www.tikt0k-support.ru
Open in
urlscan Pro
2a03:6f00:1::5c35:60bf
Malicious Activity!
Public Scan
URL:
https://www.tikt0k-support.ru/
Submission: On October 14 via automatic, source certstream-suspicious
Submission: On October 14 via automatic, source certstream-suspicious
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 2a03:6f00:1::5c35:60bf, located in
Russian Federation and
belongs to TIMEWEB-AS, RU.
The main domain is www.tikt0k-support.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3 months.
This is the only time www.tikt0k-support.ru was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3 months.
This is the only time www.tikt0k-support.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: TikTok (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 2a03:6f00:1::... 2a03:6f00:1::5c35:60bf | 9123 (TIMEWEB-AS) (TIMEWEB-AS) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 7 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
tikt0k-support.ru
www.tikt0k-support.ru |
463 KB |
| 1 |
googleapis.com
ajax.googleapis.com |
30 KB |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | www.tikt0k-support.ru |
www.tikt0k-support.ru
|
| 1 | ajax.googleapis.com |
www.tikt0k-support.ru
|
| 7 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| support.tiktok.com |
| www.tiktok.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| tikt0k-support.ru Let's Encrypt Authority X3 |
2020-10-14 - 2021-01-12 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1O1 |
2020-09-22 - 2020-12-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.tikt0k-support.ru/
Frame ID: B40019B4BDBB3098F64B959F0658DC6B
Requests: 9 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
URL: https://support.tiktok.com/ru
Title: Обратная связь и помощь
Title: Обратная связь и помощь
Search URL Search Domain Scan URL
URL: https://www.tiktok.com/trending
Search URL Search Domain Scan URL
URL: https://www.tiktok.com/signup?lang=ru
Title: Забыли пароль?
Title: Забыли пароль?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.tikt0k-support.ru/ |
24 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading.de997145.gif
www.tikt0k-support.ru/core/ |
23 KB 23 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.0/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sofiapro-regular.otf
www.tikt0k-support.ru/core/ |
155 KB 155 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
521 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hidePassword.316c9e71.svg
www.tikt0k-support.ru/core/ |
801 B 983 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Proxima-Nova-Regular.otf
www.tikt0k-support.ru/core/ |
134 KB 134 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Proxima-Nova-Bold.otf
www.tikt0k-support.ru/core/ |
138 KB 139 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: TikTok (Social Network)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
www.tikt0k-support.ru
2a00:1450:4001:808::200a
2a03:6f00:1::5c35:60bf
0e33144028c0206ade61f8aaab12bf2cd7a1b2abbbcf5036d487a7cae16be9bc
1565f93098b6935add0af93015b436b72d37b85973bb3b4ed8bde279f1f0dedf
21387d49779e6ad4ce969a865eb7543619aa37f3bd9c3243018340b08b774e3e
6f17dbea8b6db5fd570d0a498b3a082691979671adf03ac1aa3c20697ec8296e
8a102873a33f24f7eb22221e6b23c4f718e29f85168ecc769a35bfaed9b12cce
b1fb6db7fb9b71519ef57c1352cd8510e9789110fbc780103a2becfa850bb79d
cc1058f0f690b91d486b7f8e6da82692fe16dd4dd407304088a7d526576039d4
e145b1a56b822a1f604021905dc0c661a5447c13a569b6424be2abc8c140b668
f8e3b229ab6cdef3fe8a712b1b52708f5d075d3ef9b1f0ec6f030bfd62035663