confirm-1928361827-heip.com Open in urlscan Pro
164.215.103.71 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://confirm-1928361827-heip.com/
Submission: On September 11 via manual (September 11th 2023, 8:43:54 am UTC) from GB — Scanned from GB

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 164.215.103.71, located in Azerbaijan and belongs to IPCONNECT, SC. The main domain is confirm-1928361827-heip.com.
TLS certificate: Issued by R3 on September 8th 2023. Valid for: 3 months.

This is the only time confirm-1928361827-heip.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
5	164.215.103.71 164.215.103.71	213373 (IPCONNECT) (IPCONNECT)
2	2606:4700:20:... 2606:4700:20::681a:82c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	146.70.100.116 146.70.100.116	9009 (M247) (M247)
10	4

5 164.215.103.71 (Azerbaijan)

ASN213373 (IPCONNECT, SC)

confirm-1928361827-heip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:82c (United States)

ASN13335 (CLOUDFLARENET, US)

ipapi.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 146.70.100.116 (Los Angeles, United States)

ASN9009 (M247, RO)

fax.flexflex.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	confirm-1928361827-heip.com confirm-1928361827-heip.com	462 KB
3	flexflex.online fax.flexflex.online	573 B
2	ipapi.co ipapi.co — Cisco Umbrella Rank: 17283	2 KB
10	3

	Domain	Requested by
5	confirm-1928361827-heip.com	confirm-1928361827-heip.com
3	fax.flexflex.online	confirm-1928361827-heip.com
2	ipapi.co	confirm-1928361827-heip.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
confirm-1928361827-heip.com R3	`2023-09-08` - `2023-12-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-16` - `2024-04-15`	a year	crt.sh
fax.flexflex.online R3	`2023-07-13` - `2023-10-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://confirm-1928361827-heip.com/
Frame ID: 5108F845DD10E4EF6F44D1287E416198
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Meta for Business

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

464 kB
Transfer

475 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
confirm-1928361827-heip.com/ 881 B
698 B 180ms
48ms Document
text/html 164.215.103.71
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://confirm-1928361827-heip.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.215.103.71 , Azerbaijan, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: f2d9c2df2cfb437ead303d9dda324c7cf9e601937844941634f64d8317669b5e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 11 Sep 2023 08:43:49 GMT
ETag: W/"64fa71fc-371"
Last-Modified: Fri, 08 Sep 2023 00:59:40 GMT
Server: nginx/1.18.0
Transfer-Encoding: chunked

GET
H/1.1 200
OK main.0163f84d.js Show response
confirm-1928361827-heip.com/static/js/ 259 KB
259 KB 95ms
95ms Script
application/javascript 164.215.103.71
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://confirm-1928361827-heip.com/static/js/main.0163f84d.js
Requested by: Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.215.103.71 , Azerbaijan, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: b2fa0ef67611f2c95cfbedd09fecae6629847becb0372890b71e20de01b549c1

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://confirm-1928361827-heip.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date: Mon, 11 Sep 2023 08:43:49 GMT
Last-Modified: Fri, 08 Sep 2023 00:59:40 GMT
Server: nginx/1.18.0
ETag: "64fa71fc-40ca1"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 265377

GET
H/1.1 200
OK main.c1c9e2a9.css
confirm-1928361827-heip.com/static/css/ 140 KB
140 KB 192ms
95ms Stylesheet
text/css 164.215.103.71
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://confirm-1928361827-heip.com/static/css/main.c1c9e2a9.css
Requested by: Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.215.103.71 , Azerbaijan, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 502e38454249c5e31c9cb8a9474fb099524ce011295cda2bd5a9f03f489273d8

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://confirm-1928361827-heip.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date: Mon, 11 Sep 2023 08:43:49 GMT
Last-Modified: Fri, 08 Sep 2023 00:59:40 GMT
Server: nginx/1.18.0
ETag: "64fa71fc-2309c"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 143516

GET
H2 200 / Show response
ipapi.co/json// 762 B
892 B 335ms
246ms XHR
application/json 2606:4700:20::681a:82c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ipapi.co/json//

Requested by

Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/static/js/main.0163f84d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:20::681a:82c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5954ff17f0309825b1a03f80e60d79a405364dc74da95867901497919499322f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://confirm-1928361827-heip.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 08:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Host, origin
allow: OPTIONS, POST, GET, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: https://confirm-1928361827-heip.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VWCq8tnboe0Uw%2BiweNdXyKnB90nDX5NEUArFv5IwWxmlCWD1e2PlX6xRHsvB4Eda0UypJ6BOn65uVbO1CfjgT6mswrN9%2F6jbq7K1NT5p7exJJcskSKFgWRJ8lyA14BrDnL810bx9"}],"group":"cf-nel","max_age":604800}
x-frame-options: DENY
cf-ray: 804ea0137c6076c5-LHR

OPTIONS
H/1.1 200
OK shadow
fax.flexflex.online/api/activity/ 0
0 621ms
201ms Preflight
text/plain 146.70.100.116
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://fax.flexflex.online/api/activity/shadow
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.70.100.116 Los Angeles, United States, ASN9009 (M247, RO),
Reverse DNS
Software: nginx/1.25.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://confirm-1928361827-heip.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 2
Content-Type: text/plain; charset=utf-8
Date: Mon, 11 Sep 2023 08:43:50 GMT
Server: nginx/1.25.2
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://confirm-1928361827-heip.com
access-control-max-age: 600
vary: Origin

POST
H/1.1 200
OK shadow Show response
fax.flexflex.online/api/activity/ 85 B
311 B 247ms
245ms XHR
application/json 146.70.100.116
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://fax.flexflex.online/api/activity/shadow
Requested by: Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/static/js/main.0163f84d.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.70.100.116 Los Angeles, United States, ASN9009 (M247, RO),
Reverse DNS
Software: nginx/1.25.2 /
Resource Hash: 5bca00413d504d784b3974bb8d78ec197273152c0e4ce073d51250e69e8ee53c

Request headers

Accept: application/json, text/plain, */*
Referer: https://confirm-1928361827-heip.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
Date: Mon, 11 Sep 2023 08:43:50 GMT
access-control-allow-credentials: true
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 85
Content-Type: application/json

GET
H/1.1 200
OK init Show response
fax.flexflex.online/api/set_status/null/ 36 B
262 B 193ms
193ms XHR
application/json 146.70.100.116
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://fax.flexflex.online/api/set_status/null/init
Requested by: Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/static/js/main.0163f84d.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.70.100.116 Los Angeles, United States, ASN9009 (M247, RO),
Reverse DNS
Software: nginx/1.25.2 /
Resource Hash: 3a81f99aaef5363691cb6067c2fe3c2b5eea5da386a7f80fcf7eafdd42e90de1

Request headers

Accept: application/json, text/plain, */*
Referer: https://confirm-1928361827-heip.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Mon, 11 Sep 2023 08:43:50 GMT
access-control-allow-credentials: true
Server: nginx/1.25.2
Connection: keep-alive
Content-Length: 36
Content-Type: application/json

GET
H/1.1 200
OK humanIcon-v4.62b0718b3254f2a8ab0f.png
confirm-1928361827-heip.com/static/media/ 48 KB
49 KB 96ms
96ms Image
image/png 164.215.103.71
IPCONNECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://confirm-1928361827-heip.com/static/media/humanIcon-v4.62b0718b3254f2a8ab0f.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.215.103.71 , Azerbaijan, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e43b722e09d8ee493d73b4f584aa8e2f78c442cfc4043f2e7f1b355e3ff40832

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://confirm-1928361827-heip.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date: Mon, 11 Sep 2023 08:43:50 GMT
Last-Modified: Fri, 08 Sep 2023 00:59:40 GMT
Server: nginx/1.18.0
ETag: "64fa71fc-c1c4"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49604

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f95ec6c859f4afa3cdc887673121919c3cf6fa04c41b4304a9bc71463bd84d0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK montserrat-latin-400-normal.acb6629fe45c43ad5d8b.woff2
confirm-1928361827-heip.com/static/media/ 12 KB
13 KB 48ms
48ms Font
application/octet-stream 164.215.103.71
IPCONNECT

General

Check archive.org

Show headers Download Go to

Full URL: https://confirm-1928361827-heip.com/static/media/montserrat-latin-400-normal.acb6629fe45c43ad5d8b.woff2
Requested by: Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/static/css/main.c1c9e2a9.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 164.215.103.71 , Azerbaijan, ASN213373 (IPCONNECT, SC),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394

Request headers

Referer: https://confirm-1928361827-heip.com/static/css/main.c1c9e2a9.css
Origin: https://confirm-1928361827-heip.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date: Mon, 11 Sep 2023 08:43:50 GMT
Last-Modified: Fri, 08 Sep 2023 00:59:40 GMT
Server: nginx/1.18.0
ETag: "64fa71fc-31a4"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12708

GET
H2 200 / Show response
ipapi.co/json// 762 B
655 B 221ms
221ms XHR
application/json 2606:4700:20::681a:82c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ipapi.co/json//

Requested by

Host: confirm-1928361827-heip.com
URL: https://confirm-1928361827-heip.com/static/js/main.0163f84d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:20::681a:82c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5954ff17f0309825b1a03f80e60d79a405364dc74da95867901497919499322f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer: https://confirm-1928361827-heip.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 08:43:51 GMT
content-encoding: br
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Host, origin
allow: OPTIONS, POST, GET, OPTIONS, HEAD
content-type: application/json
access-control-allow-origin: https://confirm-1928361827-heip.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWzarlkd6qTm7XsmDMlS1KssxRaOkv5UQCN5BJrgjXhxuTKk5w2Fjk0Nmv%2BTJ0uvG10DyEaQccd9FNByPKMZng8IAbBylDT2JHjpycd1mKFvXrPNcObYl70sgHqyOOvEeOCQiCM3"}],"group":"cf-nel","max_age":604800}
x-frame-options: DENY
cf-ray: 804ea01e193a76c5-LHR

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackChunkexternal_creator3

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

confirm-1928361827-heip.com
fax.flexflex.online
ipapi.co
146.70.100.116
164.215.103.71
2606:4700:20::681a:82c
0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92
2f95ec6c859f4afa3cdc887673121919c3cf6fa04c41b4304a9bc71463bd84d0
3a81f99aaef5363691cb6067c2fe3c2b5eea5da386a7f80fcf7eafdd42e90de1
502e38454249c5e31c9cb8a9474fb099524ce011295cda2bd5a9f03f489273d8
5954ff17f0309825b1a03f80e60d79a405364dc74da95867901497919499322f
5bca00413d504d784b3974bb8d78ec197273152c0e4ce073d51250e69e8ee53c
b2fa0ef67611f2c95cfbedd09fecae6629847becb0372890b71e20de01b549c1
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
e43b722e09d8ee493d73b4f584aa8e2f78c442cfc4043f2e7f1b355e3ff40832
f2d9c2df2cfb437ead303d9dda324c7cf9e601937844941634f64d8317669b5e

confirm-1928361827-heip.com Open in urlscan Pro 164.215.103.71 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

464 kBTransfer

475 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

confirm-1928361827-heip.com Open in urlscan Pro
164.215.103.71 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

464 kB
Transfer

475 kB
Size

0
Cookies

10 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!