business-help-managers.com Open in urlscan Pro
89.185.84.236 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://business-help-managers.com/business-center-community/business
Submission: On October 29 via api (October 29th 2024, 1:30:38 am UTC) from US — Scanned from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 13 HTTP transactions. The main IP is 89.185.84.236, located in London, United Kingdom and belongs to GCS-AS, GB. The main domain is business-help-managers.com.
TLS certificate: Issued by R11 on October 25th 2024. Valid for: 3 months.

This is the only time business-help-managers.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
6	89.185.84.236 89.185.84.236	215540 (GCS-AS) (GCS-AS)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.74.195 142.250.74.195	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	7

6 89.185.84.236 (London, United Kingdom)

ASN215540 (GCS-AS, GB)
PTR: 39874-2.ip-ptr.tech

business-help-managers.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.74.195 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

freeipapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	business-help-managers.com business-help-managers.com	1 MB
2	gstatic.com fonts.gstatic.com	36 KB
1	freeipapi.com freeipapi.com — Cisco Umbrella Rank: 92786	933 B
1	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 967	6 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2041	156 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	25 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
13	7

	Domain	Requested by
6	business-help-managers.com	business-help-managers.com
2	fonts.gstatic.com	fonts.googleapis.com
1	freeipapi.com	business-help-managers.com
1	static.xx.fbcdn.net
1	api.ipify.org	business-help-managers.com
1	cdn.jsdelivr.net	business-help-managers.com
1	fonts.googleapis.com	business-help-managers.com
13	7

This site contains no links.

Subject Issuer	Validity	Valid
business-help-managers.com R11	`2024-10-25` - `2025-01-23`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
ipify.org WE1	`2024-09-15` - `2024-12-14`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-07` - `2024-11-05`	3 months	crt.sh
freeipapi.com Cloudflare Inc ECC CA-3	`2024-01-21` - `2024-12-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://business-help-managers.com/business-center-community/business
Frame ID: AD251CBBE5F21AA812A9D8132B156857
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Buiness Help Center

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

1221 kB
Transfer

1355 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request business Show response
business-help-managers.com/business-center-community/ 1 KB
919 B 1178ms
81ms Document
text/html 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://business-help-managers.com/business-center-community/business
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 10439e6f272c0ea292cae2e1d41bf475c98a951ef037a08fae8f5f43c6620a61

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 29 Oct 2024 01:30:27 GMT
ETag: W/"671b9420-45f"
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 194ms
73ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Requested by

Host: business-help-managers.com
URL: https://business-help-managers.com/business-center-community/business

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7ac45629a2939c00a0db5d8e98afc10238c1361fd75419c85401f200478b3ebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 29 Oct 2024 01:30:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 29 Oct 2024 01:30:28 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Tue, 29 Oct 2024 01:21:36 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ 152 KB
25 KB 160ms
41ms Stylesheet
text/css 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

Requested by

Host: business-help-managers.com
URL: https://business-help-managers.com/business-center-community/business

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://business-help-managers.com
Referer: https://business-help-managers.com/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
age: 2902769
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Tue, 29 Oct 2024 01:30:28 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230097-FRA, cache-lcy-eglc8600061-LCY
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25360
x-jsd-version: 5.0.2

GET
H/1.1 200
OK main.832e1d6f.css
business-help-managers.com/static/css/ 1 KB
919 B 69ms
41ms Stylesheet
text/html 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://business-help-managers.com/static/css/main.832e1d6f.css
Requested by: Host: business-help-managers.com
URL: https://business-help-managers.com/business-center-community/business
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 10439e6f272c0ea292cae2e1d41bf475c98a951ef037a08fae8f5f43c6620a61

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/business-center-community/business

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
ETag: W/"671b9420-45f"
Connection: keep-alive
Date: Tue, 29 Oct 2024 01:30:28 GMT
Content-Type: text/html
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK bundle.js Show response
business-help-managers.com/ 754 KB
755 KB 140ms
69ms Script
application/javascript 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://business-help-managers.com/bundle.js
Requested by: Host: business-help-managers.com
URL: https://business-help-managers.com/business-center-community/business
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 9e8ab19529d9de4c7bfe51ca1a7e8c11b1609b0c7c7300d023c47b1efaf6f00e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/business-center-community/business

Response headers

ETag: "671b9420-bc97d"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 772477
Date: Tue, 29 Oct 2024 01:30:28 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H2 200 / Show response
api.ipify.org/ 23 B
156 B 496ms
159ms XHR
application/json 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: business-help-managers.com
URL: https://business-help-managers.com/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9256a09334c7beae652511fb13e9b36c4dbefa14468f77e0589d5946ec6c9aff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://business-help-managers.com/

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8d9f66916b59cd26-LHR
access-control-allow-origin: *
content-length: 23
date: Tue, 29 Oct 2024 01:30:30 GMT
content-type: application/json
vary: Origin
server: cloudflare

GET
H/1.1 200
OK d42fe85024cd6936fb43a241e083e5b3.png
business-help-managers.com/ 31 KB
31 KB 76ms
72ms Image
image/png 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://business-help-managers.com/d42fe85024cd6936fb43a241e083e5b3.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 5da69e13d11124b421ba77038093fcf8196e57bbede9a640190cad9e5c2c1717

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/business-center-community/business

Response headers

ETag: "671b9420-7ccb"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 31947
Date: Tue, 29 Oct 2024 01:30:29 GMT
Content-Type: image/png
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK 913f4cdb1dc234a4f5523184e9416cce.png
business-help-managers.com/ 2 KB
2 KB 61ms
57ms Image
image/png 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://business-help-managers.com/913f4cdb1dc234a4f5523184e9416cce.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: b33cb32e30cf5aff200a5d6c3a60e95521bd82aecac352f9e8f1a9734503559c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/business-center-community/business

Response headers

ETag: "671b9420-7d4"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2004
Date: Tue, 29 Oct 2024 01:30:29 GMT
Content-Type: image/png
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK 1f85623d06212e6d3ed4016dc123dc05.png
business-help-managers.com/ 361 KB
361 KB 159ms
96ms Image
image/png 89.185.84.236
GCS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://business-help-managers.com/1f85623d06212e6d3ed4016dc123dc05.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.185.84.236 London, United Kingdom, ASN215540 (GCS-AS, GB),
Reverse DNS: 39874-2.ip-ptr.tech
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4f83d8067197a3421cebdad0a99baf4119a6146e84a11a468db279f57270784e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/business-center-community/business

Response headers

ETag: "671b9420-5a3dd"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 369629
Date: Tue, 29 Oct 2024 01:30:29 GMT
Content-Type: image/png
Last-Modified: Fri, 25 Oct 2024 12:50:40 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 329ms
71ms Font
font/woff2 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://business-help-managers.com
Referer: https://fonts.googleapis.com/

Response headers

age: 550845
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:29:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:29:44 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 331ms
80ms Font
font/woff2 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://business-help-managers.com
Referer: https://fonts.googleapis.com/

Response headers

age: 585089
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 06:59:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 06:59:00 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H2 200 hLRJ1GG_y0J.ico
static.xx.fbcdn.net/rsrc.php/yb/r/ 4 KB
6 KB 294ms
75ms Other
image/x-icon 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/yb/r/hLRJ1GG_y0J.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://business-help-managers.com/

Response headers

content-md5: jN3KQn2um5Jec0MvhzPgWg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 17 Oct 2025 01:42:04 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 01:30:30 GMT
content-type: image/x-icon
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 3aE/kaV38FyZdNFM1dpuJrVjCdtHVay1SMrgVmpqxpQuWYivZMj5QapL5Ju6sVh+RwHApKt6AUj73saBz8O3SQ==
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=15, mss=1297, tbw=2926, tp=-1, tpl=-1, uplat=2, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 0
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 4286
origin-agent-cluster: ?1

GET
H3 200 130.180.200.35 Show response
freeipapi.com/api/json/ 427 B
933 B 352ms
221ms XHR
application/json 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freeipapi.com/api/json/130.180.200.35
Requested by: Host: business-help-managers.com
URL: https://business-help-managers.com/bundle.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.3.11
Resource Hash: 1ececae1809b391f4136c87ef5cd6b63c77e13d497e660a49ee71747c95ec9e1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://business-help-managers.com/

Response headers

cache-control: no-cache, private
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPOA5hC51sLGBq%2BjkckWCQ31xUylx2bQJ8wMn%2FF9H%2BASaRT97jNM5UDBJGqxFesZLmoaGLgUZjBIkEDFcTZduQ9U4FMvHRn2O5Vu9FTILJSZFcSSRExzNgyeUGTgTX83"}],"group":"cf-nel","max_age":604800}
x-ratelimit-remaining: 59
cf-ray: 8d9f6693880994e7-LHR
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22257&sent=12&recv=8&lost=0&retrans=0&sent_bytes=3992&recv_bytes=4377&delivery_rate=131079&cwnd=12000&unsent_bytes=0&cid=be78a0924b17de1b&ts=136&x=1", cfHdrFlush;dur=0
date: Tue, 29 Oct 2024 01:30:30 GMT
x-ratelimit-limit: 60
content-type: application/json
x-powered-by: PHP/8.3.11
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://business-help-managers.com/business-center-community/business Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
business-help-managers.com
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
freeipapi.com
static.xx.fbcdn.net
142.250.74.195
172.67.74.152
188.114.97.3
2a00:1450:4001:831::200a
2a03:2880:f084:105:face:b00c:0:3
2a04:4e42:200::485
89.185.84.236
10439e6f272c0ea292cae2e1d41bf475c98a951ef037a08fae8f5f43c6620a61
1ececae1809b391f4136c87ef5cd6b63c77e13d497e660a49ee71747c95ec9e1
4f83d8067197a3421cebdad0a99baf4119a6146e84a11a468db279f57270784e
5da69e13d11124b421ba77038093fcf8196e57bbede9a640190cad9e5c2c1717
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7ac45629a2939c00a0db5d8e98afc10238c1361fd75419c85401f200478b3ebb
89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
9256a09334c7beae652511fb13e9b36c4dbefa14468f77e0589d5946ec6c9aff
9e8ab19529d9de4c7bfe51ca1a7e8c11b1609b0c7c7300d023c47b1efaf6f00e
b33cb32e30cf5aff200a5d6c3a60e95521bd82aecac352f9e8f1a9734503559c
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

business-help-managers.com Open in urlscan Pro 89.185.84.236 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

43 %IPv6

7 Domains

7 Subdomains

7 IPs

4 Countries

1221 kBTransfer

1355 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

business-help-managers.com Open in urlscan Pro
89.185.84.236 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

1221 kB
Transfer

1355 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!