urlscan.io logo urlscan.io
SecurityTrails logo

trivialpoorvendor.asfgsht.repl.co Open in urlscan Pro
35.201.120.147  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://trivialpoorvendor.asfgsht.repl.co/
Submission: On January 20 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 6 HTTP transactions. The main IP is 35.201.120.147, located in Ascension Island and belongs to GOOGLE, US. The main domain is trivialpoorvendor.asfgsht.repl.co.
This is the only time trivialpoorvendor.asfgsht.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 35.201.120.147 15169 (GOOGLE)
1 3 167.114.158.130 16276 (OVH)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a03:2880:f02... 32934 (FACEBOOK)
1 1 67.202.94.86 32748 (STEADFAST)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
6 6
1    35.201.120.147 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 147.120.201.35.bc.googleusercontent.com
trivialpoorvendor.asfgsht.repl.co
3    167.114.158.130 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: net08usa.nethostingsac.com
www.sincareta247.xyz
1    2606:4700:20::ac43:46e9 (United States)

ASN13335 (CLOUDFLARENET, US)
get.geojs.io
1    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net
1    67.202.94.86 (Chicago, United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
1    2606:4700:10::ac43:88d (United States)

ASN13335 (CLOUDFLARENET, US)
widgets.amung.us
Domain Requested by
3 www.sincareta247.xyz 1 redirects trivialpoorvendor.asfgsht.repl.co
1 widgets.amung.us
1 whos.amung.us 1 redirects
1 static.xx.fbcdn.net
1 get.geojs.io
1 trivialpoorvendor.asfgsht.repl.co
6 6

This site contains no links.

Subject Issuer Validity Valid
www.sincareta247.xyz
cPanel, Inc. Certification Authority		 2021-01-02 -
2021-04-02		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-09 -
2021-07-09		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-12-22 -
2021-03-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://trivialpoorvendor.asfgsht.repl.co/
Frame ID: 4801DDE6C07375E7D7FA21D7616BE8F4
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers via /^1\.1 google$/i

Page Statistics

6
Requests

67 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

4
Countries

12 kB
Transfer

21 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.sincareta247.xyz/location HTTP 301
  • https://www.sincareta247.xyz/location/
Request Chain 2
  • http://get.geojs.io/v1/ip/geo.json HTTP 307
  • https://get.geojs.io/v1/ip/geo.json
Request Chain 5
  • http://whos.amung.us/widget/oliver007 HTTP 307
  • http://widgets.amung.us/classic/00/10.png

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
trivialpoorvendor.asfgsht.repl.co/ 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://trivialpoorvendor.asfgsht.repl.co/
Protocol
HTTP/1.1
Server
35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
147.120.201.35.bc.googleusercontent.com
Software
/
Resource Hash
df08461e247b6ad228413ee904b63f6a7c4a24a948c4fc03a5ce27c224a71dee

Request headers

Host
trivialpoorvendor.asfgsht.repl.co
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Content-Length
2396
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Jan 2021 01:04:47 GMT
Via
1.1 google
/
www.sincareta247.xyz/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2
Requested by
Host: trivialpoorvendor.asfgsht.repl.co
URL: http://trivialpoorvendor.asfgsht.repl.co/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.114.158.130 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
net08usa.nethostingsac.com
Software
LiteSpeed /
Resource Hash
b008927ec3c2ea573e63e5d8dced7dc49150e513514a26b56a8acd3f4e350f1f

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Jan 2021 01:04:47 GMT
content-encoding
br
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-store, no-cache, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT
/
www.sincareta247.xyz/location/
Redirect Chain
  • https://www.sincareta247.xyz/location
  • https://www.sincareta247.xyz/location/
1 KB
530 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sincareta247.xyz/location/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
167.114.158.130 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
net08usa.nethostingsac.com
Software
LiteSpeed /
Resource Hash
4d76c86a9edad85d1a1da59736b4badb9aee2dba15aeda031599c5460ae96c90

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:04:48 GMT
content-encoding
br
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
content-length
427
expires
Wed, 27 Jan 2021 01:04:48 GMT

Redirect headers

location
https://www.sincareta247.xyz/location/
date
Wed, 20 Jan 2021 01:04:47 GMT
server
LiteSpeed
content-length
706
content-type
text/html
geo.json
get.geojs.io/v1/ip/
Redirect Chain
  • http://get.geojs.io/v1/ip/geo.json
  • https://get.geojs.io/v1/ip/geo.json
364 B
673 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://get.geojs.io/v1/ip/geo.json
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:46e9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3c9a255fa658db8a0ece25c4529341124d7238fad6026854268b4722fee4576
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:04:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
access-control-allow-methods
GET
cf-request-id
07beebaf4500001f45fb1b9000000001
x-request-id
b8c1bddf31337c544e8b5074eb7d2958-AMS
x-geojs-location
AMS
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6%2FEWikWeeD3nRndmXQfIB7RJLrF7K%2BMjiOZP2uz49dtotF36qcQymvMnuW68N3DgNvEAJresgzVJb2b1fgGPH8hdUNsR5hylVD25HDzEnmjxg9nEpiZqf1Y%3D"}],"group":"cf-nel"}
content-type
application/json
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, private, max-age=0
cf-ray
6144e22bab431f45-FRA

Redirect headers

Location
https://get.geojs.io/v1/ip/geo.json
Non-Authoritative-Reason
HSTS
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
http://trivialpoorvendor.asfgsht.repl.co
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1027
x-fb-rlafr
0
x-fb-debug
jTTARgq4tBnJ6WaJgmM5wXeGl9GC8Xfx63k9RXzBZ+W/ls3ZuKHz6GcO/Lzd7ve5ZqC93QxFDhUs0lHkWSsFlw==
x-fb-trip-id
917726464
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
date
Wed, 20 Jan 2021 01:04:47 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-xss-protection
0
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 13 Jan 2022 17:31:14 GMT
10.png
widgets.amung.us/classic/00/
Redirect Chain
  • http://whos.amung.us/widget/oliver007
  • http://widgets.amung.us/classic/00/10.png
1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://widgets.amung.us/classic/00/10.png
Protocol
HTTP/1.1
Server
2606:4700:10::ac43:88d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
675bd4c420aa370199ea7caac5ee2b0d047838a033dcd68fe075121afa3d8ec3

Request headers

Referer
http://trivialpoorvendor.asfgsht.repl.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:04:48 GMT
CF-Cache-Status
HIT
Age
56693
Connection
keep-alive
Content-Length
1487
cf-request-id
07beebafac00000ea7923bc000000001
last-modified
Sun, 13 Jun 2010 09:03:09 GMT
Server
cloudflare
etag
"4c149ecd-5cf"
Vary
Accept-Encoding
Content-Type
image/png
access-control-allow-origin
*
cache-control
max-age=432000
Accept-Ranges
bytes
CF-RAY
6144e22c4ac40ea7-FRA
expires
Wed, 20 Jan 2021 09:19:55 GMT

Redirect headers

location
http://widgets.amung.us/classic/00/10.png
date
Wed, 20 Jan 2021 01:04:47 GMT
cache-control
no-cache, no-store, must-revalidate
transfer-encoding
chunked
content-type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms

0 Cookies

5 Console Messages

Source Level URL
Text
console-api log URL: https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2(Line 89)
Message:
[object HTMLScriptElement]
console-api log URL: https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2(Line 89)
Message:
[object HTMLScriptElement]
console-api log URL: https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2(Line 89)
Message:
[object HTMLScriptElement]
console-api log URL: https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2(Line 89)
Message:
[object HTMLScriptElement]
console-api log URL: https://www.sincareta247.xyz/?api=1&lan=facebooknew&ht=2(Line 89)
Message:
[object HTMLScriptElement]