gg001.ml
Open in
urlscan Pro
185.125.78.217
Malicious Activity!
Public Scan
Effective URL: http://gg001.ml/?lang=de
Submission: On June 21 via manual from US
Summary
This is the only time gg001.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 185.125.78.217 185.125.78.217 | 60458 (ASN-XTUDI...) (ASN-XTUDIONET) | |
1 | 185.225.208.133 185.225.208.133 | 13213 (UK2NET-AS) (UK2NET-AS) | |
1 | 107.182.231.45 107.182.231.45 | 32780 (HOSTINGSE...) (HOSTINGSERVICES-INC - Hosting Services) | |
2 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
1 | 104.16.87.26 104.16.87.26 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
7 | 208.100.17.185 208.100.17.185 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
1 | 208.100.17.187 208.100.17.187 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
19 | 8 |
ASN32780 (HOSTINGSERVICES-INC - Hosting Services, Inc., US)
PTR: 6bb6e72d.setaptr.net
t.dtscout.com |
ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us
whos.amung.us |
ASN32748 (STEADFAST - Steadfast, US)
PTR: ip185.208-100-17.static.steadfastdns.net
ic.tynt.com |
ASN32748 (STEADFAST - Steadfast, US)
PTR: ip187.208-100-17.static.steadfastdns.net
de.tynt.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
tynt.com
cdn.tynt.com ic.tynt.com de.tynt.com |
8 KB |
7 |
gg001.ml
1 redirects
gg001.ml |
245 KB |
3 |
amung.us
widgets.amung.us whos.amung.us |
4 KB |
1 |
dtscout.com
t.dtscout.com |
379 B |
19 | 4 |
Domain | Requested by | |
---|---|---|
7 | ic.tynt.com |
gg001.ml
|
7 | gg001.ml |
1 redirects
gg001.ml
|
2 | whos.amung.us |
widgets.amung.us
|
1 | de.tynt.com |
cdn.tynt.com
|
1 | cdn.tynt.com |
widgets.amung.us
|
1 | t.dtscout.com |
widgets.amung.us
|
1 | widgets.amung.us |
gg001.ml
|
19 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://gg001.ml/?lang=de
Frame ID: AD4228C4324317286B9C7FF215A3FDCC
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://gg001.ml/
HTTP 302
http://gg001.ml/?lang=de Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://gg001.ml/
HTTP 302
http://gg001.ml/?lang=de Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
gg001.ml/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tSOgnJdhTc3.css
gg001.ml/css/ |
30 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
9an7U6cZys0.css
gg001.ml/css/ |
68 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
gg001.ml/css/ |
1 KB 928 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fEZ5x2OZgwl.js
gg001.ml/js/ |
248 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
gg001.ml/img/ |
127 KB 127 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
small.js
widgets.amung.us/ |
7 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
t.dtscout.com/i/ |
17 B 379 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
whos.amung.us/pingjs/ |
32 B 216 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
whos.amung.us/pingjs/ |
30 B 214 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tc.js
cdn.tynt.com/ |
16 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 316 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
v2
de.tynt.com/deb/ |
4 B 250 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p
ic.tynt.com/b/ |
0 151 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| __DEV__ function| __annotator function| __bodyWrapper function| __m function| __t function| __w object| babelHelpers function| define function| require function| requireDynamic function| requireLazy function| __d object| ErrorUtils function| ProfilingCounters object| TimeSlice string| cpa string| index function| __updateOrientation undefined| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_cps function| docReady object| _dts object| x string| x1 string| x2 object| Tynt object| _33Across function| __cmp3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gg001.ml/ | Name: 2Nf8zJ4oH8vPvwUyzhQhY1mO30thIH7MBanBtDZCBtbkNl979971JntUZqTSO6czexqILCwJ2bfvAVECgtX7aNEeQpjIsWc8FF5K Value: 1 |
|
gg001.ml/ | Name: detect Value: Mk5mOHpKNG9IOHZQdndVeXpoUWhZMW1PMzB0aElIN01CYW5CdERaQ0J0YmtObDk3OTk3MUpudFVacVRTTzZjemV4cUlMQ3dKMmJmdkFWRUNndFg3YU5FZVFwaklzV2M4RkY1Sz0tMSwyTmY4eko0b0g4dlB2d1V5emhRaFkxbU8zMHRoSUg3TUJhbkJ0RFpDQnRia05sOTc5OTcxSm50VVpxVFNPNmN6ZXhxSUxDd0oyYmZ2QVZFQ2d0WDdhTkVlUXBqSXNXYzhGRjVLPTAsMk5mOHpKNG9IOHZQdndVeXpoUWhZMW1PMzB0aElIN01CYW5CdERaQ0J0YmtObDk3OTk3MUpudFVacVRTTzZjemV4cUlMQ3dKMmJmdkFWRUNndFg3YU5FZVFwaklzV2M4RkY1Sz0xLDJOZjh6SjRvSDh2UHZ3VXl6aFFoWTFtTzMwdGhJSDdNQmFuQnREWkNCdGJrTmw5Nzk5NzFKbnRVWnFUU082Y3pleHFJTEN3SjJiZnZBVkVDZ3RYN2FORWVRcGpJc1djOEZGNUs9MiwyTmY4eko0b0g4dlB2d1V5emhRaFkxbU8zMHRoSUg3TUJhbkJ0RFpDQnRia05sOTc5OTcxSm50VVpxVFNPNmN6ZXhxSUxDd0oyYmZ2QVZFQ2d0WDdhTkVlUXBqSXNXYzhGRjVLPTM= |
|
gg001.ml/ | Name: PHPSESSID Value: dd388a333f1a30a042cea61ad938677d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.tynt.com
de.tynt.com
gg001.ml
ic.tynt.com
t.dtscout.com
whos.amung.us
widgets.amung.us
104.16.87.26
107.182.231.45
185.125.78.217
185.225.208.133
208.100.17.185
208.100.17.187
67.202.94.93
1be72a6fd3de0461f912fe5e59edbb445c57f182c9cdbe96052741384ccefc17
1f0b4598b7e8f61d46bd01c1abc79a6a0a56ee7a922de1505c45953652e3d6f3
37c5cbe8ad795a530c7ad3e2a3574a4f9038c3fc10fc48ca4c1c74ed9ffdc6a4
44c824e0d4b5e2720f5ed2bd62f210987281bcabc8acdb6fc316d9de87235808
479cb91730eef777856825b3a30f19536770ed45c7120117de44e56b7db826c6
4a233525e26bb26db9a20f3922e8d665efe0fb0bd602f517184984ccff9bef66
54013fe95d54f0a9fc356042fbdb28f350cd92fa8e879f26510377d8f5f483fc
56b3a78bf4df13e8416cb28e5f1bfa7749c6f27cf7d87cfec5a445eb8d1dbc6d
cb97e3ac17e6bb8da089407d483489fd39a67fb85b225413f1bf7ae0c516d7ef
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
e0d357e1ba7356033c48b227aed69ed26288fb6e1878651e7010971d3204f203
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5d9aec8ad6b3af21fe1f17becac34e1bfd59d296df3064255eee9c612cb6848
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac