boratrabalharr.com - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 129.121.37.200, located in United States and belongs to ASMALLORANGE1, US. The main domain is boratrabalharr.com.

This is the only time boratrabalharr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	129.121.37.200 129.121.37.200	62729 (ASMALLORA...) (ASMALLORANGE1)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
6	4

3 129.121.37.200 (United States)

ASN62729 (ASMALLORANGE1, US)
PTR: skwisgaar.seoboxes.com

boratrabalharr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	boratrabalharr.com boratrabalharr.com	29 KB
1	fbcdn.net static.xx.fbcdn.net
1	facebook.com facebook.com	221 B
1	jquery.com code.jquery.com	30 KB
6	4

	Domain	Requested by
3	boratrabalharr.com	boratrabalharr.com
1	static.xx.fbcdn.net	boratrabalharr.com
1	facebook.com	boratrabalharr.com
1	code.jquery.com	boratrabalharr.com
6	4

This site contains no links.

Subject Issuer	Validity	Valid
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Frame ID: 42D65EB7E0D4605F798845D0CD174907
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

50 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

59 kB
Transfer

183 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index1.php Show response
boratrabalharr.com/video04/ 8 KB
3 KB 368ms
324ms Document
text/html 129.121.37.200
ASMALLORANGE1

General

Check archive.org

Show headers Download Go to

Full URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Protocol: HTTP/1.1
Server: 129.121.37.200 , United States, ASN62729 (ASMALLORANGE1, US),
Reverse DNS: skwisgaar.seoboxes.com
Software: nginx/1.14.0 /
Resource Hash: 12924a76dc8d84c4870f15bc425189647f249efc9d7841cb22d324ecee8bab0c

Request headers

Host: boratrabalharr.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.14.0
Date: Fri, 28 Feb 2020 14:35:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

GET
H/1.1 200
OK style.css
boratrabalharr.com/video04/css/ 76 KB
21 KB 128ms
123ms Stylesheet
text/css 129.121.37.200
ASMALLORANGE1

General

Check archive.org

Show headers Download Go to

Full URL: http://boratrabalharr.com/video04/css/style.css
Requested by: Host: boratrabalharr.com
URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Protocol: HTTP/1.1
Server: 129.121.37.200 , United States, ASN62729 (ASMALLORANGE1, US),
Reverse DNS: skwisgaar.seoboxes.com
Software: nginx/1.14.0 /
Resource Hash: 64c6dced37310418be45912643f2064474d04b502b33634bb062ce43af72181f

Request headers

Origin: http://boratrabalharr.com
Referer: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 14:35:57 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Feb 2020 18:01:49 GMT
Server: nginx/1.14.0
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/css

GET
H/1.1 200
OK style2.css
boratrabalharr.com/video04/css/ 13 KB
4 KB 239ms
225ms Stylesheet
text/css 129.121.37.200
ASMALLORANGE1

General

Check archive.org

Show headers Download Go to

Full URL: http://boratrabalharr.com/video04/css/style2.css
Requested by: Host: boratrabalharr.com
URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Protocol: HTTP/1.1
Server: 129.121.37.200 , United States, ASN62729 (ASMALLORANGE1, US),
Reverse DNS: skwisgaar.seoboxes.com
Software: nginx/1.14.0 /
Resource Hash: f0abaf30e814c47677a28b4c3d27eb3e100458308934d3e522d3f8470682f85e

Request headers

Origin: http://boratrabalharr.com
Referer: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 14:35:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Feb 2020 18:01:49 GMT
Server: nginx/1.14.0
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/css

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 31ms
7ms Script
application/javascript 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: boratrabalharr.com
URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 28 Feb 2020 14:35:57 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: W/"5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1582900557.dop008.fr8.t,1582900557.cds060.fr8.shn,1582900557.cds060.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
221 B 38ms
37ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Host: boratrabalharr.com
URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: Nt8AJfgDxgungh9N5G+xXDEWdrHxBF7i3s2HG90dK5Kmp9+zjk93BAX7rBgaqiNbeTeCq3oqcz0RUtOTNZ9h6A==
expires: Sat, 01 Jan 2000 00:00:00 GMT
date: Fri, 28 Feb 2020 14:35:57 GMT, Fri, 28 Feb 2020 14:35:57 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET
H2 404 mM5QXt4jedV.png
static.xx.fbcdn.net/rsrc.php/v3/yd/r/ 0
0 39ms
37ms Image
text/html 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/mM5QXt4jedV.png
Requested by: Host: boratrabalharr.com
URL: http://boratrabalharr.com/video04/index1.php?t=bdf678a01126892111cb9a8e373eb612
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://boratrabalharr.com/video04/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

boratrabalharr.com
code.jquery.com
facebook.com
static.xx.fbcdn.net
129.121.37.200
2001:4de0:ac19::1:b:1a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
12924a76dc8d84c4870f15bc425189647f249efc9d7841cb22d324ecee8bab0c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
64c6dced37310418be45912643f2064474d04b502b33634bb062ce43af72181f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0abaf30e814c47677a28b4c3d27eb3e100458308934d3e522d3f8470682f85e

boratrabalharr.com Open in urlscan Pro 129.121.37.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

59 kBTransfer

183 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

boratrabalharr.com Open in urlscan Pro
129.121.37.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

59 kB
Transfer

183 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!