independentcy.now.sh Open in urlscan Pro
34.65.228.161  Malicious Activity! Public Scan

URL: https://independentcy.now.sh/index.html
Submission Tags: @ipnigh
Submission: On April 27 via api from GB

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 34.65.228.161, located in United States and belongs to GOOGLE, US. The main domain is independentcy.now.sh.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 5th 2020. Valid for: 3 months.
This is the only time independentcy.now.sh was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 34.65.228.161 15169 (GOOGLE)
9 51.15.16.245 12876 (Online SAS)
1 2 192.186.220.3 26496 (AS-26496-...)
11 3
Apex Domain
Subdomains
Transfer
9 postimg.cc
i.postimg.cc
52 KB
2 csscheckbox.com
csscheckbox.com
www.csscheckbox.com
2 KB
1 now.sh
independentcy.now.sh
2 KB
11 3
Domain Requested by
9 i.postimg.cc independentcy.now.sh
1 www.csscheckbox.com independentcy.now.sh
1 csscheckbox.com 1 redirects
1 independentcy.now.sh
11 4

This site contains no links.

Subject Issuer Validity Valid
*.now.sh
Let's Encrypt Authority X3
2020-04-05 -
2020-07-04
3 months crt.sh
postimg.cc
Let's Encrypt Authority X3
2020-03-10 -
2020-06-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://independentcy.now.sh/index.html
Frame ID: 67402B65657FF8C04DD0AD60E168D5E5
Requests: 11 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^now$/i

Page Statistics

11
Requests

91 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

55 kB
Transfer

56 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • http://csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png HTTP 301
  • http://www.csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.html
independentcy.now.sh/
5 KB
2 KB
Document
General
Full URL
https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.65.228.161 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
161.228.65.34.bc.googleusercontent.com
Software
now /
Resource Hash
40ccbba2bb3406803491c6d750f26198acc723b5c0d07b90a66445a3fc869b03
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

:method
GET
:authority
independentcy.now.sh
:scheme
https
:path
/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 27 Apr 2020 01:47:29 GMT
content-type
text/html; charset=utf-8
x-vercel-cache
HIT
x-now-cache
HIT
cache-control
public, max-age=0, must-revalidate
content-disposition
inline; filename="index.html"
access-control-allow-origin
*
etag
W/"de092960f7d16fa94dcf388fd68c3c5293907f47"
age
6715
x-now-trace
zrh1
server
now
x-vercel-id
zrh1::mmg2l-1587952049448-926180978871
x-now-id
zrh1::mmg2l-1587952049448-926180978871
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
logo2.png
i.postimg.cc/xdgvDWM9/
7 KB
7 KB
Image
General
Full URL
https://i.postimg.cc/xdgvDWM9/logo2.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
3530d98644454fc8def54e8ea732c6c58bc6092f7cb1d62f25270688fdda8e12

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 11:43:28 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
6962
expires
Thu, 31 Dec 2037 23:55:55 GMT
signin.png
i.postimg.cc/zXkprJ6R/
5 KB
5 KB
Image
General
Full URL
https://i.postimg.cc/zXkprJ6R/signin.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
43fa99ba07a162d0b5c1dead120d4ac7de9afc66c297003bf2374b951abef02f

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:03:03 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
4845
expires
Thu, 31 Dec 2037 23:55:55 GMT
pass.png
i.postimg.cc/kg2m6hxw/
4 KB
4 KB
Image
General
Full URL
https://i.postimg.cc/kg2m6hxw/pass.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
5919ac9207f04c9b939a9376d2ee4099a6ef31cd6b99f2db270cdc1ba10dcc15

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:15:48 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
4277
expires
Thu, 31 Dec 2037 23:55:55 GMT
condition.png
i.postimg.cc/Rh0gqyjT/
7 KB
7 KB
Image
General
Full URL
https://i.postimg.cc/Rh0gqyjT/condition.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
a45733d9947e8020384d36ff7ee8f2716fcb5b862e4df0c8f5fa2f2c036abe79

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:38:06 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
6984
expires
Thu, 31 Dec 2037 23:55:55 GMT
line.png
i.postimg.cc/YqQcM39v/
249 B
491 B
Image
General
Full URL
https://i.postimg.cc/YqQcM39v/line.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
c69c92e81a0253e2877c0d366af416a03cf03416d8dd0dd1a90b0844f095b90e

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 11:56:58 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
249
expires
Thu, 31 Dec 2037 23:55:55 GMT
footer.png
i.postimg.cc/VNJWczBm/
15 KB
16 KB
Image
General
Full URL
https://i.postimg.cc/VNJWczBm/footer.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
0e2f4d08725b06e25ec93675ca1cae87fc10fe9a2fe03ffc8915ee0e53fd483b

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 12:08:54 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
15800
expires
Thu, 31 Dec 2037 23:55:55 GMT
keepme.png
i.postimg.cc/xT3FgGPH/
3 KB
3 KB
Image
General
Full URL
https://i.postimg.cc/xT3FgGPH/keepme.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
0ebd28ca9aeaa52fbdcfb4e97d16d66872b89b793c916b94f7599fb9fa1051cb

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:46:03 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
2881
expires
Thu, 31 Dec 2037 23:55:55 GMT
newuser.png
i.postimg.cc/4NHStKLk/
6 KB
7 KB
Image
General
Full URL
https://i.postimg.cc/4NHStKLk/newuser.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
d2dbab7d094f50eb2e6e0ba40cd431a49ef5313adbfaa94dace32d0636dfc959

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:56:06 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
6611
expires
Thu, 31 Dec 2037 23:55:55 GMT
singinbotton.png
i.postimg.cc/t4d4Ccyf/
2 KB
2 KB
Image
General
Full URL
https://i.postimg.cc/t4d4Ccyf/singinbotton.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
51.15.16.245 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS
i.postimg.cc
Software
nginx /
Resource Hash
cc2b61910b4f84b734c4b06224732b129bc265134739e3508e82ebd395cc3ca3

Request headers

Referer
https://independentcy.now.sh/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 27 Apr 2020 01:47:29 GMT
last-modified
Wed, 28 Aug 2019 13:33:47 GMT
server
nginx
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
2010
expires
Thu, 31 Dec 2037 23:55:55 GMT
csscheckbox_a608ec28e6c50a02870bf452f125b974.png
www.csscheckbox.com/checkboxes/u/
Redirect Chain
  • http://csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png
  • http://www.csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png
882 B
1 KB
Image
General
Full URL
http://www.csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png
Requested by
Host: independentcy.now.sh
URL: https://independentcy.now.sh/index.html
Protocol
HTTP/1.1
Server
192.186.220.3 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-192-186-220-3.ip.secureserver.net
Software
Apache /
Resource Hash
a9ed9f39c940ba1aaf7f34eee399e23588c4510b519be50bb8ca7ad74e96fefc

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 01:47:30 GMT
Last-Modified
Sat, 11 Jun 2016 20:13:26 GMT
Server
Apache
Upgrade
h2,h2c
Cache-Control
max-age=31557600, public
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=5
Content-Length
882
Expires
Tue, 27 Apr 2021 01:47:30 GMT

Redirect headers

Date
Mon, 27 Apr 2020 01:47:29 GMT
Server
Apache
Content-Type
text/html; charset=iso-8859-1
Location
http://www.csscheckbox.com/checkboxes/u/csscheckbox_a608ec28e6c50a02870bf452f125b974.png
Cache-Control
max-age=31536000
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
296
Expires
Tue, 27 Apr 2021 01:47:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| unhideBody

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload