urlscan.io logo urlscan.io
SecurityTrails logo

8views.com Open in urlscan Pro
139.59.83.143  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://k8bet9.com/wp-content/remoteg/centmob/
Effective URL: https://8views.com/resumes/logme/keyman/
Submission Tags: https://phish.report @phish_report Search All
Submission: On April 14 via api from FI — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 139.59.83.143, located in Bengaluru, India and belongs to DIGITALOCEAN-ASN, US. The main domain is 8views.com.
TLS certificate: Issued by R3 on April 4th 2023. Valid for: 3 months.
This is the only time 8views.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GCash (Financial)

Domain & IP information

IP Address AS Autonomous System
1 139.59.104.143 14061 (DIGITALOC...)
3 139.59.83.143 14061 (DIGITALOC...)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
6 4
Apex Domain
Subdomains		 Transfer
3 8views.com
8views.com
12 KB
1 gstatic.com
fonts.gstatic.com
21 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39
986 B
1 k8bet9.com
k8bet9.com
238 B
6 4
Domain Requested by
3 8views.com 8views.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com 8views.com
1 k8bet9.com
6 4

This site contains no links.

Subject Issuer Validity Valid
www.k8bet9.com
R3		 2023-04-09 -
2023-07-08		 3 months crt.sh
8views.com
R3		 2023-04-04 -
2023-07-03		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-28 -
2023-06-20		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-03-28 -
2023-06-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://8views.com/resumes/logme/keyman/
Frame ID: 7B5F7150EB78118D2F32987B7C4FED82
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

GCash

Page URL History Show full URLs

  1. https://k8bet9.com/wp-content/remoteg/centmob/ Page URL
  2. https://8views.com/resumes/logme/keyman/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

34 kB
Transfer

38 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://k8bet9.com/wp-content/remoteg/centmob/ Page URL
  2. https://8views.com/resumes/logme/keyman/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
k8bet9.com/wp-content/remoteg/centmob/ 		91 B
238 B 		Document
General
Check archive.org
Download Go to
Full URL
https://k8bet9.com/wp-content/remoteg/centmob/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
139.59.104.143 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
k8bet9.com
Software
nginx /
Resource Hash
92b405b21deb4d195d0c3ba1e5ca44e7c52c6d0b87aedc54cbcb5ea070595ce9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 14 Apr 2023 09:36:10 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
Primary Request /
8views.com/resumes/logme/keyman/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://8views.com/resumes/logme/keyman/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
139.59.83.143 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
8d39ceb5b199757e1f43a54389bf7c23795573e5e75af16cd6163a1a6ab7544e

Request headers

Referer
https://k8bet9.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1546
Content-Type
text/html; charset=UTF-8
Date
Fri, 14 Apr 2023 09:36:11 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding
index.css
8views.com/resumes/logme/keyman/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://8views.com/resumes/logme/keyman/css/index.css
Requested by
Host: 8views.com
URL: https://8views.com/resumes/logme/keyman/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
139.59.83.143 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://8views.com/resumes/logme/keyman/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date
Fri, 14 Apr 2023 09:36:11 GMT
Server
Apache/2.4.29 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
273
Content-Type
text/html; charset=iso-8859-1
css
fonts.googleapis.com/ 		4 KB
986 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Karla|Karla:Bold|Poppins|Poppins:600&display=swap
Requested by
Host: 8views.com
URL: https://8views.com/resumes/logme/keyman/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4003:c11::5f , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3caeda766e91ada15e6091181bf9cf59e1e8a3e3c94c361d17fa473991c3ac91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://8views.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 14 Apr 2023 09:36:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 14 Apr 2023 09:36:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 14 Apr 2023 09:36:11 GMT
gcash-1024x768.png
8views.com/resumes/logme/keyman/Gcash_files/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://8views.com/resumes/logme/keyman/Gcash_files/gcash-1024x768.png
Requested by
Host: 8views.com
URL: https://8views.com/resumes/logme/keyman/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
139.59.83.143 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
0b022da978f07df901703de2ba5b3303fbb496a81d05964e4bc079ae04275fdf

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://8views.com/resumes/logme/keyman/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date
Fri, 14 Apr 2023 09:36:11 GMT
Last-Modified
Fri, 05 Nov 2021 10:03:16 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"26aa-5d007c0782100"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
9898
qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v23/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/karla/v23/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Karla|Karla:Bold|Poppins|Poppins:600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4003:c04::5e , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8c2240958cb1fff47d921ca0f3097f9e7403ada01af2382477ef42c404c38d4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://8views.com
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Sun, 09 Apr 2023 20:13:23 GMT
x-content-type-options
nosniff
age
393768
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21248
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 20:38:57 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 08 Apr 2024 20:13:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GCash (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| isNumber function| length_disabled_btn

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://8views.com/resumes/logme/keyman/css/index.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000