ravenukt.herokuapp.com
Open in
urlscan Pro
23.22.130.173
Malicious Activity!
Public Scan
URL:
https://ravenukt.herokuapp.com/index.php?id=l_HHBeKPoc&instagram-login=
Submission: On June 26 via automatic, source openphish — Scanned from DE
Submission: On June 26 via automatic, source openphish — Scanned from DE
Summary
This website contacted 4 IPs
in 2 countries
across 4 domains to perform 30 HTTP transactions.
The main IP is 23.22.130.173, located in
Ashburn, United States and
belongs to AMAZON-AES, US.
The main domain is ravenukt.herokuapp.com.
TLS certificate: Issued by Amazon on May 2nd 2022. Valid for: a year.
This is the only time ravenukt.herokuapp.com was scanned on urlscan.io!
TLS certificate: Issued by Amazon on May 2nd 2022. Valid for: a year.
This is the only time ravenukt.herokuapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 19 | 23.22.130.173 23.22.130.173 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 2 | 2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
| 2 | 2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
| 30 | 4 |
19
23.22.130.173
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-130-173.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-130-173.compute-1.amazonaws.com
| ravenukt.herokuapp.com |
2
2a03:2880:f02d:100:face:b00c:0:3
(Frankfurt am Main, Germany)
ASN32934 (FACEBOOK, US)
ASN32934 (FACEBOOK, US)
| connect.facebook.net |
2
2a03:2880:f11c:8183:face:b00c:0:25de
(Frankfurt am Main, Germany)
ASN32934 (FACEBOOK, US)
ASN32934 (FACEBOOK, US)
| www.facebook.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 19 |
herokuapp.com
ravenukt.herokuapp.com |
136 KB |
| 2 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 96 |
388 B |
| 2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 155 |
110 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 30 | 4 |
| Domain | Requested by | |
|---|---|---|
| 19 | ravenukt.herokuapp.com |
ravenukt.herokuapp.com
|
| 2 | www.facebook.com |
ravenukt.herokuapp.com
|
| 2 | connect.facebook.net |
ravenukt.herokuapp.com
connect.facebook.net |
| 0 | jnkdcmgmnegofdddphijckfagibepdlb Failed |
ravenukt.herokuapp.com
|
| 30 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.instagram.com |
| itunes.apple.com |
| play.google.com |
| www.microsoft.com |
| help.instagram.com |
| blog.instagram.com |
| instagram-press.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.herokuapp.com Amazon |
2022-05-02 - 2023-05-31 |
a year | crt.sh |
| *.facebook.com DigiCert SHA2 High Assurance Server CA |
2022-04-04 - 2022-07-03 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://ravenukt.herokuapp.com/index.php?id=l_HHBeKPoc&instagram-login=
Frame ID: C8E35EDB6E0F48CDA0EA4454BD35622B
Requests: 29 HTTP requests in this frame
Frame:
https://ravenukt.herokuapp.com/lY4eZXm_YWu.html
Frame ID: F4B52C4E082269BDD079DAE6D0517D39
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
InstagramDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Heroku
(PaaS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.herokuapp\.com
Facebook
(Widgets)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
URL: https://www.instagram.com/accounts/password/reset/
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/app/instagram/id389801252?pt=428156&ct=igweb.loginPage.badge&mt=8
Search URL Search Domain Scan URL
URL: https://play.google.com/store/apps/details?id=com.instagram.android&referrer=utm_source%3Dinstagramweb%26utm_campaign%3DloginPage%26utm_medium%3Dbadge
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-us/store/apps/instagram/9nblggh5l9xt
Search URL Search Domain Scan URL
URL: https://www.instagram.com/about/us/
Title: About us
Title: About us
Search URL Search Domain Scan URL
URL: https://help.instagram.com/
Title: Support
Title: Support
Search URL Search Domain Scan URL
URL: http://blog.instagram.com/
Title: Blog
Title: Blog
Search URL Search Domain Scan URL
URL: https://instagram-press.com/
Title: Press
Title: Press
Search URL Search Domain Scan URL
URL: https://www.instagram.com/developer/
Title: API
Title: API
Search URL Search Domain Scan URL
URL: https://www.instagram.com/about/jobs/
Title: Jobs
Title: Jobs
Search URL Search Domain Scan URL
URL: https://www.instagram.com/legal/privacy/
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: https://www.instagram.com/legal/terms/
Title: Terms
Title: Terms
Search URL Search Domain Scan URL
URL: https://www.instagram.com/explore/locations/
Title: Directory
Title: Directory
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
ravenukt.herokuapp.com/ |
133 KB 133 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b67d172d5783.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
100 KB 26 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sdk.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aafd8c6b005d.jpg
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2d9d7248af43.jpg
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
629d23a3c7b2.jpg
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
001bc33056c1.jpg
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
f5ae123ab1e2.jpg
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
4b70f6fae447.png
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
f06b908907d5.png
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
f55c258e826e.png
ravenukt.herokuapp.com/.images/ |
199 B 199 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
d1f0f06b39df.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
96f2557117a2.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
f9e5c0ca0804.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
8e2c2a606042.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
bootstrap.min.js
jnkdcmgmnegofdddphijckfagibepdlb/bootstrap/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
jszip-utils.js
jnkdcmgmnegofdddphijckfagibepdlb/savejs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
jszip.js
jnkdcmgmnegofdddphijckfagibepdlb/savejs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
FileSaver.js
jnkdcmgmnegofdddphijckfagibepdlb/savejs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
inject_download_all.js
jnkdcmgmnegofdddphijckfagibepdlb/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
helpBar.js
jnkdcmgmnegofdddphijckfagibepdlb/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
dash.all.min.js
jnkdcmgmnegofdddphijckfagibepdlb/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
38825c9d5aa2.png
ravenukt.herokuapp.com/static/images/homepage/home-phones.png/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb48443ec9d3.png
ravenukt.herokuapp.com/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b67d172d5783.js.download
ravenukt.herokuapp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lY4eZXm_YWu.html
ravenukt.herokuapp.com/ Frame F4B5 |
196 B 381 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1425767024389221
connect.facebook.net/signals/config/ |
288 KB 84 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
www.facebook.com/tr/ |
44 B 297 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
/
www.facebook.com/tr/ |
44 B 91 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/bootstrap/js/bootstrap.min.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/savejs/jszip-utils.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/savejs/jszip.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/savejs/FileSaver.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/inject_download_all.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/helpBar.js
- Domain
- jnkdcmgmnegofdddphijckfagibepdlb
- URL
- chrome-extension://jnkdcmgmnegofdddphijckfagibepdlb/js/dash.all.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| __bufferedPerformance object| _sharedData function| webpackJsonp function| fbq function| _fbq3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| ravenukt.herokuapp.com/ | Name: PHPSESSID Value: sfdvh4tvpc9d8nikjv7qo92dr7niomhg |
|
| ravenukt.herokuapp.com/ | Name: tg_id Value: 5022471639 |
|
| .ravenukt.herokuapp.com/ | Name: _fbp Value: fb.2.1656248839069.1831164905 |
25 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.facebook.net
jnkdcmgmnegofdddphijckfagibepdlb
ravenukt.herokuapp.com
www.facebook.com
jnkdcmgmnegofdddphijckfagibepdlb
23.22.130.173
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
3b809b688e12358260c6580fd0e45744ffe055b4e403e295450bebc43d3be023
3d79854e01d0c79408c548889dcfddd23e4ef10f11c698c831b570573ee13b97
5b13fb5957b84ef7bb9d0b6cd509c947ff6a37d67efdac2b896ddd3b908aad10
60db3b88bd26e12966b560482b3f342410e546d67ebeeb1860b98a5c6cb1f2d6
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880