urlscan.io logo urlscan.io
SecurityTrails logo

www.gitfpubgs.zyns.com Open in urlscan Pro
194.135.95.226  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Submission: On February 11 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 9 HTTP transactions. The main IP is 194.135.95.226, located in Lithuania and belongs to RACKRAY UAB Rakrejus, LT. The main domain is www.gitfpubgs.zyns.com.
This is the only time www.gitfpubgs.zyns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
6 194.135.95.226 62282 (RACKRAY U...)
1 2 23.210.248.44 16625 (AKAMAI-AS)
1 2.18.235.40 16625 (AKAMAI-AS)
1 2.21.36.164 20940 (AKAMAI-ASN1)
9 4
Apex Domain
Subdomains		 Transfer
6 zyns.com
www.gitfpubgs.zyns.com
111 KB
2 addthis.com
s7.addthis.com
113 KB
1 addthisedge.com
v1.addthisedge.com
325 B
1 moatads.com
z.moatads.com
1 KB
9 4
Domain Requested by
6 www.gitfpubgs.zyns.com www.gitfpubgs.zyns.com
2 s7.addthis.com 1 redirects www.gitfpubgs.zyns.com
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
9 4

This site contains no links.

Subject Issuer Validity Valid
odc-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2019-10-10 -
2020-09-04		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.gitfpubgs.zyns.com/login/facebook/
Frame ID: F03E6A12868C83C4E715B108884DE6F5
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /addthis\.com\/js\//i

Page Statistics

9
Requests

33 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

226 kB
Transfer

461 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • http://s7.addthis.com/js/300/addthis_widget.js HTTP 308
  • https://s7.addthis.com/js/300/addthis_widget.js

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.gitfpubgs.zyns.com/login/facebook/ 		6 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
c687d0cdb6097656e2383719e9ef7cfcc802fe24e7537a86489e4b3ba66e5d52

Request headers

Host
www.gitfpubgs.zyns.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:44 GMT
Server
Apache
Last-Modified
Wed, 13 Nov 2019 18:26:12 GMT
Accept-Ranges
bytes
Content-Length
6078
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
tpmBF2cA-iG1f8e.css
www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/yB/l/0%2ccross/ 		49 KB
49 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/yB/l/0%2ccross/tpmBF2cA-iG1f8e.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
104b8176aa2ad40a1c913ef5f1a4f8535f319564ef211b7a0ebdff8c02d66db4

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:44 GMT
Last-Modified
Sun, 10 Nov 2019 21:11:06 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
50119
qMo9Nrl4WeY1f8e.css
www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/y3/l/0%2ccross/ 		36 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/y3/l/0%2ccross/qMo9Nrl4WeY1f8e.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
f625c6a40db73519d8b157689193a0745c290cf1bbff73ded63df5268556c6b3

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:45 GMT
Last-Modified
Sun, 10 Nov 2019 21:11:06 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
36809
0fjRDqSItl-1f8e.css
www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/y_/l/0%2ccross/ 		127 B
367 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/y_/l/0%2ccross/0fjRDqSItl-1f8e.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
7aebc236fa10fe1952e2d58cc8481e4c561d4d4e51dd766c33b0ce7582259fae

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:45 GMT
Last-Modified
Sun, 10 Nov 2019 21:11:04 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
127
addthis_widget.js
s7.addthis.com/js/300/
Redirect Chain
  • http://s7.addthis.com/js/300/addthis_widget.js
  • https://s7.addthis.com/js/300/addthis_widget.js
349 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-44.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
580065b866725e710cd9dd4228ee9cbcf2f4168cd818b244c41ca25e5d90b0f8
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Tue, 21 Jan 2020 20:57:37 GMT
server
nginx/1.15.8
etag
"5e2765c1-57446"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
status
200
cache-control
public, max-age=600
date
Tue, 11 Feb 2020 01:17:46 GMT
x-host
s7.addthis.com
content-length
114924

Redirect headers

Date
Tue, 11 Feb 2020 01:17:46 GMT
Server
nginx/1.15.8
X-Distribution
99
Content-Type
text/html
Location
https://s7.addthis.com/js/300/addthis_widget.js
X-Host
s7.addthis.com
Connection
keep-alive
Content-Length
171
icon_logom.png
www.gitfpubgs.zyns.com/login/facebook/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/img/icon_logom.png
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
e2eafa7cdfc62c1bba8d6536fd20e77646620593d24ebae72dd8a13aab45351b

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:45 GMT
Last-Modified
Sun, 10 Nov 2019 21:11:06 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
10435
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Tue, 11 Feb 2020 01:17:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Nov 2019 20:13:52 GMT
Server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
ETag
"f14b4e1f799b14f798a195f43cf58376"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=37857
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-5dcbabd2869127ad/ 		165 B
325 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-5dcbabd2869127ad/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-36-164.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
879dce98bcbc961e11b2a57f801408fc28d755ac827ff496493ea743e252a884

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Tue, 11 Feb 2020 01:17:47 GMT
content-encoding
gzip
etag
1183136534
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
public, max-age=55, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
153
41TvQ87KEvs.png
www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/yQ/r/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/yQ/r/41TvQ87KEvs.png
Requested by
Host: www.gitfpubgs.zyns.com
URL: http://www.gitfpubgs.zyns.com/login/facebook/
Protocol
HTTP/1.1
Server
194.135.95.226 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS
cloud.hostfzth.icu
Software
Apache /
Resource Hash
683e2e7e95561de83d40507bc53daef1ac12c28d69071ec2fe36aafedd8b4fa4

Request headers

Referer
http://www.gitfpubgs.zyns.com/login/facebook/rsrc.php/v3/yB/l/0%2ccross/tpmBF2cA-iG1f8e.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 11 Feb 2020 01:17:46 GMT
Last-Modified
Sun, 10 Nov 2019 21:11:04 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
8832

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| addthis_config object| addthis_share boolean| __@@##MUH

2 Cookies

Domain/Path Name / Value
www.gitfpubgs.zyns.com/ Name: __atuvs
Value: 5e4200ba4905c143000
www.gitfpubgs.zyns.com/ Name: __atuvc
Value: 1%7C7