identityverification.click
Open in
urlscan Pro
34.132.103.26
Malicious Activity!
Public Scan
Submission: On October 03 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 28th 2022. Valid for: 3 months.
This is the only time identityverification.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 34.132.103.26 34.132.103.26 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 18.209.232.133 18.209.232.133 | 14618 (AMAZON-AES) (AMAZON-AES) | |
11 | 2 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 26.103.132.34.bc.googleusercontent.com
identityverification.click |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-209-232-133.compute-1.amazonaws.com
ipgeolocation.abstractapi.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
identityverification.click
identityverification.click |
701 KB |
1 |
abstractapi.com
ipgeolocation.abstractapi.com — Cisco Umbrella Rank: 75738 |
1 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | identityverification.click |
identityverification.click
|
1 | ipgeolocation.abstractapi.com |
identityverification.click
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
identityconfirmationguide.click R3 |
2022-06-28 - 2022-09-26 |
3 months | crt.sh |
ipgeolocation.abstractapi.com Amazon |
2022-05-23 - 2023-06-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://identityverification.click/
Frame ID: 29997054E458AFF92F4396BD85FBB0EC
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
FacebookDetected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
identityverification.click/ |
8 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
identityverification.click/lib/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
screen-width-450.css
identityverification.click/lib/css/reponsives/ |
421 B 658 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.css
identityverification.click/lib/css/ |
35 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.6.0.min.js
identityverification.click/lib/js/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.js
identityverification.click/lib/js/ |
517 KB 517 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
identityverification.click/lib/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner.jpg
identityverification.click/lib/images/ |
32 KB 32 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.png
identityverification.click/lib/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
steps-icons.png
identityverification.click/lib/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipgeolocation.abstractapi.com/v1/ |
996 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
identityverification.click
ipgeolocation.abstractapi.com
18.209.232.133
34.132.103.26
2bfc323edb7fa8f62fd06704f830b1c6d320b97c5d5ad95a645dc78133e9ea58
3fa75fd1e33bb2d5661b01cf19410b405750bc605bf771f634c1c183166407bc
4c1fc7dff64683a5905ee1b02542996a7a326050a05f2b4c72897c5fae069106
6be163cd314eb27b661d65186624e37d94052f60f34de7b9bfe2af36c64805ed
84e75d4c10f393751296a25633354568ea457f33273b8b30a2a83343a368fa0a
8956b37adc46f5a131257c12cf598bc6ac255c33a489fb02262d81f6d6d141df
9fa3b26f18d6f666bf192665bdc287c656ca917c2af7671c3009075057d579a7
9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514
a051398ec3ac8076cec38cda70bbc5504fb8ddb31db558bf036a363381c01074
bfa7cf7d62cc25c9dd34fa448b199a7cad9dc54bf98cb9e6ac72c3b76967ed80
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e