![](/screenshots/c80bda3b-7adb-49a1-b5ba-527c660fd98a.png)
herbshopperlive.com
Open in
urlscan Pro
2606:4700:3037::ac43:c73e
Malicious Activity!
Public Scan
Effective URL: https://herbshopperlive.com/sweeps_3/index_9.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=&clickid=23fa9c...
Submission Tags: demotag1 demotag2 Search All
Submission: On April 07 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on March 24th 2023. Valid for: 3 months.
This is the only time herbshopperlive.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online) Customer Survey Spam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2607:f8b0:400... 2607:f8b0:4004:c09::80 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2606:4700:303... 2606:4700:3035::ac43:ae63 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 34.95.111.143 34.95.111.143 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 1 | 2606:4700:303... 2606:4700:3031::ac43:8af2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 2606:4700:303... 2606:4700:3037::ac43:c73e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2600:9000:25c... 2600:9000:25c8:aa00:b:4623:cac0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
27 | 4 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 143.111.95.34.bc.googleusercontent.com
www.br2ghatrk.com |
ASN16509 (AMAZON-02, US)
d3e1y4kxkqljcb.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
herbshopperlive.com
herbshopperlive.com |
543 KB |
3 |
cloudfront.net
d3e1y4kxkqljcb.cloudfront.net |
216 KB |
2 |
googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 424 fonts.googleapis.com — Cisco Umbrella Rank: 47 |
7 KB |
1 |
bsttpl.com
1 redirects
bsttpl.com — Cisco Umbrella Rank: 464221 |
1 KB |
1 |
br2ghatrk.com
1 redirects
www.br2ghatrk.com — Cisco Umbrella Rank: 557277 |
480 B |
1 |
wardonn.com
1 redirects
wardonn.com |
534 B |
27 | 6 |
Domain | Requested by | |
---|---|---|
22 | herbshopperlive.com |
storage.googleapis.com
herbshopperlive.com |
3 | d3e1y4kxkqljcb.cloudfront.net |
herbshopperlive.com
|
1 | fonts.googleapis.com |
herbshopperlive.com
|
1 | bsttpl.com | 1 redirects |
1 | www.br2ghatrk.com | 1 redirects |
1 | wardonn.com | 1 redirects |
1 | storage.googleapis.com | |
27 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
storage.googleapis.com GTS CA 1C3 |
2023-03-20 - 2023-06-12 |
3 months | crt.sh |
*.herbshopperlive.com R3 |
2023-03-24 - 2023-06-22 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2022-12-08 - 2023-12-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-20 - 2023-06-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://herbshopperlive.com/sweeps_3/index_9.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=&clickid=23fa9ciusqek216e&campaign=4358&user_id=1&clickcost=0&lander=1908&time=1680874911&browser_version=111.0.5563.146&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Unknown&ip=2a0d:5600:24:1500:1012:bf5b:d606:ed0a&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/111.0.5563.146%20Safari/537.36&lpkey=169380d1895e329211&target=Unknown&device=DESKTOP&country=US&ts={t9}&trafficsource=136&uclick=ciusqek2&uclickhash=ciusqek2-ciusqek2-qe8w-b7fe-ciu3-8piki4-8pikfe-3082d4
Frame ID: 6F280385BC0E9031663FBDCBD87027D1
Requests: 27 HTTP requests in this frame
Screenshot
![](/screenshots/c80bda3b-7adb-49a1-b5ba-527c660fd98a.png)
Page Title
[1] Reward Pending - We Want Your Opinion!Page URL History Show full URLs
- https://storage.googleapis.com/vghnjuyrvgergberb/vghnjuyrvgergberb.htm Page URL
-
https://wardonn.com/cl/235469_md/12/3954/3449/261/84346
HTTP 302
https://www.br2ghatrk.com/B4H89W/2MT9SGQ/?sub1=12&sub2=235469_8&sub3=261_84346_3954_2533552_md HTTP 302
https://bsttpl.com/click.php?key=n1fmj09wwd676ockokc8&externalid=c7692eaf0c714d9881be7c5610195e... HTTP 302
https://herbshopperlive.com/sweeps_3/index_9.php?device_name=Desktop&browser_name=Chrome&language=en-US&... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://storage.googleapis.com/vghnjuyrvgergberb/vghnjuyrvgergberb.htm Page URL
-
https://wardonn.com/cl/235469_md/12/3954/3449/261/84346
HTTP 302
https://www.br2ghatrk.com/B4H89W/2MT9SGQ/?sub1=12&sub2=235469_8&sub3=261_84346_3954_2533552_md HTTP 302
https://bsttpl.com/click.php?key=n1fmj09wwd676ockokc8&externalid=c7692eaf0c714d9881be7c5610195e75&target=&subid=201 HTTP 302
https://herbshopperlive.com/sweeps_3/index_9.php?device_name=Desktop&browser_name=Chrome&language=en-US&city=&clickid=23fa9ciusqek216e&campaign=4358&user_id=1&clickcost=0&lander=1908&time=1680874911&browser_version=111.0.5563.146&device_model=Desktop&device_brand=Desktop&resolution=desktop&os_name=Windows&os_version=10.0&country=United%20States&country_code=US&isp=Unknown&ip=2a0d:5600:24:1500:1012:bf5b:d606:ed0a&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/111.0.5563.146%20Safari/537.36&lpkey=169380d1895e329211&target=Unknown&device=DESKTOP&country=US&ts={t9}&trafficsource=136&uclick=ciusqek2&uclickhash=ciusqek2-ciusqek2-qe8w-b7fe-ciu3-8piki4-8pikfe-3082d4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
vghnjuyrvgergberb.htm
storage.googleapis.com/vghnjuyrvgergberb/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index_9.php
herbshopperlive.com/sweeps_3/ Redirect Chain
|
62 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
herbshopperlive.com/sweeps_3/assets/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
herbshopperlive.com/sweeps_3/assets/ |
72 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
herbshopperlive.com/sweeps_3/assets/ |
34 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lowes_logo_new.png
herbshopperlive.com/sweeps_3/assets/ |
21 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
02831ab02f02782d9c47fffcfd5eadc4.png
herbshopperlive.com/sweeps_3/assets/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stanleygradetoolset_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ |
96 KB 97 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index_9.php
herbshopperlive.com/sweeps_3/ |
24 KB 24 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
herbshopperlive.com/sweeps_3/assets/fonts/ |
93 KB 93 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stanleygrade_comm1.jpg
herbshopperlive.com/sweeps_3/assets/ |
109 KB 109 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stanleygrade_comm2.jpg
herbshopperlive.com/sweeps_3/assets/ |
41 KB 42 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stanleygrade_comm3.jpg
herbshopperlive.com/sweeps_3/assets/ |
84 KB 84 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f52dd02fdbe33cb89087dd83d16dc230.png
herbshopperlive.com/sweeps_3/assets/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d34bd763d46c8f2ddf09fc415fbc3c06.png
herbshopperlive.com/sweeps_3/assets/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
279132e34471a44f9e9c889082127894.png
herbshopperlive.com/sweeps_3/assets/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-3.4.1.min.js
herbshopperlive.com/sweeps_3/assets/ |
86 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
herbshopperlive.com/sweeps_3/assets/ |
62 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
myscript.js
herbshopperlive.com/sweeps_3/assets/ |
2 KB 845 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
redirect_bin.js
herbshopperlive.com/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common.js
herbshopperlive.com/sweeps_3/assets/ |
49 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
halloween_sweeps.css
herbshopperlive.com/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
banner.css
herbshopperlive.com/ |
249 B 679 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0404_banner_Easter_03.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ |
108 KB 109 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comm_sweeps.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icomoonMain.ttf
herbshopperlive.com/ |
2 KB 2 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online) Customer Survey Spam (Consumer)55 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery object| bootstrap string| redirect_url string| back_url_link string| attrChoices string| domain number| count string| pipeline string| zipcode string| state_selected boolean| processing object| states function| birthdayFill function| beforeShowQuestion function| showOfferWall function| createQuestion function| processQuestion function| nextQuestion function| replaceUrlParam function| popunder number| box_trying boolean| oneclick function| formatPhoneNumber function| switchTypeQuestions function| validatePhone function| validateEmail function| validateZip function| sendZipIp function| validateHeightF function| validateHeightI function| validateWeight function| validateAll function| validateName function| validateLName function| validateBirthday function| days function| daysInMonth function| dashedNumber function| alpha function| validateKeyStrokes function| showStreetState function| leadgenForm function| overflowP function| showDisclaimer function| preventS function| comment function| like function| createQuestionU function| nextQuestionU function| validateData function| showStreetStateU function| showModal function| showOfferWallU4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.br2ghatrk.com/ | Name: uniqueClick_2MT9SGQ Value: cd347fb8-c253-4661-903d-f72fbda28b63:1680892911 |
|
www.br2ghatrk.com/ | Name: transaction_id Value: c7692eaf0c714d9881be7c5610195e75 |
|
bsttpl.com/ | Name: uclick Value: ciusqek2 |
|
bsttpl.com/ | Name: uclickhash Value: ciusqek2-ciusqek2-qe8w-b7fe-ciu3-8piki4-8pikfe-3082d4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bsttpl.com
d3e1y4kxkqljcb.cloudfront.net
fonts.googleapis.com
herbshopperlive.com
storage.googleapis.com
wardonn.com
www.br2ghatrk.com
2600:9000:25c8:aa00:b:4623:cac0:21
2606:4700:3031::ac43:8af2
2606:4700:3035::ac43:ae63
2606:4700:3037::ac43:c73e
2607:f8b0:4004:c09::80
2607:f8b0:4006:81c::200a
34.95.111.143
06d81345fc255d392fe9d296124a99392dafab5dde522058f9fd24e0d96b5dad
2cb1b1d32e69a8940f4aae5b8f929446167ab0dca18f3366c5953e04a9108c74
3cbf461ac85270ca4bd1084c0332f58e3bb3e0ae792bb0199097f087dbc7c066
424faccf03d66211eef49262f66183fe7da49ba0ea21109947dfa270ebdb1ee4
4437a2d3e5d987d0d58415918abc69503157bf9618a2ed28246bb0f367a006bc
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
6010575f1c8c6af618358084bb9931d03cc63bc2a6421b4385238866a6f077df
76a78798e82c6fa73c160b260fabed6c553a040fc4aad6c33de77ca8dc8e4cb9
8328bab88f30849150677f8e75d79ac10518e91082df483c07f2e85add94de12
9ab4f4c2fbb7f22fd22e510a5797ecb47fb1c05c60c9c7ddc578d3841adaf33f
9de17d5dd007723384a0cf35ed82872716b1d1da671a43c94e07e45786a20756
a5c0bb41af4708d1a155e1e044a48335ec7d80f43d1c750d00b195ee1e1b9ee9
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c0109e9747e94335267d540104b0b256bc507882206be853bfbd6b13ddb1c277
c3e512711b33e96a612ebe17258686e941f9af183846399f39a17bbe12c78ae1
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
c7006220d1ebde3319d5b8d4e932be817dfde094ff3321907b0a4ed6cdb833cb
c889fb1af64cceab36a53b3d6e622710e0880b0ed4b38be7730561105b3c5bcc
d597549deac4a152ad75a4533358d7f7873dea8b253c8c8fb5a3b40c69596ea4
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
d9e673ae9c1dd257e45bc224d65da6025f60904ceedf276d297160921a546175
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e87ec3a915a259afeb671504548d90b339e0fda76dad7168b4385d89297753c7
e99003f5d746f15741333c91e9553fa75c9d9e56a501d26fe5fb5a303c5c56f9
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194