ksp900.gq Open in urlscan Pro
209.126.84.57  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request proses.php Show response ksp900.gq/	8 KB 3 KB	263ms 116ms	Document text/html	209.126.84.57 CONTABO
General Check archive.org Show headers Download Go to Full URL http://ksp900.gq/proses.php Protocol HTTP/1.1 Server 209.126.84.57 , United States, ASN40021 (CONTABO, US), Reverse DNS vmi777040.contaboserver.net Software LiteSpeed / Resource Hash 887783ee6d016c42257de643ccab425dfb770212d198f477e9730052d7e2b1a9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 content-type text/html; charset=UTF-8 content-length 2928 content-encoding gzip vary Accept-Encoding date Thu, 17 Feb 2022 13:22:54 GMT server LiteSpeed
GET H/1.1	200 OK	pos.js Show response domin.se.ke/	3 KB 3 KB	454ms 17ms	Script application/javascript	173.212.217.143 CONTABO
General Check archive.org Show headers Download Go to Full URL http://domin.se.ke/pos.js Requested by Host: ksp900.gq URL: http://ksp900.gq/proses.php Protocol HTTP/1.1 Server 173.212.217.143 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS vmi406274.contaboserver.net Software nginx/1.14.2 / Express Resource Hash dbfec457fb984e022112bb52d70f2e8708b275182518221f1aa3eb3d778beb4b Request headers Accept-Language de-DE,de;q=0.9 Referer http://ksp900.gq/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers Date Thu, 17 Feb 2022 13:22:54 GMT Last-Modified Fri, 12 Nov 2021 20:00:39 GMT Server nginx/1.14.2 X-Powered-By Express ETag W/"bf1-17d15bce226" Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 3057
GET H2	200	k97pj8-or6s.png static.xx.fbcdn.net/rsrc.php/v3/y8/r/	809 B 1 KB	34ms 7ms	Image image/png	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/y8/r/k97pj8-or6s.png Requested by Host: ksp900.gq URL: http://ksp900.gq/proses.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://ksp900.gq/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 17 Feb 2022 13:22:54 GMT x-content-type-options nosniff content-md5 ZfLx61eYtTxQTtjePZDJWA== document-policy force-load-at-top content-security-policy-report-only default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.xx.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script'; cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=3600,h3-29=":443"; ma=3600 content-length 809 x-fb-rlafr 0 x-fb-debug A0+7p87cUyizswyBuwsiYDdPU2BGtxnOgQTbOZnddc33PLze4sBeGBE6qak9IlmyWtlxGWSbJuonNL7RcxFO9g== x-fb-trip-id 686109401 last-modified Mon, 01 Jan 2001 08:00:00 GMT content-type image/png access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Sun, 12 Feb 2023 01:44:53 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	167 KB 62 KB	57ms 35ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-QHQMYDZDD3 Requested by Host: domin.se.ke URL: http://domin.se.ke/pos.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 659e539796d64ffe0b554f45bd7049176cbe699aaee14b2c9d014c5b2a576625 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer http://ksp900.gq/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Thu, 17 Feb 2022 13:22:55 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 63116 x-xss-protection 0 expires Thu, 17 Feb 2022 13:22:55 GMT
POST		ksp900.gq domin.se.ke/user/	0 0
POST H2	204	collect www.google-analytics.com/g/	0 333 B	80ms 14ms	Ping text/plain	2a00:1450:4001:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-QHQMYDZDD3&gtm=2oe290&_p=1152137845&sr=1600x1200&ul=en-us&cid=1098209096.1645104175&_s=1&dl=http%3A%2F%2Fksp900.gq%2Fproses.php&dt=Masuk%20Facebook%20%7C%20Facebook&sid=1645104175&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-QHQMYDZDD3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer http://ksp900.gq/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers pragma no-cache date Thu, 17 Feb 2022 13:22:55 GMT server Golfe2 content-type text/plain access-control-allow-origin http://ksp900.gq cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H/1.1	204 No Content	ksp900.gq domin.se.ke/user/	0 0	30ms 16ms	Preflight	173.212.217.143 CONTABO
General Check archive.org Show headers Download Go to Full URL http://domin.se.ke/user/ksp900.gq Protocol HTTP/1.1 Server 173.212.217.143 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS vmi406274.contaboserver.net Software nginx/1.14.2 / Express Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin http://ksp900.gq User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Sec-Fetch-Mode cors Response headers Server nginx/1.14.2 Date Thu, 17 Feb 2022 13:22:55 GMT Content-Length 0 Connection keep-alive X-Powered-By Express Access-Control-Allow-Origin * Access-Control-Allow-Credentials true Access-Control-Allow-Methods GET,HEAD,PUT,PATCH,POST,DELETE Vary Access-Control-Request-Headers Access-Control-Allow-Headers content-type

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

domin.se.ke

URL

http://domin.se.ke/user/ksp900.gq

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone number| sekeid function| loadGoogleAnalytics function| gtag function| setCookie function| getCookie number| hours number| now object| setupTime object| dataLayer object| google_tag_manager object| google_tag_data object| gaGlobal function| onYouTubeIframeAPIReady

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ksp900.gq/	1970-01-20 18:29:36	Name: _ga_QHQMYDZDD3 Value: GS1.1.1645104175.1.0.1645104175.0
			.ksp900.gq/	1970-01-20 18:29:36	Name: _ga Value: GA1.1.1098209096.1645104175

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

domin.se.ke
ksp900.gq
static.xx.fbcdn.net
www.google-analytics.com
www.googletagmanager.com
domin.se.ke
173.212.217.143
209.126.84.57
2a00:1450:4001:808::2008
2a00:1450:4001:810::200e
2a03:2880:f01c:8012:face:b00c:0:3
659e539796d64ffe0b554f45bd7049176cbe699aaee14b2c9d014c5b2a576625
887783ee6d016c42257de643ccab425dfb770212d198f477e9730052d7e2b1a9
dbfec457fb984e022112bb52d70f2e8708b275182518221f1aa3eb3d778beb4b
e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855