vverriifikasiipemmblokiranid.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
Submission Tags: @jcybersec_
Submission: On July 08 via api (July 8th 2020, 6:30:47 pm UTC) from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 9 HTTP transactions. The main IP is 2a02:4780:dead:ed11::1, located in United States and belongs to AWEX, US. The main domain is vverriifikasiipemmblokiranid.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.

This is the only time vverriifikasiipemmblokiranid.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	2a02:4780:dea... 2a02:4780:dead:ed11::1	204915 (AWEX) (AWEX)
1	192.0.72.22 192.0.72.22	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
1 1	103.109.43.14 103.109.43.14	135905 (VNPT-AS-V...) (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP)
1	2606:4700:303... 2606:4700:3033::6812:2f89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:f5e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	6

3 2a02:4780:dead:ed11::1 (United States)

ASN204915 (AWEX, US)

vverriifikasiipemmblokiranid.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.72.22 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

claudimed.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.109.43.14 (Viet Nam) 1 redirects

ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN)

static.subiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6812:2f89 (United States)

ASN13335 (CLOUDFLARENET, US)

public-gcs.subiz-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:f5e (United States)

ASN13335 (CLOUDFLARENET, US)

api.sbz.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	000webhostapp.com vverriifikasiipemmblokiranid.000webhostapp.com	68 KB
2	gstatic.com fonts.gstatic.com	26 KB
1	sbz.vn api.sbz.vn	412 B
1	subiz-cdn.com public-gcs.subiz-cdn.com	165 KB
1	subiz.com 1 redirects static.subiz.com	213 B
1	googleapis.com fonts.googleapis.com	856 B
1	wordpress.com claudimed.files.wordpress.com	21 KB
9	7

	Domain	Requested by
3	vverriifikasiipemmblokiranid.000webhostapp.com	vverriifikasiipemmblokiranid.000webhostapp.com
2	fonts.gstatic.com	vverriifikasiipemmblokiranid.000webhostapp.com
1	api.sbz.vn	public-gcs.subiz-cdn.com
1	public-gcs.subiz-cdn.com	vverriifikasiipemmblokiranid.000webhostapp.com
1	static.subiz.com	1 redirects
1	fonts.googleapis.com	vverriifikasiipemmblokiranid.000webhostapp.com
1	claudimed.files.wordpress.com	vverriifikasiipemmblokiranid.000webhostapp.com
9	7

This site contains no links.

Subject Issuer	Validity	Valid
*.000webhostapp.com RapidSSL RSA CA 2018	`2019-06-11` - `2021-07-10`	2 years	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2019-01-15` - `2021-01-14`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-06-17` - `2020-09-09`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-06-17` - `2020-09-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
Frame ID: 9A978781C05E30C81069CA053AD310DF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Page Statistics

9
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

282 kB
Transfer

744 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://static.subiz.com/public/js/loader.js HTTP 302
https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request detail.php Show response
vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/ 5 KB
2 KB 336ms
107ms Document
text/html 2a02:4780:dead:ed11::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:ed11::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

6967ad2d7473593facff96f970e2afea26595782baee97e14d3fedd7897ad6b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: vverriifikasiipemmblokiranid.000webhostapp.com
:scheme: https
:path: /FACEBOOK%20GUA/detail.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Wed, 08 Jul 2020 18:30:24 GMT
content-type: text/html; charset=UTF-8
server: awex
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-request-id: a0e63eba6071a5e7c94a45b26e33f8c8
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/ 94 KB
38 KB 106ms
105ms Script
application/javascript 2a02:4780:dead:ed11::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Requested by

Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:ed11::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 08 Jul 2020 18:30:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Jul 2020 14:12:33 GMT
server: awex
content-type: application/javascript
status: 200
x-xss-protection: 1; mode=block
x-request-id: b18df9d856a4a7141d947d61ce3d5a02

GET
H2 200 bootstrap.min.css
vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/ 146 KB
28 KB 209ms
208ms Stylesheet
text/css 2a02:4780:dead:ed11::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/bootstrap.min.css

Requested by

Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:ed11::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

33bf181c4c89696029c6b085c552ed2a2ae2eb89109457a64bbc6aca4e09a072

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 08 Jul 2020 18:30:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Jul 2020 14:12:32 GMT
server: awex
content-type: text/css
status: 200
x-xss-protection: 1; mode=block
x-request-id: 0406f0f4d69d40ad7b31f4ae87577332

GET
H2 200 facebook-png.png
claudimed.files.wordpress.com/2011/06/ 21 KB
21 KB 60ms
27ms Image
image/png 192.0.72.22
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://claudimed.files.wordpress.com/2011/06/facebook-png.png
Requested by: Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9be0d70af67d2f8351a21de677983cc78c16f194480b908582fc84e3778307b1

Request headers

Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 22 np
date: Wed, 08 Jul 2020 18:30:29 GMT
last-modified: Sun, 19 Jun 2011 20:06:20 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 21814
expires: Mon, 13 Jul 2020 21:54:01 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
856 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700

Requested by

Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

da7ddd3a5a73db8108c0763e65a55794409b0b18911461537f10d333e808a04c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 08 Jul 2020 17:39:24 GMT
server: ESF
date: Wed, 08 Jul 2020 18:30:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 08 Jul 2020 18:30:30 GMT

GET
H2

200

1732437a894.app.js Show response
public-gcs.subiz-cdn.com/widget-v4/public/
Redirect Chain

https://static.subiz.com/public/js/loader.js
https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js

444 KB
165 KB

54ms
29ms

Script
application/javascript

2606:4700:3033::6812:2f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js
Requested by: Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6812:2f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 386dcbae16c366ca0fdb831180da62fbf3d41078611f93d2080ea87f11a66567

Request headers

Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 08 Jul 2020 18:30:31 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 192377
x-guploader-uploadid: AAANsUlqLSclsfZZBKJBWb6_49byRvpHoMrLS8SxOI9h2Lcf-xInBzyzP8pI8rYc1ZTgmBJsMyB5TBAlYFyRStJGWHE
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 167715
cf-request-id: 03d14aa3fc000005dc2abe6200000001
last-modified: Mon, 06 Jul 2020 13:02:18 GMT
server: cloudflare
etag: "dd83a9c10c01942323a9354da1a2a604"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=bBvAVw==, md5=3YOpwQwBlCMjqTVNoaKmBA==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1594040538711328
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000, no-transform
x-goog-stored-content-length: 167715
accept-ranges: bytes
cf-ray: 5afbe07ffc8005dc-FRA
content-type: application/javascript
expires: Tue, 06 Jul 2021 13:03:07 GMT

Redirect headers

Location: https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js
Date: Wed, 08 Jul 2020 18:30:31 GMT
Server: nginx/1.14.0 (Ubuntu)
Connection: keep-alive
Content-Length: 0

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2

Requested by

Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700
Origin: https://vverriifikasiipemmblokiranid.000webhostapp.com

Response headers

date: Thu, 11 Jun 2020 13:09:04 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:05 GMT
server: sffe
age: 2352086
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13224
x-xss-protection: 0
expires: Fri, 11 Jun 2021 13:09:04 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: vverriifikasiipemmblokiranid.000webhostapp.com
URL: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700
Origin: https://vverriifikasiipemmblokiranid.000webhostapp.com

Response headers

date: Fri, 12 Jun 2020 16:28:31 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:19 GMT
server: sffe
age: 2253719
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Sat, 12 Jun 2021 16:28:31 GMT

GET
H2 200 __link Show response
api.sbz.vn/4.0/ 2 B
412 B 145ms
127ms XHR
application/json 2606:4700:20::681a:f5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sbz.vn/4.0/__link?id=54166
Requested by: Host: public-gcs.subiz-cdn.com
URL: https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:f5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json, text/plain, */*
Referer: https://vverriifikasiipemmblokiranid.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 08 Jul 2020 18:30:31 GMT
cf-cache-status: DYNAMIC
x-api-time: 1.369146ms
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json
access-control-allow-origin: https://vverriifikasiipemmblokiranid.000webhostapp.com
x-thanh: thanh
cf-ray: 5afbe0813dd11f41-FRA
content-length: 2
cf-request-id: 03d14aa4bf00001f4119872200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://public-gcs.subiz-cdn.com/widget-v4/public/1732437a894.app.js(Line 1) Message: GOT V3 54166

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.sbz.vn
claudimed.files.wordpress.com
fonts.googleapis.com
fonts.gstatic.com
public-gcs.subiz-cdn.com
static.subiz.com
vverriifikasiipemmblokiranid.000webhostapp.com
103.109.43.14
192.0.72.22
2606:4700:20::681a:f5e
2606:4700:3033::6812:2f89
2a00:1450:4001:801::200a
2a00:1450:4001:816::2003
2a02:4780:dead:ed11::1
33bf181c4c89696029c6b085c552ed2a2ae2eb89109457a64bbc6aca4e09a072
386dcbae16c366ca0fdb831180da62fbf3d41078611f93d2080ea87f11a66567
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
6967ad2d7473593facff96f970e2afea26595782baee97e14d3fedd7897ad6b1
7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568
9be0d70af67d2f8351a21de677983cc78c16f194480b908582fc84e3778307b1
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
da7ddd3a5a73db8108c0763e65a55794409b0b18911461537f10d333e808a04c
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

vverriifikasiipemmblokiranid.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

6 IPs

3 Countries

282 kBTransfer

744 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

vverriifikasiipemmblokiranid.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

282 kB
Transfer

744 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!