fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 54.154.11.226, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net.
TLS certificate: Issued by Amazon on August 25th 2020. Valid for: a year.

This is the only time fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	54.154.11.226 54.154.11.226	16509 (AMAZON-02) (AMAZON-02)
1	2a02:4780:dea... 2a02:4780:dead:eca1::1	204915 (AWEX) (AWEX)
2 2	67.202.94.86 67.202.94.86	32748 (STEADFAST) (STEADFAST)
2	2606:4700:10:... 2606:4700:10::6816:4bab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	4

1 54.154.11.226 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-11-226.eu-west-1.compute.amazonaws.com

fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:4780:dead:eca1::1 (United States)

ASN204915 (AWEX, CY)

mexicamfree.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.202.94.86 (United States) 2 redirects

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)

widgets.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	amung.us 2 redirects whos.amung.us widgets.amung.us	3 KB
1	000webhostapp.com mexicamfree.000webhostapp.com	515 KB
1	webselfsite.net fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net	920 B
0	ta0onieehpuaorl.co Failed www.ta0onieehpuaorl.co Failed
5	4

	Domain	Requested by
2	widgets.amung.us
2	whos.amung.us	2 redirects
1	mexicamfree.000webhostapp.com	fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
1	fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
0	www.ta0onieehpuaorl.co Failed	fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
5	5

This site contains no links.

Subject Issuer	Validity	Valid
webself.net Amazon	`2020-08-25` - `2021-09-24`	a year	crt.sh
*.000webhostapp.com RapidSSL RSA CA 2018	`2019-06-11` - `2021-07-10`	2 years	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/ext/script/frame?f=&id=116741819&si=1947185
Frame ID: A144BAD9D208F4E5E324680B933CFABD
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

519 kB
Transfer

770 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://whos.amung.us/widget/w2dqrzdvp0 HTTP 307
https://widgets.amung.us/classic/00/1.png

Request Chain 4

https://whos.amung.us/widget/angentesmit1 HTTP 307
https://widgets.amung.us/classic/00/1.png

5 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set frame Show response
fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/ext/script/ 149 B
920 B 278ms
49ms Document
text/html 54.154.11.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/ext/script/frame?f=&id=116741819&si=1947185
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.11.226 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-11-226.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 451b23fbf577a90a77fe053f3430ca6b3fd678dc9eafda469e9c1ac48d8fa2c9

Request headers

Host: fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Cache-Control: private
Cache-control: no-cache="set-cookie"
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sat, 10 Apr 2021 01:25:10 GMT
Server: Microsoft-IIS/8.5
Set-Cookie: AWSELB=C595937910A6D3DDCB03BA275D7AADB7DC7BEB12DCA84F48300BB38F054C8E683109C714BE50AEC9D47297FB1F58756BCC1CA85BFF692A87A3CB07646AA0C3CDC34C0C7768;PATH=/ AWSELBCORS=C595937910A6D3DDCB03BA275D7AADB7DC7BEB12DCA84F48300BB38F054C8E683109C714BE50AEC9D47297FB1F58756BCC1CA85BFF692A87A3CB07646AA0C3CDC34C0C7768;PATH=/;SECURE;SAMESITE=None
Vary: Accept-Encoding
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Length: 234
Connection: keep-alive

GET
H2 200 s1.js Show response
mexicamfree.000webhostapp.com/bbbs01/ 715 KB
515 KB 344ms
108ms Script
application/javascript 2a02:4780:dead:eca1::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mexicamfree.000webhostapp.com/bbbs01/s1.js

Requested by

Host: fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
URL: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/ext/script/frame?f=&id=116741819&si=1947185

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:eca1::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

892a843b456aecac41778e97c14b308769f4f36c7197a110b9f861daa4f9fe5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 01:25:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Mar 2021 03:42:27 GMT
server: awex
content-type: application/javascript
x-xss-protection: 1; mode=block
x-request-id: b2a630d0a1b1ba1811841df601863c7a

GET location
www.ta0onieehpuaorl.co/008/ 0
0

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

1.png
widgets.amung.us/classic/00/
Redirect Chain

https://whos.amung.us/widget/w2dqrzdvp0
https://widgets.amung.us/classic/00/1.png

1 KB
2 KB

35ms
15ms

Image
image/png

2606:4700:10::6816:4bab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.amung.us/classic/00/1.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb1085e3b92d21a22e500f63551873329da9b10a2ad5aca8938aaac7385b4f3d

Request headers

Referer: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 01:25:15 GMT
cf-cache-status: HIT
age: 145395
content-length: 1349
cf-request-id: 095afb2a5200004a5bb6bc9000000001
last-modified: Sun, 13 Jun 2010 09:03:09 GMT
server: cloudflare
etag: "4c149ecd-545"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 63d82e23be914a5b-FRA
expires: Fri, 09 Apr 2021 09:02:00 GMT

Redirect headers

location: https://widgets.amung.us/classic/00/1.png
date: Sat, 10 Apr 2021 01:25:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8

GET
H2

200

1.png
widgets.amung.us/classic/00/
Redirect Chain

https://whos.amung.us/widget/angentesmit1
https://widgets.amung.us/classic/00/1.png

1 KB
1 KB

54ms
34ms

Image
image/png

2606:4700:10::6816:4bab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.amung.us/classic/00/1.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb1085e3b92d21a22e500f63551873329da9b10a2ad5aca8938aaac7385b4f3d

Request headers

Referer: https://fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 10 Apr 2021 01:25:15 GMT
cf-cache-status: HIT
age: 145395
content-length: 1349
cf-request-id: 095afb2a5200004a5ba38ca000000001
last-modified: Sun, 13 Jun 2010 09:03:09 GMT
server: cloudflare
etag: "4c149ecd-545"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 63d82e23be924a5b-FRA
expires: Fri, 09 Apr 2021 09:02:00 GMT

Redirect headers

location: https://widgets.amung.us/classic/00/1.png
date: Sat, 10 Apr 2021 01:25:15 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 51 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.ta0onieehpuaorl.co
URL: https://www.ta0onieehpuaorl.co/008/location

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/	1969-12-31 23:59:59	Name: AWSELBCORS Value: C595937910A6D3DDCB03BA275D7AADB7DC7BEB12DCA84F48300BB38F054C8E683109C714BE50AEC9D47297FB1F58756BCC1CA85BFF692A87A3CB07646AA0C3CDC34C0C7768
			fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net/	1969-12-31 23:59:59	Name: AWSELB Value: C595937910A6D3DDCB03BA275D7AADB7DC7BEB12DCA84F48300BB38F054C8E683109C714BE50AEC9D47297FB1F58756BCC1CA85BFF692A87A3CB07646AA0C3CDC34C0C7768

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]
console-api	log	URL: https://mexicamfree.000webhostapp.com/bbbs01/s1.js(Line 71) Message: [object HTMLScriptElement]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net
mexicamfree.000webhostapp.com
whos.amung.us
widgets.amung.us
www.ta0onieehpuaorl.co
www.ta0onieehpuaorl.co
2606:4700:10::6816:4bab
2a02:4780:dead:eca1::1
54.154.11.226
67.202.94.86
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
451b23fbf577a90a77fe053f3430ca6b3fd678dc9eafda469e9c1ac48d8fa2c9
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
892a843b456aecac41778e97c14b308769f4f36c7197a110b9f861daa4f9fe5e
bb1085e3b92d21a22e500f63551873329da9b10a2ad5aca8938aaac7385b4f3d

fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net Open in urlscan Pro 54.154.11.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

519 kBTransfer

770 kBSize

2 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

2 Cookies

6 Console Messages

Indicators

fdgdgfdgfdgf854dgf4d5gfd-07.webselfsite.net Open in urlscan Pro
54.154.11.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

519 kB
Transfer

770 kB
Size

2
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!