111905087232066.ga Open in urlscan Pro
144.76.156.2  Malicious Activity!

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 111905087232066.ga/	14 KB 6 KB	581ms 71ms	Document text/html	144.76.156.2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://111905087232066.ga/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 144.76.156.2 Kurten, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS krishna.genxwhosting.com Software Apache/2 / Resource Hash f467a3a908fdedcb8af1cfb80bed6f6e990b021945ad10247f2b94294ffcbb0f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 5922 content-type text/html; charset=UTF-8 date Fri, 21 Oct 2022 03:17:31 GMT server Apache/2 vary Accept-Encoding,User-Agent
GET H2	200	style-pay.css 111905087232066.ga/css/fax/	45 KB 5 KB	30ms 29ms	Stylesheet text/css	144.76.156.2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://111905087232066.ga/css/fax/style-pay.css Requested by Host: 111905087232066.ga URL: https://111905087232066.ga/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 144.76.156.2 Kurten, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS krishna.genxwhosting.com Software Apache/2 / Resource Hash 3a56c06795eed899bb11ab46a1cd7b554584d9969748b4a65240a28b4df48694 Request headers accept-language de-DE,de;q=0.9 Referer https://111905087232066.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Fri, 21 Oct 2022 03:17:32 GMT content-encoding gzip last-modified Thu, 13 Oct 2022 06:59:22 GMT server Apache/2 etag "b2a0-5eae50c84e680-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes content-length 4917
GET H2	200	pAy5sS6Se6DC.css 111905087232066.ga/css/fax/	446 KB 132 KB	38ms 38ms	Stylesheet text/css	144.76.156.2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://111905087232066.ga/css/fax/pAy5sS6Se6DC.css Requested by Host: 111905087232066.ga URL: https://111905087232066.ga/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 144.76.156.2 Kurten, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS krishna.genxwhosting.com Software Apache/2 / Resource Hash 62a13047830b787495aa8816cc1419190cc229357897ce5709ae54091d82c332 Request headers accept-language de-DE,de;q=0.9 Referer https://111905087232066.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Fri, 21 Oct 2022 03:17:32 GMT content-encoding gzip last-modified Thu, 13 Oct 2022 06:42:00 GMT server Apache/2 etag "6f980-5eae4ce693e00-gzip" vary Accept-Encoding,User-Agent content-type text/css accept-ranges bytes
GET DATA	200 OK	truncated /	135 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/png
GET H2	200	IcoMeT4.png 111905087232066.ga/image/	58 KB 58 KB	29ms 29ms	Image image/png	144.76.156.2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://111905087232066.ga/image/IcoMeT4.png Requested by Host: 111905087232066.ga URL: https://111905087232066.ga/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 144.76.156.2 Kurten, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS krishna.genxwhosting.com Software Apache/2 / Resource Hash fde02149c2e7567be7337ac3a9e318daae5753c7584bac0232d50eda3bef79c9 Request headers accept-language de-DE,de;q=0.9 Referer https://111905087232066.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Fri, 21 Oct 2022 03:17:32 GMT last-modified Sun, 02 Oct 2022 07:58:50 GMT server Apache/2 accept-ranges bytes etag "e744-5ea0898ef2280" content-length 59204 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| mousedwn string| tanggallengkap object| namahari object| namabulan object| tgl number| hari number| tanggal number| bulan number| tahun

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

111905087232066.ga
144.76.156.2
3a56c06795eed899bb11ab46a1cd7b554584d9969748b4a65240a28b4df48694
62a13047830b787495aa8816cc1419190cc229357897ce5709ae54091d82c332
c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675
f467a3a908fdedcb8af1cfb80bed6f6e990b021945ad10247f2b94294ffcbb0f
fde02149c2e7567be7337ac3a9e318daae5753c7584bac0232d50eda3bef79c9