update-1009132075871.dvrlists.com Open in urlscan Pro
103.59.94.188  Malicious Activity! Public Scan

URL: http://update-1009132075871.dvrlists.com/
Submission: On June 06 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 103.59.94.188, located in Indonesia and belongs to IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID. The main domain is update-1009132075871.dvrlists.com.
This is the only time update-1009132075871.dvrlists.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
9 103.59.94.188 136052 (IDNIC-IDC...)
1 2a00:1450:400... 15169 (GOOGLE)
10 2
Apex Domain
Subdomains
Transfer
9 dvrlists.com
update-1009132075871.dvrlists.com
166 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 70
862 B
10 2
Domain Requested by
9 update-1009132075871.dvrlists.com update-1009132075871.dvrlists.com
1 fonts.googleapis.com update-1009132075871.dvrlists.com
10 2

This site contains no links.

Subject Issuer Validity Valid
upload.video.google.com
WR2
2024-05-21 -
2024-08-13
3 months crt.sh

This page contains 1 frames:

Primary Page: http://update-1009132075871.dvrlists.com/
Frame ID: B74B3A901A189078AF56ED98727C5DCA
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Facebook

Page URL History Show full URLs

  1. http://update-1009132075871.dvrlists.com/ HTTP 307
    https://update-1009132075871.dvrlists.com/ HTTP 307
    http://update-1009132075871.dvrlists.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]*class="ant-(?:btn|col|row|layout|breadcrumb|menu|pagination|steps|select|cascader|checkbox|calendar|form|input-number|input|mention|rate|radio|slider|switch|tree-select|time-picker|transfer|upload|avatar|badge|card|carousel|collapse|list|popover|tooltip|table|tabs|tag|timeline|tree|alert|modal|message|notification|progress|popconfirm|spin|anchor|back-top|divider|drawer)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

10 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

167 kB
Transfer

764 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://update-1009132075871.dvrlists.com/ HTTP 307
    https://update-1009132075871.dvrlists.com/ HTTP 307
    http://update-1009132075871.dvrlists.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
update-1009132075871.dvrlists.com/
Redirect Chain
  • http://update-1009132075871.dvrlists.com/
  • https://update-1009132075871.dvrlists.com/
  • http://update-1009132075871.dvrlists.com/
11 KB
3 KB
Document
General
Full URL
http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
fd465dc0355174da176f80b3fed2c34905a08c911679cab1dd7b54a9cae2513b

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
connection
Keep-Alive
content-encoding
gzip
content-length
3176
content-type
text/html
date
Thu, 06 Jun 2024 15:32:47 GMT
etag
"2c22-65d7cd20-13b065;gz"
last-modified
Thu, 22 Feb 2024 22:39:28 GMT
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

Location
http://update-1009132075871.dvrlists.com/
Non-Authoritative-Reason
HttpsUpgrades
styles.css
update-1009132075871.dvrlists.com/asset/
10 KB
2 KB
Stylesheet
General
Full URL
http://update-1009132075871.dvrlists.com/asset/styles.css
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
f39266151ffccfe3a425ae17a6fb51671466df765081a6fe0738d5dab53c2bc6

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:27:42 GMT
server
LiteSpeed
etag
"2663-65d7ca5e-13b063;gz"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
1841
expires
Thu, 13 Jun 2024 15:32:48 GMT
chunk1.css
update-1009132075871.dvrlists.com/asset/
58 KB
13 KB
Stylesheet
General
Full URL
http://update-1009132075871.dvrlists.com/asset/chunk1.css
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
d059ebac9e5a7f3f7e5ae59ca137bb7224e38ad41d3ad36e1d65995b35524a22

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:27:32 GMT
server
LiteSpeed
etag
"e7c9-65d7ca54-13b05e;gz"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
12994
expires
Thu, 13 Jun 2024 15:32:48 GMT
main.chunk.css
update-1009132075871.dvrlists.com/asset/
494 KB
64 KB
Stylesheet
General
Full URL
http://update-1009132075871.dvrlists.com/asset/main.chunk.css
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
ecc0293c033edc95eedad6bb294a121546ce61c8b1a8973886f551b6702157fe

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:27:36 GMT
server
LiteSpeed
etag
"7b7d1-65d7ca58-13b060;gz"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
64743
expires
Thu, 13 Jun 2024 15:32:48 GMT
jquery.min.js
update-1009132075871.dvrlists.com/asset/
85 KB
30 KB
Script
General
Full URL
http://update-1009132075871.dvrlists.com/asset/jquery.min.js
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:27:24 GMT
server
LiteSpeed
etag
"1538e-65d7ca4c-13b061;gz"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
30348
expires
Thu, 13 Jun 2024 15:32:48 GMT
sound-mobile.png
update-1009132075871.dvrlists.com/asset/
51 KB
51 KB
Image
General
Full URL
http://update-1009132075871.dvrlists.com/asset/sound-mobile.png
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
c150037ca397366d56aa0b6bba6a1dc69898a62ff25777e3a180ba56beaea0e0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
last-modified
Thu, 22 Feb 2024 22:28:34 GMT
server
LiteSpeed
etag
"cca3-65d7ca92-13b05b;;;"
content-type
image/png
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
52387
expires
Thu, 13 Jun 2024 15:32:48 GMT
sound-mobile.svg
update-1009132075871.dvrlists.com/asset/
2 KB
1 KB
Image
General
Full URL
http://update-1009132075871.dvrlists.com/asset/sound-mobile.svg
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:28:00 GMT
server
LiteSpeed
etag
"951-65d7ca70-13b05c;gz"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
1092
expires
Thu, 13 Jun 2024 15:32:48 GMT
load.js
update-1009132075871.dvrlists.com/asset/
1 KB
775 B
Script
General
Full URL
http://update-1009132075871.dvrlists.com/asset/load.js
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
186c9530c90453f18f9d001a221c5c17ed497b925e93f30d34cb0dd1721a042c

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:49 GMT
content-encoding
gzip
last-modified
Thu, 22 Feb 2024 22:27:28 GMT
server
LiteSpeed
etag
"444-65d7ca50-13b05a;gz"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=604800
connection
Keep-Alive
accept-ranges
bytes
content-length
389
expires
Thu, 13 Jun 2024 15:32:49 GMT
css
fonts.googleapis.com/
1 KB
862 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Khula&display=swap&.css
Requested by
Host: update-1009132075871.dvrlists.com
URL: http://update-1009132075871.dvrlists.com/asset/main.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e627768b9350ad0509bb233351092ffccae12ca7d9c70733a178b132c638e98b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
http://update-1009132075871.dvrlists.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Thu, 06 Jun 2024 15:32:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 06 Jun 2024 15:32:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 06 Jun 2024 15:32:49 GMT
sound-mobile.png
update-1009132075871.dvrlists.com/asset/
51 KB
0
Other
General
Full URL
http://update-1009132075871.dvrlists.com/asset/sound-mobile.png
Protocol
HTTP/1.1
Server
103.59.94.188 , Indonesia, ASN136052 (IDNIC-IDCLOUDHOST-AS-ID PT Cloud Hosting Indonesia, ID),
Reverse DNS
ip103-59-94-188.cloudhost.web.id
Software
LiteSpeed /
Resource Hash
c150037ca397366d56aa0b6bba6a1dc69898a62ff25777e3a180ba56beaea0e0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
http://update-1009132075871.dvrlists.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Thu, 06 Jun 2024 15:32:48 GMT
last-modified
Thu, 22 Feb 2024 22:28:34 GMT
server
LiteSpeed
etag
"cca3-65d7ca92-13b05b;;;"
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
52387
expires
Thu, 13 Jun 2024 15:32:48 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| mousedwn function| showBtn

0 Cookies