andeson.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:d769::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
Submission: On August 12 via automatic, source phishtank (August 12th 2020, 5:33:47 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 11 HTTP transactions. The main IP is 2a02:4780:dead:d769::1, located in United States and belongs to AWEX, US. The main domain is andeson.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.

This is the only time andeson.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	2a02:4780:dea... 2a02:4780:dead:d769::1	204915 (AWEX) (AWEX)
1	192.0.72.22 192.0.72.22	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
1 1	103.109.43.14 103.109.43.14	135905 (VNPT-AS-V...) (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP)
3	2606:4700:303... 2606:4700:3033::6812:2e89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:e5e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	6

3 2a02:4780:dead:d769::1 (United States)

ASN204915 (AWEX, US)

andeson.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.72.22 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

claudimed.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.109.43.14 (Viet Nam) 1 redirects

ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN)

static.subiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:3033::6812:2e89 (United States)

ASN13335 (CLOUDFLARENET, US)

public-gcs.subiz-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:e5e (United States)

ASN13335 (CLOUDFLARENET, US)

api.sbz.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	subiz-cdn.com public-gcs.subiz-cdn.com	145 KB
3	000webhostapp.com andeson.000webhostapp.com	68 KB
2	gstatic.com fonts.gstatic.com	26 KB
1	sbz.vn api.sbz.vn	397 B
1	subiz.com 1 redirects static.subiz.com	213 B
1	googleapis.com fonts.googleapis.com	868 B
1	wordpress.com claudimed.files.wordpress.com	22 KB
11	7

	Domain	Requested by
3	public-gcs.subiz-cdn.com	andeson.000webhostapp.com public-gcs.subiz-cdn.com
3	andeson.000webhostapp.com	andeson.000webhostapp.com
2	fonts.gstatic.com	andeson.000webhostapp.com
1	api.sbz.vn	public-gcs.subiz-cdn.com
1	static.subiz.com	1 redirects
1	fonts.googleapis.com	andeson.000webhostapp.com
1	claudimed.files.wordpress.com	andeson.000webhostapp.com
11	7

This site contains no links.

Subject Issuer	Validity	Valid
*.000webhostapp.com RapidSSL RSA CA 2018	`2019-06-11` - `2021-07-10`	2 years	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2019-01-15` - `2021-01-14`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-05` - `2021-08-05`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
Frame ID: 32E302E1A7961C1605C595BA61CC632C
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

261 kB
Transfer

683 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://static.subiz.com/public/js/loader.js HTTP 302
https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request detail.php Show response
andeson.000webhostapp.com/FACEBOOK%20GUA/ 5 KB
2 KB 342ms
108ms Document
text/html 2a02:4780:dead:d769::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:d769::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

6967ad2d7473593facff96f970e2afea26595782baee97e14d3fedd7897ad6b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: andeson.000webhostapp.com
:scheme: https
:path: /FACEBOOK%20GUA/detail.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Wed, 12 Aug 2020 17:33:30 GMT
content-type: text/html; charset=UTF-8
server: awex
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-request-id: 1989d7bdfcef436dcefacf3e7c599a44
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
andeson.000webhostapp.com/FACEBOOK%20GUA/ 94 KB
38 KB 215ms
214ms Script
application/javascript 2a02:4780:dead:d769::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://andeson.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:d769::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Aug 2020 11:22:02 GMT
server: awex
content-type: application/javascript
status: 200
x-xss-protection: 1; mode=block
x-request-id: c88d05680a26128cb0c4d66e0f5f311e

GET
H2 200 bootstrap.min.css
andeson.000webhostapp.com/FACEBOOK%20GUA/ 146 KB
27 KB 108ms
107ms Stylesheet
text/css 2a02:4780:dead:d769::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

https://andeson.000webhostapp.com/FACEBOOK%20GUA/bootstrap.min.css

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:4780:dead:d769::1 , United States, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

33bf181c4c89696029c6b085c552ed2a2ae2eb89109457a64bbc6aca4e09a072

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Aug 2020 11:22:02 GMT
server: awex
content-type: text/css
status: 200
x-xss-protection: 1; mode=block
x-request-id: 9f25b5a468b853e12d0e4a715be3387b

GET
H2 200 facebook-png.png
claudimed.files.wordpress.com/2011/06/ 21 KB
22 KB 130ms
44ms Image
image/png 192.0.72.22
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claudimed.files.wordpress.com/2011/06/facebook-png.png

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9be0d70af67d2f8351a21de677983cc78c16f194480b908582fc84e3778307b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT arn 22 np
date: Wed, 12 Aug 2020 17:33:30 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sun, 19 Jun 2011 20:06:20 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://claudimed.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 21814
expires: Mon, 07 Sep 2020 01:02:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 8 KB
868 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

da7ddd3a5a73db8108c0763e65a55794409b0b18911461537f10d333e808a04c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 12 Aug 2020 16:28:22 GMT
server: ESF
date: Wed, 12 Aug 2020 17:33:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 12 Aug 2020 17:33:30 GMT

GET
H2

200

173c327a095.app.js Show response
public-gcs.subiz-cdn.com/widget-v4/public/
Redirect Chain

https://static.subiz.com/public/js/loader.js
https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js

217 KB
70 KB

41ms
17ms

Script
application/javascript

2606:4700:3033::6812:2e89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js
Requested by: Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6812:2e89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4701e61bf1272b4349c1788edd7d9485467f2d3f3cf18bd3ebbcb66651b9a466

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:32 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 546510
x-guploader-uploadid: AAANsUmHBGg4wCd8aY2yC1lkMGRqJAjFTawNY6uyaq7fF1VloAAHMsXP7CJ4dAxVsLVXDvCDe4pbmgLUQfnalUaya-tMe1gnnQ
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70521
cf-request-id: 04855509d9000064a9763e4200000001
last-modified: Thu, 06 Aug 2020 09:44:12 GMT
server: cloudflare
etag: "311ccf7cf059e591379f52566643a017"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=Lerr+Q==, md5=MRzPfPBZ5ZE3n1JWZkOgFw==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1596707052239738
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000, no-transform
x-goog-stored-content-length: 70521
accept-ranges: bytes
cf-ray: 5c1bf122fed764a9-FRA
content-type: application/javascript
expires: Fri, 06 Aug 2021 09:44:42 GMT

Redirect headers

Location: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js
Date: Wed, 12 Aug 2020 17:33:31 GMT
Server: nginx/1.14.0 (Ubuntu)
Connection: keep-alive
Content-Length: 0

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700
Origin: https://andeson.000webhostapp.com

Response headers

date: Wed, 15 Jul 2020 20:33:43 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:05 GMT
server: sffe
age: 2408387
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13224
x-xss-protection: 0
expires: Thu, 15 Jul 2021 20:33:43 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v13/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: andeson.000webhostapp.com
URL: https://andeson.000webhostapp.com/FACEBOOK%20GUA/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700
Origin: https://andeson.000webhostapp.com

Response headers

date: Tue, 11 Aug 2020 09:29:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:46:19 GMT
server: sffe
age: 115437
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Wed, 11 Aug 2021 09:29:33 GMT

GET
H2 200 alert-mp3.97e72cf9.js Show response
public-gcs.subiz-cdn.com/widget-v4/public/js/ 212 B
496 B 16ms
16ms Script
application/javascript 2606:4700:3033::6812:2e89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://public-gcs.subiz-cdn.com/widget-v4/public/js/alert-mp3.97e72cf9.js
Requested by: Host: public-gcs.subiz-cdn.com
URL: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6812:2e89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06d01300596efec75787bde49660a587b900e1a3b6a26fc53c2aab8717ec687a

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:32 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 546507
status: 200
x-guploader-uploadid: AAANsUnHXMPxf6-Nfr6fVa3WhgJTqQ0nVhg8o8q2PxUjr8Hbj3xUS9dQ_P_LT7FwhGtWmEuy2ki7XdFIQWOqFYbvZuc
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 189
cf-request-id: 0485550a09000064a9763e7200000001
last-modified: Thu, 06 Aug 2020 09:44:14 GMT
server: cloudflare
etag: "e7d698ca916a05662bb243989ea88320"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=55a0Ag==, md5=59aYypFqBWYrskOYnqiDIA==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1596707054252243
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000, no-transform
x-goog-stored-content-length: 189
accept-ranges: bytes
cf-ray: 5c1bf1234f0f64a9-FRA
content-type: application/javascript
expires: Fri, 06 Aug 2021 09:45:05 GMT

GET
H2 200 main-css.32af3523.js Show response
public-gcs.subiz-cdn.com/widget-v4/public/js/ 165 KB
75 KB 14ms
14ms Script
application/javascript 2606:4700:3033::6812:2e89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://public-gcs.subiz-cdn.com/widget-v4/public/js/main-css.32af3523.js
Requested by: Host: public-gcs.subiz-cdn.com
URL: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6812:2e89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24b41eb7fa2dd28a176259ff348e96ed96f02feb5cc41bbe7b1d713a90c6d6e2

Request headers

Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:32 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 546507
x-guploader-uploadid: AAANsUkdjN14iJL6lordt37TxhZ1LWJjwQs5Vv_MrvW_v5je8PI8aDrIxgROu4bp7NcBhuVKG7PtKqeueRnwBcvoNHZ_cBG18w
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 75839
cf-request-id: 0485550a09000064a9763e8200000001
last-modified: Thu, 06 Aug 2020 09:44:15 GMT
server: cloudflare
etag: "597d0bf115fb588efeaa2e9758141aed"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=2YMvGQ==, md5=WX0L8RX7WI7+qi6XWBQa7Q==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1596707055230648
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000, no-transform
x-goog-stored-content-length: 75839
accept-ranges: bytes
cf-ray: 5c1bf1234f1064a9-FRA
content-type: application/javascript
expires: Fri, 06 Aug 2021 09:44:43 GMT

GET
H2 200 __link Show response
api.sbz.vn/4.0/ 2 B
397 B 213ms
172ms XHR
application/json 2606:4700:20::681a:e5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sbz.vn/4.0/__link?id=54166
Requested by: Host: public-gcs.subiz-cdn.com
URL: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:e5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json, text/plain, */*
Referer: https://andeson.000webhostapp.com/FACEBOOK%20GUA/detail.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:33:32 GMT
cf-cache-status: DYNAMIC
x-api-time: 1.55966ms
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json
access-control-allow-origin: https://andeson.000webhostapp.com
x-thanh: thanh
cf-ray: 5c1bf1239de9176a-FRA
content-length: 2
cf-request-id: 0485550a3f0000176aec3b2200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://public-gcs.subiz-cdn.com/widget-v4/public/173c327a095.app.js(Line 1) Message: GOT V3 54166

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

andeson.000webhostapp.com
api.sbz.vn
claudimed.files.wordpress.com
fonts.googleapis.com
fonts.gstatic.com
public-gcs.subiz-cdn.com
static.subiz.com
103.109.43.14
192.0.72.22
2606:4700:20::681a:e5e
2606:4700:3033::6812:2e89
2a00:1450:4001:819::200a
2a00:1450:4001:81d::2003
2a02:4780:dead:d769::1
06d01300596efec75787bde49660a587b900e1a3b6a26fc53c2aab8717ec687a
24b41eb7fa2dd28a176259ff348e96ed96f02feb5cc41bbe7b1d713a90c6d6e2
33bf181c4c89696029c6b085c552ed2a2ae2eb89109457a64bbc6aca4e09a072
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4701e61bf1272b4349c1788edd7d9485467f2d3f3cf18bd3ebbcb66651b9a466
6967ad2d7473593facff96f970e2afea26595782baee97e14d3fedd7897ad6b1
7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568
9be0d70af67d2f8351a21de677983cc78c16f194480b908582fc84e3778307b1
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
da7ddd3a5a73db8108c0763e65a55794409b0b18911461537f10d333e808a04c
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

andeson.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:d769::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

6 IPs

3 Countries

261 kBTransfer

683 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

andeson.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:d769::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

261 kB
Transfer

683 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!