asdxasq.easy.co Open in urlscan Pro
2406:da18:d33:5c01::1000  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response asdxasq.easy.co/	853 B 944 B	959ms 464ms	Document text/html	2406:da18:d33:5c01::1000 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://asdxasq.easy.co/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2406:da18:d33:5c01::1000 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / PHP/7.4.15 Resource Hash 1e1ebe08ff8f05a36aa61dd219cc0859125a59c901e520994122a7838c7d225c Security Headers Name Value Strict-Transport-Security max-age=864000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority asdxasq.easy.co :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx date Fri, 16 Jul 2021 17:35:27 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.15 cache-control no-cache, no-store, private set-cookie XSRF-TOKEN=r3fcorhbxsOJ53bmv1V54PO8V9dz51V3Txrv2qca; expires=Fri, 16-Jul-2021 19:35:27 GMT; Max-Age=7200; path=/ _easystore_z=68MiBMCkWq4HwCJpdWJAEhn9I7ggPOJ3PbbzKQy2; path=/; httponly _landing_page=%252F; expires=Fri, 30-Jul-2021 17:35:27 GMT; Max-Age=1209600; path=/; httponly content-encoding gzip strict-transport-security max-age=864000 x-xss-protection 1; mode=block x-content-type-options nosniff
GET H2	200	/ Show response mega-scripts.club/	239 KB 83 KB	1012ms 540ms	Script text/html	64.90.44.156 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://mega-scripts.club/?token=0a81f2510cdf2174bfaa67bd5a10c7d8 Requested by Host: asdxasq.easy.co URL: https://asdxasq.easy.co/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 64.90.44.156 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-noxim.sthelens.dreamhost.com Software Apache / Resource Hash 5339915ffcf77bb79be1c0c1523e0e08abc79159f39fd16151df15332691f819 Request headers Referer https://asdxasq.easy.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Fri, 16 Jul 2021 17:35:28 GMT content-encoding gzip server Apache vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0, max-age=600 expires Fri, 16 Jul 2021 17:45:28 GMT
GET H2	200	/ whos.amung.us/pingjs/	27 B 27 B	325ms 108ms	Image text/javascript	67.202.114.212 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=coronaord&t=Blacksar%20Inc.&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=8174 Requested by Host: asdxasq.easy.co URL: https://asdxasq.easy.co/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.212 Crown Point, United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://asdxasq.easy.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Jul 2021 17:35:29 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	51 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| d object| dom string| back boolean| ignoreHistoryChange boolean| ignoreHashChange string| kon object| _$_f395 string| head string| bod

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			asdxasq.easy.co/	1970-01-19 20:07:46	Name: _landing_page Value: %252F
			asdxasq.easy.co/	1969-12-31 23:59:59	Name: _easystore_z Value: 68MiBMCkWq4HwCJpdWJAEhn9I7ggPOJ3PbbzKQy2
			asdxasq.easy.co/	1970-01-19 19:47:44	Name: XSRF-TOKEN Value: r3fcorhbxsOJ53bmv1V54PO8V9dz51V3Txrv2qca

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=864000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

asdxasq.easy.co
mega-scripts.club
whos.amung.us
2406:da18:d33:5c01::1000
64.90.44.156
67.202.114.212
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
1e1ebe08ff8f05a36aa61dd219cc0859125a59c901e520994122a7838c7d225c
5339915ffcf77bb79be1c0c1523e0e08abc79159f39fd16151df15332691f819
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855