafe-url
set-cookie: _bit=l5l6WT-899fc832e38a6a1bcc-00s; Domain=bit.ly; Expires=Sat, 18 Dec 2021 06:58:55 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 Primary Request index.php Show response
www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/ 1 MB
771 KB 3734ms
3733ms Document
text/html 103.151.217.95
NANBIAN-VPSORGLOB...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon
Requested by: Host: www.kbydt.com
URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.151.217.95 , China, ASN138538 (NANBIAN-VPSORGLOBAL-AS VPSOR-GLOBAL, CN),
Reverse DNS
Software: nginx /
Resource Hash: c22984d8d688b140df14c2ab80dec98cfbd4ee40d06e27882226209a1227dca5

Request headers

:method: GET
:authority: www.kbydt.com
:scheme: https
:path: /.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?short=b105tq5endtf7sff&tree=held&amount=interest

Response headers

server: nginx
date: Mon, 21 Jun 2021 06:59:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/3.3.1/css/ 111 KB
17 KB 21ms
20ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/3.3.1/css/bootstrap.min.css

Requested by

Host: www.kbydt.com
URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d699f303990ce9bd7d7c97e9bd3cad6a46ecf2532f475cf22ae58213237821b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kbydt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Jun 2021 06:59:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 722, 718, 718
age: 5103496
cdn-cachedat: 2021-04-22 23:16:32
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0acef69ee30000c2862bb09000000001
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:58 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: a3beaf1ce8b39308479b6cd48f02f716
cf-ray: 662b5a116aa0c286-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 404 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.8.1/css/ 0
0 480ms
479ms Stylesheet
text/html 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.8.1/css/font-awesome.min.css
Requested by: Host: www.kbydt.com
URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.kbydt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
28 KB 38ms
38ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.kbydt.com
URL: https://www.kbydt.com/.well-known/pki-validation/show_image/personnel/frmcontact/viewfile/roofingissues/index.php?enough=s9zp1eh111hqzg&sign=soon

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kbydt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Jun 2021 06:59:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 282793
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 27748
cf-request-id: 0acef69eef00004e8c90872000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iM7KqDfNmToWPctg6gBiEyn3yxYDZ0G33UxZZZ7Jj6aG5GLo%2BBBhUMPBi2zu0E1UfdSeaUQ1zyDIK%2B2hnA9Iw%2BNrL8t51Am2P6mdpIGIiQ5zr%2FcUe9fRGMyUHYL%2BCW5E2IeWQSvokYOo%2FBQasg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 662b5a117dd44e8c-FRA
expires: Sat, 11 Jun 2022 06:59:02 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 276f1db3a3178abdc581d679cd4c3091d9cfc96f6524549a42c05c518cdf2bf3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 54 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2489b6150efecee42d4a6ac44e7412e24694b800deaab4750c42d42d38180853

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 54 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4827101a742d037bfd1abee57a8381e03727e3e69595778307a67a61928ac11d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 72 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 558ff4e312e5f7cfb6a66e493102c119f477e9e9002b2e851b90d1b26b842ca6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 63 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f98da04e4fe7961d6187060290a6c399fd5b2ce7517585a046559a12b902ecff

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 39 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93569c6f0b34f2761d855b028675ecc9bfdc5b1bf7c85157c6681d8351449b09

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 250 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89551df7776d88c155ec7ebc8ff0fdb5132e555d76811739f4bfffd7979c2916

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 27 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 36a93f5572ec03df86621e681c994f8e832ad06b5ce59d235130c61182940f9f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 26 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a7bddde59764b263f7d46caab05581ab00b223ac6b1b7b5d05640d329f7e9c3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 20 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f405f28d3fc780dcd00b5febfb853a2c521ba8d9f2cbc2968a9c5787747b6f88

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d01ccd1570627430c58350525cd032e892063f9a839fe30827d9c0415e06d3b8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 518ee730c5ba149592d3e18e7c34c65eb931aaea55f921902ddd5d625cc6a1d2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2e9c24008dd7f7fa8b3a4ca375b6b00cbb164607afde5b63a1328a569a84874

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4805432d3e214ba35c2982a58e009762eddbcf3c450ee74402cce7bfac6a7929

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 14 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f4f281ca7166ffb19a8c790150f45e19b7dc9e0fcec5d783e7325e8bb16f8dc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f723cc6e270fa155f6c9c9950393f5876a52ee93f22d77864b49bc3fc24a5fa3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 981a38f436032637ba92058f73de969a85115c98512d4eafa0f101f3e08b1914

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 44 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f10db81437bdf52d935dfb99d2dbc823d7e683b14e6de520046a1371266494ae

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 21 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf0dd246573146bdec90a87c9512ee0c31c26f05aa9835397c2c496aec6f85be

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 17 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 133771dea9e842dc402c42caff112015a06070bb2b0a5bb78d26b82309247003

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Investment Scam (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
cdnjs.cloudflare.com
stackpath.bootstrapcdn.com
www.kbydt.com
103.151.217.95
2606:4700::6810:135e
2606:4700::6812:bcf
67.199.248.10
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
133771dea9e842dc402c42caff112015a06070bb2b0a5bb78d26b82309247003
2489b6150efecee42d4a6ac44e7412e24694b800deaab4750c42d42d38180853
276f1db3a3178abdc581d679cd4c3091d9cfc96f6524549a42c05c518cdf2bf3
2f4f281ca7166ffb19a8c790150f45e19b7dc9e0fcec5d783e7325e8bb16f8dc
36a93f5572ec03df86621e681c994f8e832ad06b5ce59d235130c61182940f9f
3a7bddde59764b263f7d46caab05581ab00b223ac6b1b7b5d05640d329f7e9c3
4805432d3e214ba35c2982a58e009762eddbcf3c450ee74402cce7bfac6a7929
4827101a742d037bfd1abee57a8381e03727e3e69595778307a67a61928ac11d
518ee730c5ba149592d3e18e7c34c65eb931aaea55f921902ddd5d625cc6a1d2
558ff4e312e5f7cfb6a66e493102c119f477e9e9002b2e851b90d1b26b842ca6
89551df7776d88c155ec7ebc8ff0fdb5132e555d76811739f4bfffd7979c2916
8f099e5612aeec06242e9f9ae9acfe044d7d03a6e6e4f6181b3abdbd20ff0c86
93569c6f0b34f2761d855b028675ecc9bfdc5b1bf7c85157c6681d8351449b09
981a38f436032637ba92058f73de969a85115c98512d4eafa0f101f3e08b1914
b2e9c24008dd7f7fa8b3a4ca375b6b00cbb164607afde5b63a1328a569a84874
c22984d8d688b140df14c2ab80dec98cfbd4ee40d06e27882226209a1227dca5
cf0dd246573146bdec90a87c9512ee0c31c26f05aa9835397c2c496aec6f85be
d01ccd1570627430c58350525cd032e892063f9a839fe30827d9c0415e06d3b8
d699f303990ce9bd7d7c97e9bd3cad6a46ecf2532f475cf22ae58213237821b9
f10db81437bdf52d935dfb99d2dbc823d7e683b14e6de520046a1371266494ae
f405f28d3fc780dcd00b5febfb853a2c521ba8d9f2cbc2968a9c5787747b6f88
f723cc6e270fa155f6c9c9950393f5876a52ee93f22d77864b49bc3fc24a5fa3
f98da04e4fe7961d6187060290a6c399fd5b2ce7517585a046559a12b902ecff

www.kbydt.com Open in urlscan Pro 103.151.217.95 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

818 kBTransfer

2033 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 20 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

Indicators

www.kbydt.com Open in urlscan Pro
103.151.217.95 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

818 kB
Transfer

2033 kB
Size

0
Cookies

5 HTTP transactions
20 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!