here-get-verified.surge.sh

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 138.68.112.220, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is here-get-verified.surge.sh.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 19th 2024. Valid for: a year.

This is the only time here-get-verified.surge.sh was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
4	138.68.112.220 138.68.112.220		14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
5	2

4 138.68.112.220 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

here-get-verified.surge.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	surge.sh here-get-verified.surge.sh	37 KB
0	glitch.global Failed cdn.glitch.global Failed
5	2

	Domain	Requested by
4	here-get-verified.surge.sh	here-get-verified.surge.sh
0	cdn.glitch.global Failed	here-get-verified.surge.sh
5	2

This site contains links to these domains. Also see Links.

Domain
detailed-video-29b30.web.app

Subject Issuer	Validity	Valid
*.surge.sh Sectigo RSA Domain Validation Secure Server CA	`2024-04-19` - `2025-05-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://here-get-verified.surge.sh/next.html
Frame ID: 744F4D23A3D417CBFE7D055E3DE71464
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Action | Required

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

37 kB
Transfer

107 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://detailed-video-29b30.web.app/detailed%20video.mp4

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request next.html Show response here-get-verified.surge.sh/	51 KB 30 KB	333ms 42ms	Document text/html	138.68.112.220 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://here-get-verified.surge.sh/next.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.68.112.220 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash `9d26b527e86a649a0e7f9f23d3485fc34497221f67fbab3588df6afdbadf1b40` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Age 797876 Cache-Control public, max-age=0, must-revalidate Connection close Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Thu, 25 Jul 2024 10:42:05 GMT ETag "9d26b527e86a649a0e7f9f23d3485fc34497221f67fbab3588df6afdbadf1b40" Response-Time 2ms Server Surge Surge-Cache HIT Surge-Stamp 25007::1718445975794-4bf9fc80114aa90654d3963b0d238419 Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	style.css here-get-verified.surge.sh/	30 KB 7 KB	71ms 25ms	Stylesheet text/css	138.68.112.220 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://here-get-verified.surge.sh/style.css Requested by Host: here-get-verified.surge.sh URL: https://here-get-verified.surge.sh/next.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.68.112.220 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash `d8f51bcbb532f2a3d31115ec903a0314d7f83622cfc3bf0e068a58cc69f0d68a` Request headers Referer https://here-get-verified.surge.sh/next.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Thu, 25 Jul 2024 10:42:05 GMT Content-Encoding gzip Surge-Stamp 25007::1718445975794-20450a08e875b40945bb523e9128db0b Server Surge Age 717073 ETag "d8f51bcbb532f2a3d31115ec903a0314d7f83622cfc3bf0e068a58cc69f0d68a" Vary Accept-Encoding Transfer-Encoding chunked Content-Type text/css; charset=UTF-8 Response-Time 2ms Cache-Control public, max-age=0, must-revalidate Connection close Accept-Ranges bytes Surge-Cache HIT
GET H/1.1	200 OK	home.png here-get-verified.surge.sh/	39 B 39 B	67ms 23ms	Image image/png	138.68.112.220 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://here-get-verified.surge.sh/home.png Requested by Host: here-get-verified.surge.sh URL: https://here-get-verified.surge.sh/next.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.68.112.220 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://here-get-verified.surge.sh/next.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Thu, 25 Jul 2024 10:42:05 GMT Surge-Stamp 29898::1718445975794-d4ac7f1bba70ba87c56e6d93092b7cca Server Surge Age 5351765 ETag "91218093a08027e8f69c8051f9deef1fe6c22b278b3f6bdf761e7587cb272774" Content-Type image/png Response-Time 1ms Cache-Control public, max-age=0, must-revalidate Connection close Accept-Ranges bytes Content-Length 39 Surge-Cache HIT
GET		download%20(1).jfif cdn.glitch.global/cbf8be26-0413-4201-9418-b298e829656a/	0 0

GET DATA	200 OK	truncated /	26 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6cb36e76f421d1699b0a0eb28dce64920464c398b8be148d99b4f5a214021941` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/jpeg
GET H/1.1	200 OK	favicon.ico here-get-verified.surge.sh/	39 B 467 B	75ms 30ms	Other image/x-icon	138.68.112.220 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://here-get-verified.surge.sh/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.68.112.220 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash `91218093a08027e8f69c8051f9deef1fe6c22b278b3f6bdf761e7587cb272774` Request headers Referer https://here-get-verified.surge.sh/next.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Thu, 25 Jul 2024 10:42:05 GMT Surge-Stamp 29030::1718445975794-d4ac7f1bba70ba87c56e6d93092b7cca Server Surge Age 5351765 ETag "91218093a08027e8f69c8051f9deef1fe6c22b278b3f6bdf761e7587cb272774" Vary Accept-Encoding Content-Type image/x-icon Response-Time 2ms Cache-Control public, max-age=0, must-revalidate Connection close Accept-Ranges bytes Content-Length 39 Surge-Cache HIT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.glitch.global
URL: https://cdn.glitch.global/cbf8be26-0413-4201-9418-b298e829656a/download%20(1).jfif?v=1698098011376

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.glitch.global
here-get-verified.surge.sh
cdn.glitch.global
138.68.112.220
6cb36e76f421d1699b0a0eb28dce64920464c398b8be148d99b4f5a214021941
91218093a08027e8f69c8051f9deef1fe6c22b278b3f6bdf761e7587cb272774
9d26b527e86a649a0e7f9f23d3485fc34497221f67fbab3588df6afdbadf1b40
d8f51bcbb532f2a3d31115ec903a0314d7f83622cfc3bf0e068a58cc69f0d68a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

here-get-verified.surge.sh Open in urlscan Pro 138.68.112.220 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

37 kBTransfer

107 kBSize

0 Cookies

1 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

here-get-verified.surge.sh Open in urlscan Pro
138.68.112.220 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

37 kB
Transfer

107 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!