verified-support.com Open in urlscan Pro
198.46.87.233  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request mailconfirmation.php Show response verified-support.com/	169 KB 169 KB	293ms 179ms	Document text/html	198.46.87.233 INMOTI-1
General Check archive.org Show headers Download Go to Full URL http://verified-support.com/mailconfirmation.php Protocol HTTP/1.1 Server 198.46.87.233 El Segundo, United States, ASN54641 (INMOTI-1, US), Reverse DNS vps60444.inmotionhosting.com Software Apache / Resource Hash 4266d08e39f6f3255d13910bd5d0eda78d3406dcb6137ea298e7e66aae66174b Request headers Host verified-support.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 10 Aug 2020 01:12:33 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	33ms 6ms	Script text/javascript	2a00:1450:4001:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: verified-support.com URL: http://verified-support.com/mailconfirmation.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://verified-support.com/mailconfirmation.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 06 Aug 2020 21:11:46 GMT content-encoding gzip x-content-type-options nosniff age 273648 status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 06 Aug 2021 21:11:46 GMT
GET		__cpa.cp.js newbigdata.science/	0 0
GET H2	200	logo.png image.ibb.co/fjkP4z/	3 KB 3 KB	74ms 20ms	Image image/png	51.210.112.129 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://image.ibb.co/fjkP4z/logo.png Requested by Host: verified-support.com URL: http://verified-support.com/mailconfirmation.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 51.210.112.129 , France, ASN16276 (OVH, FR), Reverse DNS i.ibb.co Software nginx / Resource Hash 8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc Request headers Referer http://verified-support.com/mailconfirmation.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 10 Aug 2020 01:12:34 GMT last-modified Sun, 16 Sep 2018 15:18:11 GMT server nginx status 200 access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 3273 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	1200px-Mail.svg.png upload.wikimedia.org/wikipedia/commons/thumb/d/d3/Mail.svg/	42 KB 43 KB	54ms 22ms	Image image/png	2620:0:862:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/thumb/d/d3/Mail.svg/1200px-Mail.svg.png Requested by Host: verified-support.com URL: http://verified-support.com/mailconfirmation.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/8.0.8 / Resource Hash 33f4d9a0f15df4807d4b767bb7a6cf618f2f02c276181032850ae1163a772f95 Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload Request headers Referer http://verified-support.com/mailconfirmation.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 09 Aug 2020 15:16:21 GMT age 35773 x-cache-status hit-front x-cache cp3061 hit, cp3059 hit/2 status 200 content-disposition inline;filename*=UTF-8''Mail.svg.png server-timing cache;desc="hit-front" content-length 43429 x-client-ip 2a01:4f8:192:5414::2 x-object-meta-sha1base36 joe3lzr38gpraf3int8b8bi2hjotlev last-modified Thu, 12 Dec 2013 14:27:13 GMT server ATS/8.0.8 etag 3a0ac5bd38e0427aaa05b35bc8b607d0 strict-transport-security max-age=106384710; includeSubDomains; preload content-type image/png access-control-allow-origin * x-timestamp 1386858432.75028 accept-ranges bytes timing-allow-origin * access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
GET		qMnGlIs-JNW.js newbigdata.science/connect/xd_arbiter/r/ Frame FFB6	0 0
GET		ping newbigdata.science/connect/ Frame C5ED	0 0
GET H2	200	2115b50d229d.png instagram.com/static/bundles/base/sprite_core.png/	128 KB 128 KB	1488ms 1283ms	Image image/png	2406:da00:ff00::34ca:4a7f AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://instagram.com/static/bundles/base/sprite_core.png/2115b50d229d.png Requested by Host: verified-support.com URL: http://verified-support.com/mailconfirmation.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2406:da00:ff00::34ca:4a7f Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash 405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8 Request headers Referer https://instagram.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 10 Aug 2020 01:12:39 GMT content-encoding br status 200 etag "2115b50d229d" vary Accept-Encoding content-type image/png access-control-allow-origin * edge-control max-age=1209600, no-transform cache-control public,max-age=31536000,immutable alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 130927

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

newbigdata.science

URL

https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1

Domain

newbigdata.science

URL

https://newbigdata.science/connect/xd_arbiter/r/qMnGlIs-JNW.js?version=42&__cpo=aHR0cHM6Ly9zdGF0aWN4eC5mYWNlYm9vay5jb20

Domain

newbigdata.science

URL

https://newbigdata.science/connect/ping?client_id=124024574287414&domain=www.instagram.com&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FqMnGlIs-JNW.js%3Fversion%3D42%23cb%3Df1f19c0950ec264%26domain%3Dwww.instagram.com%26origin%3Dhttps%253A%252F%252Fwww.instagram.com%252Ff59a022dfc20ec%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.2&__cpo=aHR0cHM6Ly93d3cuZmFjZWJvb2suY29t

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getCookie object| notification object| hostingerLogo undefined| mainContent object| newList undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| h1Tag undefined| paragraph undefined| list undefined| listElements undefined| org_html undefined| new_html undefined| saleImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
image.ibb.co
instagram.com
newbigdata.science
upload.wikimedia.org
verified-support.com
newbigdata.science
198.46.87.233
2406:da00:ff00::34ca:4a7f
2620:0:862:ed1a::2:b
2a00:1450:4001:81e::200a
51.210.112.129
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
33f4d9a0f15df4807d4b767bb7a6cf618f2f02c276181032850ae1163a772f95
405e90473f7ac27061af0027ea856fe80c6f71310edb768f23f774c4088eb8c8
4266d08e39f6f3255d13910bd5d0eda78d3406dcb6137ea298e7e66aae66174b
8d462c8f2d10700b31c8263fca0da5b11f0921a99eb15c1c3cebc1e37889b1cc