alert3fbb0-seeagreetoterms.biz.id

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 70.39.90.16, located in Denver, United States and belongs to SHARKTECH, US. The main domain is alert3fbb0-seeagreetoterms.biz.id.

This is the only time alert3fbb0-seeagreetoterms.biz.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	70.39.90.16 70.39.90.16	46844 (SHARKTECH) (SHARKTECH)
2	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
1	104.21.235.69 104.21.235.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3

2 70.39.90.16 (Denver, United States)

ASN46844 (SHARKTECH, US)
PTR: paul.baae.org

alert3fbb0-seeagreetoterms.biz.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.235.69 (None, )

ASN13335 (CLOUDFLARENET, US)

iili.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 381	54 KB
2	alert3fbb0-seeagreetoterms.biz.id alert3fbb0-seeagreetoterms.biz.id	69 KB
1	iili.io iili.io — Cisco Umbrella Rank: 43490	3 KB
5	3

	Domain	Requested by
2	cdn.jsdelivr.net	alert3fbb0-seeagreetoterms.biz.id
2	alert3fbb0-seeagreetoterms.biz.id
1	iili.io	alert3fbb0-seeagreetoterms.biz.id
5	3

This site contains no links.

Subject Issuer	Validity	Valid
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
iili.io E1	`2024-06-01` - `2024-08-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://alert3fbb0-seeagreetoterms.biz.id/
Frame ID: 1EFB2850C8FAB343040AEB478EE921AE
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pаgе Help Suрроrt Team

Page URL History Show full URLs

http://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
https://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
http://alert3fbb0-seeagreetoterms.biz.id/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

60 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

127 kB
Transfer

344 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
https://alert3fbb0-seeagreetoterms.biz.id/ HTTP 307
http://alert3fbb0-seeagreetoterms.biz.id/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
alert3fbb0-seeagreetoterms.biz.id/
Redirect Chain

http://alert3fbb0-seeagreetoterms.biz.id/
https://alert3fbb0-seeagreetoterms.biz.id/
http://alert3fbb0-seeagreetoterms.biz.id/

8 KB
3 KB

914ms
911ms

Document
text/html

70.39.90.16
SHARKTECH

General

Check archive.org

Show headers Download Go to

Full URL: http://alert3fbb0-seeagreetoterms.biz.id/
Protocol: HTTP/1.1
Server: 70.39.90.16 Denver, United States, ASN46844 (SHARKTECH, US),
Reverse DNS: paul.baae.org
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 20796d9437416caaf0047341e918da97b336978d0f3d78556d5844f0b5abd105

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Encoding: gzip
Content-Length: 2672
Content-Type: text/html
Date: Thu, 27 Jun 2024 20:54:51 GMT
ETag: "4b16bf228dc7da1:0"
Last-Modified: Wed, 26 Jun 2024 05:53:14 GMT
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
X-Powered-By: ASP.NET

Redirect headers

Location: http://alert3fbb0-seeagreetoterms.biz.id/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/ 189 KB
30 KB 160ms
51ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css

Requested by

Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: http://alert3fbb0-seeagreetoterms.biz.id/
Origin: http://alert3fbb0-seeagreetoterms.biz.id
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 27 Jun 2024 20:54:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1854977
x-jsd-version: 5.2.0-beta1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 30281
x-served-by: cache-fra-etou8220113-FRA, cache-mxp6920-MXP
x-jsd-version-type: version
etag: W/"2f3f9-YnOsGiPXmhIvAi9qh8W3XCz6/Do"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 J6cGg99.png
iili.io/ 3 KB
3 KB 122ms
57ms Image
image/png 104.21.235.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://iili.io/J6cGg99.png
Requested by: Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.235.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: http://alert3fbb0-seeagreetoterms.biz.id/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 27 Jun 2024 20:54:52 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 121643
alt-svc: h3=":443"; ma=86400
content-length: 2987
last-modified: Tue, 14 May 2024 12:14:34 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3nBU8LfWIt6ZdeU%2B4Ltn2LM1ehaOGY3OLWoOwA7ybx%2FFHpHmwq0r5J2JXm6NSp0gzyoCbdlbo7IXnDoSdO%2BTFLUNzZGdACAaLU5qV7oufkk2QaRfprTt97Dl"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 89a855b06b681e0c-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/ 78 KB
24 KB 160ms
52ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/bootstrap.bundle.min.js

Requested by

Host: alert3fbb0-seeagreetoterms.biz.id
URL: http://alert3fbb0-seeagreetoterms.biz.id/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

2515e37eee31f5ef3d659b21dcc84dc6ea732b06872da51078b5b526de34c0c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: http://alert3fbb0-seeagreetoterms.biz.id/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 27 Jun 2024 20:54:52 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1885266
x-jsd-version: 5.2.0-beta1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 24445
x-served-by: cache-fra-eddf8230137-FRA, cache-mxp6924-MXP
x-jsd-version-type: version
etag: W/"1377e-a0uYWpCr16scLjX/O4dNB8+EEO4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK meta_logo_icon_214665.ico
alert3fbb0-seeagreetoterms.biz.id/img/ 66 KB
66 KB 171ms
171ms Other
image/x-icon 70.39.90.16
SHARKTECH

General

Check archive.org

Show headers Download Go to

Full URL: http://alert3fbb0-seeagreetoterms.biz.id/img/meta_logo_icon_214665.ico
Protocol: HTTP/1.1
Server: 70.39.90.16 Denver, United States, ASN46844 (SHARKTECH, US),
Reverse DNS: paul.baae.org
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 39e97584b4390e1d77866903ca5f0afb31e51138ad227a3fca83dc8c4fbe2932

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: http://alert3fbb0-seeagreetoterms.biz.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Thu, 27 Jun 2024 20:54:51 GMT
Last-Modified: Tue, 14 May 2024 12:19:30 GMT
Server: Microsoft-IIS/10.0
ETag: "0f578f8f8a5da1:0"
X-Powered-By: ASP.NET
Content-Type: image/x-icon
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 67646

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence number| uidEvent object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alert3fbb0-seeagreetoterms.biz.id
cdn.jsdelivr.net
iili.io
104.21.235.69
2a04:4e42:600::485
70.39.90.16
20796d9437416caaf0047341e918da97b336978d0f3d78556d5844f0b5abd105
2515e37eee31f5ef3d659b21dcc84dc6ea732b06872da51078b5b526de34c0c1
39e97584b4390e1d77866903ca5f0afb31e51138ad227a3fca83dc8c4fbe2932
9fc2fe17fa35dc50cbac42366d82e564d0a6e29a6b18f966ba78641b92850514
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf

alert3fbb0-seeagreetoterms.biz.id Open in urlscan Pro 70.39.90.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

127 kBTransfer

344 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

alert3fbb0-seeagreetoterms.biz.id Open in urlscan Pro
70.39.90.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

127 kB
Transfer

344 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!