![](/screenshots/4876ffb8-bcab-4aaa-8190-4496dfdcab65.png)
imettelpan.com
Open in
urlscan Pro
85.17.80.5
Malicious Activity!
Public Scan
Effective URL: https://imettelpan.com/click.php?key=5e5fa4ib1qzcefvwlvuh&click_id=v2-1658349685395-4-8914-1134035-c7ad2109-c045-c1a2-3...
Submission Tags: falconsandbox
Submission: On July 20 via api from US — Scanned from NL
Summary
TLS certificate: Issued by R3 on June 19th 2022. Valid for: 3 months.
This is the only time imettelpan.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Apple Software Update (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 185.177.92.147 185.177.92.147 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
1 1 | 2001:978:2:2c... 2001:978:2:2c::1ee:198 | 174 (COGENT-174) (COGENT-174) | |
12 | 85.17.80.5 85.17.80.5 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
13 | 2 |
ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-92-147.ah-server.com
us07.biz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
imettelpan.com
imettelpan.com |
152 KB |
2 |
us07.biz
2 redirects
us07.biz |
666 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 303 |
30 KB |
1 |
pushnow.net
1 redirects
eu.pushnow.net — Cisco Umbrella Rank: 108210 |
387 B |
13 | 4 |
Domain | Requested by | |
---|---|---|
12 | imettelpan.com |
imettelpan.com
|
2 | us07.biz | 2 redirects |
1 | ajax.googleapis.com |
imettelpan.com
|
1 | eu.pushnow.net | 1 redirects |
13 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
imettelpan.com R3 |
2022-06-19 - 2022-09-17 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-06-27 - 2022-09-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://imettelpan.com/click.php?key=5e5fa4ib1qzcefvwlvuh&click_id=v2-1658349685395-4-8914-1134035-c7ad2109-c045-c1a2-34cf-fe0f4d0457e9&price=0.0012&sub1=9ad2ddf7d4eed845dd366cdaf6c059c5&sub2=0.0012&sub3=8914&c=EKOEYJejkz9Q524KbSOyXptVoao%3D&2=2
Frame ID: BCE622E6F88CDE5FDBE64C170549E4CB
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/4876ffb8-bcab-4aaa-8190-4496dfdcab65.png)
Page Title
PROTECT YOUR PC!Page URL History Show full URLs
-
https://us07.biz/?cc=cd5ac8e6-47e5-4cb7-b85e-ef499e81f6c2&sid=edvltf
HTTP 302
https://us07.biz/?auf=mq2dmzbzgu5dclzrguys6mjpge3dkobtgq4tmobv&s=1 HTTP 302
https://eu.pushnow.net/postback/click?key=v2-1658349685395-4-8914-1134035-c7ad2109-c045-c1a2-34cf-f... HTTP 302
https://imettelpan.com/click.php?key=5e5fa4ib1qzcefvwlvuh&click_id=v2-1658349685395-4-8914-1134035-... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://us07.biz/?cc=cd5ac8e6-47e5-4cb7-b85e-ef499e81f6c2&sid=edvltf
HTTP 302
https://us07.biz/?auf=mq2dmzbzgu5dclzrguys6mjpge3dkobtgq4tmobv&s=1 HTTP 302
https://eu.pushnow.net/postback/click?key=v2-1658349685395-4-8914-1134035-c7ad2109-c045-c1a2-34cf-fe0f4d0457e9 HTTP 302
https://imettelpan.com/click.php?key=5e5fa4ib1qzcefvwlvuh&click_id=v2-1658349685395-4-8914-1134035-c7ad2109-c045-c1a2-34cf-fe0f4d0457e9&price=0.0012&sub1=9ad2ddf7d4eed845dd366cdaf6c059c5&sub2=0.0012&sub3=8914&c=EKOEYJejkz9Q524KbSOyXptVoao%3D&2=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
click.php
imettelpan.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
imettelpan.com/landers/blue_white_2/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
imettelpan.com/landers/blue_white_2/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-logo.jpg
imettelpan.com/landers/blue_white_2/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
search.png
imettelpan.com/landers/blue_white_2/ |
631 B 869 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
win-overlay.png
imettelpan.com/landers/blue_white_2/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dreq.png
imettelpan.com/landers/blue_white_2/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cross.png
imettelpan.com/landers/blue_white_2/ |
344 B 582 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tick.png
imettelpan.com/landers/blue_white_2/ |
381 B 619 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ajax2.gif
imettelpan.com/landers/blue_white_2/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.png
imettelpan.com/landers/blue_white_2/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.mp3
imettelpan.com/landers/blue_white_2/ |
16 KB 16 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Apple Software Update (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| getURLParameter object| w object| m object| td6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
eu.pushnow.net/postback | Name: platform_user_id Value: desktop:7c09a3f74708c581b22dba6a98f3e699 |
|
eu.pushnow.net/postback | Name: platform_user_id_3rd_party Value: desktop:7c09a3f74708c581b22dba6a98f3e699 |
|
.us07.biz/ | Name: uuid Value: b8dfe78d-cb95-449f-9beb-e620ac018297 |
|
us07.biz/ | Name: uuid Value: b8dfe78d-cb95-449f-9beb-e620ac018297 |
|
imettelpan.com/ | Name: uclick Value: 8rir46oji4 |
|
imettelpan.com/ | Name: uclickhash Value: 8rir46oji4-8rir46oji4-j6k2-pmbgwj-heuqfe-8wa1vr-8wa1i4-3b0748 |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
eu.pushnow.net
imettelpan.com
us07.biz
185.177.92.147
2001:978:2:2c::1ee:198
2a00:1450:4001:829::200a
85.17.80.5
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
37e0435378f92ff39e2cea7b04e01b3d55430ecf53edd90c2288edfe12eadd55
3d520d6c4219bd80b31b9607f51622a3b2980eac46e149216ed5348cc7d74855
52a7718ac2ff3d6eae2959273c97910d585cb6d175c3e06685e341f091deb585
562b29e08c7d623d3604b9fce91a6715c5f3d14ce62fee4e3c806b72528402ce
5a54ff1f189090954bc51ef197b0c3615cda8a5473466253db5acdf4451f1878
655e75b5f9a75e8aac6a6b7da84720daae348194b525518e4b47b5c580b0b316
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8e65c9d3060370944dfd7cbd20cb45952d6d0b40c1a742b2b2048e6d6e475682
8f353892cfafea3aea0577c45d1d393c42a9d771ac069922151c94396209d527
9b1192a77adc835c1665f249fd08384d10a447271925e6d81fcdc8fdfba7771e
a4b2b465b45b670914e799ffc44f0a237e59b0a8957b20c7c95f77bc81212b6b
ed5ffc658eaf4e04edf3c08a94d35ff7bee0c5be95eda88bcb60c239986c5c2c