![](/screenshots/752af61b-b8ba-4f40-9ef7-62ac2a2376ca.png)
www2.bettertypeupgradeaflash.icu
Open in
urlscan Pro
18.211.136.211
Malicious Activity!
Public Scan
Effective URL: https://www2.bettertypeupgradeaflash.icu/?b9zd1=i8N4-JGzT5FGmqBBm0CNHnKvRqHvuDyDXI8keRfLJ9RhhsnT5WWU57Rz2B5oapVK64Nsaqv0dAwMIuZt2N93WA..&...
Submission: On October 30 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 29th 2018. Valid for: 3 months.
This is the only time www2.bettertypeupgradeaflash.icu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Flash UpdateDomain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.104.235.28 172.104.235.28 | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
1 1 | 35.168.24.149 35.168.24.149 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 1 | 18.215.115.40 18.215.115.40 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
5 | 18.211.136.211 18.211.136.211 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 13.32.223.128 13.32.223.128 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6813:c797 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
8 | 5 |
ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1811-28.members.linode.com
sftasd.org |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-168-24-149.compute-1.amazonaws.com
wi.adpiano.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-215-115-40.compute-1.amazonaws.com
www.mediabestoriginalaflash.icu |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-211-136-211.compute-1.amazonaws.com
www2.bettertypeupgradeaflash.icu |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-32-223-128.fra56.r.cloudfront.net
js.bestquickcontentfiles.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
bettertypeupgradeaflash.icu
www2.bettertypeupgradeaflash.icu |
145 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
6 KB |
1 |
bestquickcontentfiles.com
js.bestquickcontentfiles.com |
2 KB |
1 |
mediabestoriginalaflash.icu
1 redirects
www.mediabestoriginalaflash.icu |
487 B |
1 |
adpiano.com
1 redirects
wi.adpiano.com |
340 B |
1 |
sftasd.org
sftasd.org |
437 B |
8 | 6 |
Domain | Requested by | |
---|---|---|
5 | www2.bettertypeupgradeaflash.icu |
sftasd.org
www2.bettertypeupgradeaflash.icu |
1 | cdnjs.cloudflare.com |
www2.bettertypeupgradeaflash.icu
|
1 | js.bestquickcontentfiles.com |
www2.bettertypeupgradeaflash.icu
|
1 | www.mediabestoriginalaflash.icu | 1 redirects |
1 | wi.adpiano.com | 1 redirects |
1 | sftasd.org | |
8 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.dirittnolaro.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www2.bettertypeupgradeaflash.icu Let's Encrypt Authority X3 |
2018-10-29 - 2019-01-27 |
3 months | crt.sh |
js.bestquickcontentfiles.com Amazon |
2018-07-02 - 2019-08-02 |
a year | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-22 - 2019-03-31 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www2.bettertypeupgradeaflash.icu/?b9zd1=i8N4-JGzT5FGmqBBm0CNHnKvRqHvuDyDXI8keRfLJ9RhhsnT5WWU57Rz2B5oapVK64Nsaqv0dAwMIuZt2N93WA..&cid=7571603070623356199&sid=4502866&v_id=tIIblmv9alZd4qp43ilyg5qvNlzHY-LvTpg4RwLQtio.
Frame ID: 6ACE9C83B8991A499AD4671DA0097E85
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/752af61b-b8ba-4f40-9ef7-62ac2a2376ca.png)
Page URL History Show full URLs
- http://sftasd.org/?sid=55194&site_id=MC2P5GMHFV&conv_id=ftkna8uhlqoshk6k3t12 Page URL
-
https://wi.adpiano.com/sestiusrfgakghskflhuteh/uetkgbvshbkahfka.php?utm_source=15480&utm_campaign=1...
HTTP 302
https://www.mediabestoriginalaflash.icu/?b9zd1=sifoLNT_3DewNs1GcvJgMhPA25_61clKuUZ22cNgheQ.&cid=7571603070623356199&... HTTP 302
https://www2.bettertypeupgradeaflash.icu/?b9zd1=i8N4-JGzT5FGmqBBm0CNHnKvRqHvuDyDXI8keRfLJ9RhhsnT5WWU57Rz2B5oapVK64Nsa... Page URL
Detected technologies
![](/vendor/wappa/icons/HeadJS.png)
Detected patterns
- env /^head$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Click here to update for latest version.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://sftasd.org/?sid=55194&site_id=MC2P5GMHFV&conv_id=ftkna8uhlqoshk6k3t12 Page URL
-
https://wi.adpiano.com/sestiusrfgakghskflhuteh/uetkgbvshbkahfka.php?utm_source=15480&utm_campaign=1379016&clck=7571603070623356199&sid=4502866
HTTP 302
https://www.mediabestoriginalaflash.icu/?b9zd1=sifoLNT_3DewNs1GcvJgMhPA25_61clKuUZ22cNgheQ.&cid=7571603070623356199&sid=4502866 HTTP 302
https://www2.bettertypeupgradeaflash.icu/?b9zd1=i8N4-JGzT5FGmqBBm0CNHnKvRqHvuDyDXI8keRfLJ9RhhsnT5WWU57Rz2B5oapVK64Nsaqv0dAwMIuZt2N93WA..&cid=7571603070623356199&sid=4502866&v_id=tIIblmv9alZd4qp43ilyg5qvNlzHY-LvTpg4RwLQtio. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sftasd.org/ |
279 B 437 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
![]() www2.bettertypeupgradeaflash.icu/ Redirect Chain
|
112 KB 77 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dl.min.js
js.bestquickcontentfiles.com/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apple.png
www2.bettertypeupgradeaflash.icu/images/om_flash/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
ua-parser.min.js
cdnjs.cloudflare.com/ajax/libs/UAParser.js/0.7.18/ |
14 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Chrome.png
www2.bettertypeupgradeaflash.icu/images/new_lp_images/lp101/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chrome1.png
www2.bettertypeupgradeaflash.icu/images/main/ |
15 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chrome2.png
www2.bettertypeupgradeaflash.icu/images/main/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Flash Update35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| UAParser object| d object| user object| $window object| $button object| steps object| brw string| imgName function| isElement function| onClick function| replaceText function| prepareSteps function| showSteps undefined| offsetX undefined| offsetY function| addListeners function| mouseUp function| mouseDown function| divMove object| dlobj function| dlfunc boolean| has_class string| host string| pdi_param_1 number| pdi_param_2 number| pdi_param_3 string| pdi_start_url object| head object| css object| adVars function| goToAd function| setFilterEffect function| close_modal_ad function| showModalAd function| httpGetAsync0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
js.bestquickcontentfiles.com
sftasd.org
wi.adpiano.com
www.mediabestoriginalaflash.icu
www2.bettertypeupgradeaflash.icu
13.32.223.128
172.104.235.28
18.211.136.211
18.215.115.40
2400:cb00:2048:1::6813:c797
35.168.24.149
1bcbdee1992f8dbbc4c7f0254dad16177c9b55b61362a526bc195021dcc6b43c
2d81b21b9630dbfb3350f58d3e3a4e3480680d203fb1a0fde378b546d64b6d5c
899471667dd971c4f2784b0ee3dd32a5eba74be2531c8f75425b4a47384c6229
8c5d5209dc5ba7581664cefb7401bad7778f5f00427680adefdd833053781967
a11bdefe5f3317ce495ff60c664f979d4ecc89f17c3ba1299246b94bdb189ffb
add554ae6eb172aacf9f78ba2b4bd7149c0ad84c4e5f424fee8aa0ac09d0e7ca
cc552570b5c8c4fb338ef812cde7e7e92c7b89fbf6861f13fdf9c2e50dc4a311
f32fcdc2c152df13186e0592493286d155458a8f812229e7c597e1a828fed085