hkbestoffer.com
Open in
urlscan Pro
103.104.122.68
Malicious Activity!
Public Scan
Effective URL: https://hkbestoffer.com/sweeps/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=Buffalo&clickid=...
Submission: On February 23 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 23rd 2023. Valid for: 3 months.
This is the only time hkbestoffer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online) Customer Survey Spam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 20.47.17.184 20.47.17.184 | 8069 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 140.99.153.98 140.99.153.98 | 35913 (DEDIPATH-LLC) (DEDIPATH-LLC) | |
1 1 | 103.147.122.142 103.147.122.142 | 135932 (VNDATA-AS...) (VNDATA-AS-VN Viet Storage Technology Joint Stock Company) | |
19 | 103.104.122.68 103.104.122.68 | 135932 (VNDATA-AS...) (VNDATA-AS-VN Viet Storage Technology Joint Stock Company) | |
2 | 2600:9000:220... 2600:9000:2209:a000:b:4623:cac0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
23 | 4 |
ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
meee00.blob.core.windows.net |
ASN135932 (VNDATA-AS-VN Viet Storage Technology Joint Stock Company, VN)
bsttpl.com |
ASN135932 (VNDATA-AS-VN Viet Storage Technology Joint Stock Company, VN)
PTR: static-ptr.vndata.vn
hkbestoffer.com |
ASN16509 (AMAZON-02, US)
d3e1y4kxkqljcb.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
hkbestoffer.com
hkbestoffer.com |
1 MB |
2 |
cloudfront.net
d3e1y4kxkqljcb.cloudfront.net |
275 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43 |
1 KB |
1 |
bsttpl.com
1 redirects
bsttpl.com |
1 KB |
1 |
govwlfeloony.com
1 redirects
www.govwlfeloony.com |
655 B |
1 |
windows.net
meee00.blob.core.windows.net |
520 B |
23 | 6 |
Domain | Requested by | |
---|---|---|
19 | hkbestoffer.com |
hkbestoffer.com
|
2 | d3e1y4kxkqljcb.cloudfront.net |
hkbestoffer.com
|
1 | fonts.googleapis.com |
hkbestoffer.com
|
1 | bsttpl.com | 1 redirects |
1 | www.govwlfeloony.com | 1 redirects |
1 | meee00.blob.core.windows.net | |
23 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.blob.core.windows.net Microsoft RSA TLS CA 02 |
2022-12-23 - 2023-12-23 |
a year | crt.sh |
hkbestoffer.com R3 |
2023-01-23 - 2023-04-23 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2022-12-08 - 2023-12-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-02-01 - 2023-04-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://hkbestoffer.com/sweeps/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=Buffalo&clickid=2f4babzgxm7xo144&campaign=4323&user_id=1&clickcost=0&lander=1696&time=1677118839&browser_version=110.0.5481.100&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Nexeon%20Technologies&ip=96.9.249.39&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/110.0.5481.100%20Safari/537.36&lpkey=16d2776e137471ff39&target=wef&device=DESKTOP&country=US&ts={t9}&trafficsource=162&uclick=bzgxm7xo&uclickhash=bzgxm7xo-bzgxm7xo-qeoj-b4dz-166j-8pk2vr-8pk2i4-255552
Frame ID: D83C5BCE9B41D60F6571B0008F21EBAB
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
[1] Reward Pending - We Want Your Opinion!Page URL History Show full URLs
- https://meee00.blob.core.windows.net/amazonmail-bulk/HHHRRRDDDWWRRDDWWLLLTTT%C3%A8_______GGGNNRTTRR%C2%A3%C2%A3SW... Page URL
-
https://www.govwlfeloony.com/2FNF9CJ5S/H8XDXT1/?creative_id=43358&sub1=md
HTTP 302
https://bsttpl.com/click.php?key=l5mkmy5cebqx6y19qhs5&externalid=41ad3c41be3d43aa8b3da37144d670... HTTP 302
https://hkbestoffer.com/sweeps/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&c... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://meee00.blob.core.windows.net/amazonmail-bulk/HHHRRRDDDWWRRDDWWLLLTTT%C3%A8_______GGGNNRTTRR%C2%A3%C2%A3SWP1......HTm Page URL
-
https://www.govwlfeloony.com/2FNF9CJ5S/H8XDXT1/?creative_id=43358&sub1=md
HTTP 302
https://bsttpl.com/click.php?key=l5mkmy5cebqx6y19qhs5&externalid=41ad3c41be3d43aa8b3da37144d6709b&target=wef&affid=702743&subid2=md HTTP 302
https://hkbestoffer.com/sweeps/index_16.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=Buffalo&clickid=2f4babzgxm7xo144&campaign=4323&user_id=1&clickcost=0&lander=1696&time=1677118839&browser_version=110.0.5481.100&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Nexeon%20Technologies&ip=96.9.249.39&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/110.0.5481.100%20Safari/537.36&lpkey=16d2776e137471ff39&target=wef&device=DESKTOP&country=US&ts={t9}&trafficsource=162&uclick=bzgxm7xo&uclickhash=bzgxm7xo-bzgxm7xo-qeoj-b4dz-166j-8pk2vr-8pk2i4-255552 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
HHHRRRDDDWWRRDDWWLLLTTT%C3%A8_______GGGNNRTTRR%C2%A3%C2%A3SWP1......HTm
meee00.blob.core.windows.net/amazonmail-bulk/ |
117 B 520 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index_16.php
hkbestoffer.com/sweeps/ Redirect Chain
|
63 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
hkbestoffer.com/sweeps/assets/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
hkbestoffer.com/sweeps/assets/ |
34 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9c231cfa16f08beed41bd431b38c71ba.png
hkbestoffer.com/sweeps/assets/ |
326 KB 327 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
02831ab02f02782d9c47fffcfd5eadc4.png
hkbestoffer.com/sweeps/assets/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dewaltgenerator_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ |
264 KB 265 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dewaltgen_comm1.jpg
hkbestoffer.com/sweeps/assets/ |
69 KB 70 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dewaltgen_comm2.jpg
hkbestoffer.com/sweeps/assets/ |
352 KB 352 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dewaltgen_comm3.jpg
hkbestoffer.com/sweeps/assets/ |
63 KB 63 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f52dd02fdbe33cb89087dd83d16dc230.png
hkbestoffer.com/sweeps/assets/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d34bd763d46c8f2ddf09fc415fbc3c06.png
hkbestoffer.com/sweeps/assets/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
279132e34471a44f9e9c889082127894.png
hkbestoffer.com/sweeps/assets/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
hkbestoffer.com/sweeps/assets/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
hkbestoffer.com/sweeps/assets/ |
62 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myscript.js
hkbestoffer.com/sweeps/assets/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redirect_bin.js
hkbestoffer.com/ |
2 KB 787 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.js
hkbestoffer.com/sweeps/assets/ |
49 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_16.php
hkbestoffer.com/sweeps/ |
63 KB 63 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
hkbestoffer.com/sweeps/assets/fonts/ |
93 KB 93 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
halloween_sweeps.css
hkbestoffer.com/ |
2 KB 976 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comm_sweeps.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online) Customer Survey Spam (Consumer)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bsttpl.com/ | Name: uclick Value: bzgxm7xo |
|
bsttpl.com/ | Name: uclickhash Value: bzgxm7xo-bzgxm7xo-qeoj-b4dz-166j-8pk2vr-8pk2i4-255552 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bsttpl.com
d3e1y4kxkqljcb.cloudfront.net
fonts.googleapis.com
hkbestoffer.com
meee00.blob.core.windows.net
www.govwlfeloony.com
103.104.122.68
103.147.122.142
140.99.153.98
20.47.17.184
2600:9000:2209:a000:b:4623:cac0:21
2607:f8b0:4006:81c::200a
06bd71e334de995f965820fca0097787182f1077b30e81fe4bc5c09bc65509df
06d81345fc255d392fe9d296124a99392dafab5dde522058f9fd24e0d96b5dad
401792ce322a1433b6271c6de8b7ab2e2c8966e009a1c09b0a13321b339f3ff6
4437a2d3e5d987d0d58415918abc69503157bf9618a2ed28246bb0f367a006bc
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
5353aedc535ca3d443ce78d920cd69160100c0563701535ce2ea6457634c7629
6bfce6ef62d617be0e972b005661fbc0c46a698bc9d7df034bf36062a7fea5b6
6f2de36054525c7a25f6b4ca1447f762169a97d0f11593cf0f8f254880f4c2bc
821bde5a8cf7c9ea9f16b1e655cdd117be03784b6f26bc9ed05b784727f44634
990762c29c78f7e906e8cd5de5b59b782834585148b58ab26201996f054b352c
a5c0bb41af4708d1a155e1e044a48335ec7d80f43d1c750d00b195ee1e1b9ee9
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c0109e9747e94335267d540104b0b256bc507882206be853bfbd6b13ddb1c277
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
c889fb1af64cceab36a53b3d6e622710e0880b0ed4b38be7730561105b3c5bcc
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
e322dea2b22e9a4e612f170bbc35c06cfe23416f7fd28379a1030b4e244b562c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8201d6d9e6e449e5b87b2d053fad5c8543835f7c2689593f512b529d0e56edd
f0fe296d7c333d430a4a3a9bcfdc317728f05669190c74d10aa6b813e3cfd711
f4c5c2774b705f182008f9c29417147e4a7c1d1394d8ad53e867f514e2f45f82
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194