blueticket-helpplatform.ml Open in urlscan Pro
51.83.209.70  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response blueticket-helpplatform.ml/	4 KB 2 KB	190ms 57ms	Document text/html	51.83.209.70 OVH
General Check archive.org Show headers Download Go to Full URL https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.83.209.70 , France, ASN16276 (OVH, FR), Reverse DNS server.hostimul.org Software LiteSpeed / Resource Hash f18232763223d9e7a038ae85bcc78e241f2df7e3885bba1db174f0d973020382 Request headers :method GET :authority blueticket-helpplatform.ml :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers vary Accept-Encoding content-type text/html; charset=UTF-8 content-encoding gzip date Tue, 01 Dec 2020 10:33:52 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H2	200	QnbQQj.gif i.imgyukle.com/2020/04/09/	1 MB 1 MB	106ms 34ms	Image image/gif	116.202.246.29 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgyukle.com/2020/04/09/QnbQQj.gif Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 116.202.246.29 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.29.246.202.116.clients.your-server.de Software nginx / Resource Hash 4d7f94eca318ccb273eb10ac33b7f210a6c6a986367115d040080b2c3cb8ddd5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self'; Strict-Transport-Security max-age=15768000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://blueticket-helpplatform.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 10:33:52 GMT referrer-policy origin last-modified Thu, 09 Apr 2020 11:10:00 GMT server nginx etag "5e8f0288-1301d3" x-frame-options SAMEORIGIN content-type image/gif x-xss-protection 1; mode=block x-permitted-cross-domain-policies master-only feature-policy geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none; content-security-policy frame-ancestors 'self'; strict-transport-security max-age=15768000; includeSubDomains accept-ranges bytes content-length 1245651 x-content-type-options nosniff
GET H2	200	4c68346f3fc7.css www.instagram.com/static/bundles/es6/ConsumerUICommons.css/	113 KB 14 KB	21ms 6ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8ba4b1252264531dd9c3470451173cd553e4832ed959857dd6c3f2b319be4899 Request headers Origin https://blueticket-helpplatform.ml Referer https://blueticket-helpplatform.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 18 Nov 2020 05:02:01 GMT x-fb-trip-id 1679558926 etag "4c68346f3fc7" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 13855
GET H2	200	f5339c1f472f.css www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/	16 KB 3 KB	20ms 6ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/ConsumerAsyncCommons.css/f5339c1f472f.css Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c6f34c73fb517a1dcb1e10298b863bc04e21485a3fb88b19310494670b6bed6a Request headers Origin https://blueticket-helpplatform.ml Referer https://blueticket-helpplatform.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 18 Nov 2020 05:02:01 GMT x-fb-trip-id 1679558926 etag "f5339c1f472f" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 3081
GET H2	200	e6dcc76c8eaf.css www.instagram.com/static/bundles/es6/Challenge.css/	65 KB 17 KB	26ms 11ms	Stylesheet text/css	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.instagram.com/static/bundles/es6/Challenge.css/e6dcc76c8eaf.css Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 16c16a825280d02191f5bfa3b9084965ccfe31ca16621354c2625fd0e7e15dd3 Request headers Origin https://blueticket-helpplatform.ml Referer https://blueticket-helpplatform.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 18 Nov 2020 05:02:01 GMT x-fb-trip-id 1679558926 etag "e6dcc76c8eaf" vary Accept-Encoding content-type text/css access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 17467
GET H2	200	WholeInsert4.js Show response ads.mgmt.somee.com/serveimages/ad2/	4 KB 2 KB	401ms 132ms	Script application/javascript	198.37.116.27 DC74-AS
General Check archive.org Show headers Download Go to Full URL https://ads.mgmt.somee.com/serveimages/ad2/WholeInsert4.js Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 198.37.116.27 La Jolla, United States, ASN17216 (DC74-AS, US), Reverse DNS 116.37.198-27.dc74.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash f0847b313c3f0714d708fd7402e2babc6e7db1d445819859c6aaaf4b743539c5 Request headers Referer https://blueticket-helpplatform.ml/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 10:33:54 GMT content-encoding gzip last-modified Tue, 27 Dec 2016 18:04:08 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "01c419e6b60d21:0" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1533
GET H2	200	c14ffe44a4f6.png www.instagram.com/static/bundles/es6/sprite_glyphs_c14ffe44a4f6.png/	123 KB 123 KB	18ms 6ms	Image image/png	2a03:2880:f21c:81e5:face:b00c:0:4420 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.instagram.com/static/bundles/es6/sprite_glyphs_c14ffe44a4f6.png/c14ffe44a4f6.png Requested by Host: www.instagram.com URL: https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash ea590d49726c63b33ad77cc4f8e7142dd45e960df41b72b26c2494b195288ef8 Request headers Referer https://www.instagram.com/static/bundles/es6/ConsumerUICommons.css/4c68346f3fc7.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 12:04:16 GMT x-fb-trip-id 1679558926 etag "c14ffe44a4f6" vary Accept-Encoding content-type image/png access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable content-encoding br content-length 125636
GET H/1.1	500 Internal Server Error	DOProcessAdClick.aspx vb1700.mgmt.somee.com/dzwebsvc/	0 0	248ms 230ms	Image text/html	198.37.116.16 DC74-AS
General Check archive.org Show headers Download Go to Show image Full URL http://vb1700.mgmt.somee.com/dzwebsvc/DOProcessAdClick.aspx?cid=someehost&ct=h&p=0&rn=0.128372572701827&c=1&vr=adwords&r=&fr=0&pg=https%3A//blueticket-helpplatform.ml/&go= Requested by Host: blueticket-helpplatform.ml URL: https://blueticket-helpplatform.ml/ Protocol HTTP/1.1 Server 198.37.116.16 La Jolla, United States, ASN17216 (DC74-AS, US), Reverse DNS 116.37.198-16.dc74.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated boolean| Ssac boolean| Ssc function| Ss_sec function| S_ssac function| D_ssac function| Do_se function| S_tst object| sEmpty function| findX function| findY function| checkFrame boolean| chFr string| ins string| Mu object| Md object| Mnv number| Mp number| Mc number| Mrn number| Mn string| Mz number| Mfr string| My object| smeimg

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			blueticket-helpplatform.ml/	1969-12-31 23:59:59	Name: b Value: b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.mgmt.somee.com
blueticket-helpplatform.ml
i.imgyukle.com
vb1700.mgmt.somee.com
www.instagram.com
116.202.246.29
198.37.116.16
198.37.116.27
2a03:2880:f21c:81e5:face:b00c:0:4420
51.83.209.70
16c16a825280d02191f5bfa3b9084965ccfe31ca16621354c2625fd0e7e15dd3
4d7f94eca318ccb273eb10ac33b7f210a6c6a986367115d040080b2c3cb8ddd5
8ba4b1252264531dd9c3470451173cd553e4832ed959857dd6c3f2b319be4899
c6f34c73fb517a1dcb1e10298b863bc04e21485a3fb88b19310494670b6bed6a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea590d49726c63b33ad77cc4f8e7142dd45e960df41b72b26c2494b195288ef8
f0847b313c3f0714d708fd7402e2babc6e7db1d445819859c6aaaf4b743539c5
f18232763223d9e7a038ae85bcc78e241f2df7e3885bba1db174f0d973020382