urlscan.io logo urlscan.io
SecurityTrails logo

dar-tunisia.com Open in urlscan Pro
46.105.57.169  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://url-shortener-fcc-.glitch.me/ycsFapj/
Effective URL: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Submission: On August 14 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 46.105.57.169, located in Saint-Ouen, France and belongs to OVH, FR. The main domain is dar-tunisia.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 8th 2019. Valid for: 3 months.
This is the only time dar-tunisia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 2 54.165.156.139 14618 (AMAZON-AES)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 9 46.105.57.169 16276 (OVH)
10 3
Apex Domain
Subdomains		 Transfer
9 dar-tunisia.com
dar-tunisia.com
102 KB
2 glitch.me
url-shortener-fcc-.glitch.me
5 KB
1 cloudflare.com
cdnjs.cloudflare.com
3 KB
10 3
Domain Requested by
9 dar-tunisia.com 1 redirects url-shortener-fcc-.glitch.me
dar-tunisia.com
2 url-shortener-fcc-.glitch.me 1 redirects
1 cdnjs.cloudflare.com url-shortener-fcc-.glitch.me
10 3

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon		 2019-01-20 -
2020-02-20		 a year crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-08-10 -
2020-02-16		 6 months crt.sh
dar-tunisia.com
Let's Encrypt Authority X3		 2019-07-08 -
2019-10-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Frame ID: F806B4C6FDCEB7CFAFB0A15B07B2A2AC
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://url-shortener-fcc-.glitch.me/ycsFapj/ Page URL
  2. https://url-shortener-fcc-.glitch.me/ycsFapj/ HTTP 302
    https://dar-tunisia.com/.app/secure/?ID=myaccountsettings&verf=onlineid&cookies=LMAOBIATCH HTTP 302
    https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US Page URL

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

109 kB
Transfer

240 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://url-shortener-fcc-.glitch.me/ycsFapj/ Page URL
  2. https://url-shortener-fcc-.glitch.me/ycsFapj/ HTTP 302
    https://dar-tunisia.com/.app/secure/?ID=myaccountsettings&verf=onlineid&cookies=LMAOBIATCH HTTP 302
    https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
url-shortener-fcc-.glitch.me/ycsFapj/ 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://url-shortener-fcc-.glitch.me/ycsFapj/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.156.139 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-165-156-139.compute-1.amazonaws.com
Software
/ Express
Resource Hash
d91af98c557aa0e851eb8f780fe2426ea89beb5da4df457407d99cd81da15d83

Request headers

:method
GET
:authority
url-shortener-fcc-.glitch.me
:scheme
https
:path
/ycsFapj/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
date
Wed, 14 Aug 2019 15:25:09 GMT
x-powered-by
Express
cache-control
no-cache
bowser.min.js
cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/bowser.min.js
Requested by
Host: url-shortener-fcc-.glitch.me
URL: https://url-shortener-fcc-.glitch.me/ycsFapj/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b52f6b6011741e76cefa2be41164bbc9b33bba334b9ad15b03abad37b609d983
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://url-shortener-fcc-.glitch.me/ycsFapj/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:10 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10430217
status
200
served-in-seconds
0.033
timing-allow-origin
*
last-modified
Mon, 02 Jul 2018 14:15:51 GMT
server
cloudflare
etag
W/"5b3a3397-1edd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5063f099eedfd6d1-FRA
expires
Mon, 03 Aug 2020 15:25:10 GMT
Primary Request signin
dar-tunisia.com/.app/secure/
Redirect Chain
  • https://url-shortener-fcc-.glitch.me/ycsFapj/
  • https://dar-tunisia.com/.app/secure/?ID=myaccountsettings&verf=onlineid&cookies=LMAOBIATCH
  • https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
36 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Requested by
Host: url-shortener-fcc-.glitch.me
URL: https://url-shortener-fcc-.glitch.me/ycsFapj/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache / PHP/7.2
Resource Hash
abbb2e12cd0ed8bdac3efa43bfc2658c49c2bcd29d0003f2eee6a6e2ee018490

Request headers

:method
GET
:authority
dar-tunisia.com
:scheme
https
:path
/.app/secure/signin?country.x=US&locale.x=en_US
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://url-shortener-fcc-.glitch.me/ycsFapj/
accept-encoding
gzip, deflate, br
cookie
zPayPal_2018=9f292efdb62fa0b2cf3747b917b75773; SERVERID585=2020130|XVQn3|XVQn3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://url-shortener-fcc-.glitch.me/ycsFapj/

Response headers

status
200
date
Wed, 14 Aug 2019 15:25:14 GMT
content-type
text/html; charset=UTF-8
server
Apache
x-powered-by
PHP/7.2
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
x-robots-tag
"none, noindex, nofollow, noarchive, nosnippet, noodp, notranslate, noimageindex"
vary
Accept-Encoding
content-encoding
gzip
x-iplb-instance
18162

Redirect headers

status
302
date
Wed, 14 Aug 2019 15:25:14 GMT
content-type
text/html; charset=UTF-8
server
Apache
x-powered-by
PHP/7.2
set-cookie
zPayPal_2018=9f292efdb62fa0b2cf3747b917b75773; path=/ SERVERID585=2020130|XVQn3|XVQn3; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
x-robots-tag
"none, noindex, nofollow, noarchive, nosnippet, noodp, notranslate, noimageindex"
location
signin?country.x=US&locale.x=en_US
vary
Accept-Encoding
content-encoding
gzip
x-iplb-instance
18162
signin.css
dar-tunisia.com/.app/secure/cazanova/res/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/signin.css
Requested by
Host: dar-tunisia.com
URL: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
1e72885838cf46833f0e4efb6cd6ec917cbdfc7815aa712f02e245d37e383bd4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:14 GMT
content-encoding
gzip
last-modified
Sat, 06 Apr 2019 02:11:26 GMT
server
Apache
x-iplb-instance
18162
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=900
accept-ranges
bytes
content-length
2663
expires
Wed, 14 Aug 2019 15:40:14 GMT
jquery.min.js
dar-tunisia.com/.app/secure/cazanova/res/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/jquery.min.js
Requested by
Host: dar-tunisia.com
URL: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
892fcc249b9b0fd6e8727741d21d5cdd5474238327ba116308b5dfad6ddfd1bd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:14 GMT
content-encoding
gzip
last-modified
Sat, 06 Apr 2019 01:28:44 GMT
server
Apache
x-iplb-instance
18162
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=900
accept-ranges
bytes
content-length
30079
expires
Wed, 14 Aug 2019 15:40:14 GMT
jquery.browser.min.js
dar-tunisia.com/.app/secure/cazanova/res/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/jquery.browser.min.js
Requested by
Host: dar-tunisia.com
URL: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
beabd80773a4dc7327ac6864d464aac8c38538a3183d8fb049dbb07472dde32d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:14 GMT
content-encoding
gzip
last-modified
Fri, 19 Aug 2016 08:36:02 GMT
server
Apache
x-iplb-instance
17192
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=900
accept-ranges
bytes
content-length
852
expires
Wed, 14 Aug 2019 15:40:14 GMT
signin.js
dar-tunisia.com/.app/secure/cazanova/res/ 		43 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/signin.js
Requested by
Host: dar-tunisia.com
URL: https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
2634687f169d9f69fceb86aed9b9a81c038f537ead7fba8c02f16448debbeec1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:14 GMT
content-encoding
gzip
last-modified
Sat, 06 Apr 2019 02:16:06 GMT
server
Apache
x-iplb-instance
17197
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=900
accept-ranges
bytes
content-length
19531
expires
Wed, 14 Aug 2019 15:40:14 GMT
api.php
dar-tunisia.com/.app/secure/cazanova/paypal/ 		0
262 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/paypal/api.php
Requested by
Host: dar-tunisia.com
URL: https://dar-tunisia.com/.app/secure/cazanova/res/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache / PHP/7.2
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://dar-tunisia.com/.app/secure/signin?country.x=US&locale.x=en_US
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 14 Aug 2019 15:25:14 GMT
content-encoding
gzip
server
Apache
x-powered-by
PHP/7.2
x-iplb-instance
18162
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
cache-control
no-store, no-cache, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT
logoDesktop.svg
dar-tunisia.com/.app/secure/cazanova/res/img/ 		26 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/img/logoDesktop.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
12e11d5baf59bf859e6b2de7c5cd9a37155fa9f818d571869b0c158e060e461b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dar-tunisia.com/.app/secure/cazanova/res/signin.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:15 GMT
content-encoding
gzip
last-modified
Fri, 05 Apr 2019 08:12:24 GMT
server
Apache
x-iplb-instance
17197
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=900
accept-ranges
bytes
content-length
5211
expires
Wed, 14 Aug 2019 15:40:15 GMT
xArial.woff2
dar-tunisia.com/.app/secure/cazanova/res/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dar-tunisia.com/.app/secure/cazanova/res/xArial.woff2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.57.169 Saint-Ouen, France, ASN16276 (OVH, FR),
Reverse DNS
cluster020.hosting.ovh.net
Software
Apache /
Resource Hash
427c9aa590fd8e186f0c345a918e6844948fb2668ebb83300e123ceb9077b01c

Request headers

Sec-Fetch-Mode
cors
Referer
https://dar-tunisia.com/.app/secure/cazanova/res/signin.css
Origin
https://dar-tunisia.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 15:25:15 GMT
content-encoding
gzip
last-modified
Thu, 24 May 2018 10:24:18 GMT
server
Apache
x-iplb-instance
17197
vary
Accept-Encoding
status
200
accept-ranges
bytes
content-length
22439

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Zobtvisxlpsmus74a1akhu string| Kobtvisxlpsmus74a1akhu object| Fobtvisxlpsmus74a1akhu function| X_0x56ae function| _0x2d8f05 function| _0x2bb25a function| _0x2492de function| _0x5be702 function| _0x2dc776 function| Bobtvisxlpsmus74a1akhu function| Xobtvisxlpsmus74a1akhu function| _0x1a026c string| csrf_token function| $ function| jQuery object| jQBrowser object| H_0x87eb function| H_0x51bd function| _0x3763bd function| _0x54e1cf function| _0x6de764 function| _0x5f2ccf function| _0x3fa3fa function| _0x1478a6

2 Cookies

Domain/Path Name / Value
dar-tunisia.com/ Name: SERVERID585
Value: 2020130|XVQn3|XVQn3
dar-tunisia.com/ Name: zPayPal_2018
Value: 9f292efdb62fa0b2cf3747b917b75773