dreamjoker.0fees.us Open in urlscan Pro
185.27.134.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://dreamjoker.0fees.us/cc.html
Effective URL:
http://dreamjoker.0fees.us/cc.html?i=1
Submission: On August 13 via automatic, source phishtank (August 13th 2020, 3:35:05 pm UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.27.134.46, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is dreamjoker.0fees.us.

This is the only time dreamjoker.0fees.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
10	185.27.134.46 185.27.134.46		34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
10	1

10 185.27.134.46 (United Kingdom)

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)

dreamjoker.0fees.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	0fees.us dreamjoker.0fees.us	46 KB
10	1

	Domain	Requested by
10	dreamjoker.0fees.us	dreamjoker.0fees.us
10	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://dreamjoker.0fees.us/cc.html?i=1
Frame ID: E6E45C3BEC7847294C649F6FB45BBA1F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://dreamjoker.0fees.us/cc.html Page URL
http://dreamjoker.0fees.us/cc.html?i=1 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

46 kB
Transfer

65 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dreamjoker.0fees.us/cc.html Page URL
http://dreamjoker.0fees.us/cc.html?i=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	cc.html Show response dreamjoker.0fees.us/	837 B 832 B	53ms 40ms	Document text/html	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc.html Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `a566b6f02ce007eefb26eb055781c56bcd2f80c04f417245918ee6b41ff7d40a` Request headers Host dreamjoker.0fees.us Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Thu, 13 Aug 2020 15:34:49 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Expires Thu, 01 Jan 1970 00:00:01 GMT Cache-Control no-cache Content-Encoding gzip
GET H/1.1	200 OK	aes.js Show response dreamjoker.0fees.us/	30 KB 31 KB	27ms 26ms	Script application/javascript	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/aes.js Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc` Request headers Referer http://dreamjoker.0fees.us/cc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Last-Modified Sat, 08 Aug 2015 08:15:57 GMT Server nginx ETag "55c5babd-79e6" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 31206
GET H/1.1	200 OK	Primary Request cc.html Show response dreamjoker.0fees.us/	9 KB 3 KB	41ms 40ms	Document text/html	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc.html?i=1 Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `02b9bd6228442c7eb2114e090209dcd030b63af2ce3704961b0c1044083e45d6` Request headers Host dreamjoker.0fees.us Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://dreamjoker.0fees.us/cc.html Accept-Encoding gzip, deflate Accept-Language en-US Cookie __test=2b1ba57d7e2d97f7aad30e05e0347331 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://dreamjoker.0fees.us/cc.html Response headers Server nginx Date Thu, 13 Aug 2020 15:34:49 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Mon, 01 Jun 2015 11:58:46 GMT Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Expires Sat, 12 Sep 2020 15:34:49 GMT Content-Encoding gzip
GET H/1.1	200 OK	bn9iieje.css dreamjoker.0fees.us/cc/	21 KB 6 KB	31ms 27ms	Stylesheet text/css	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc/bn9iieje.css Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `5913917b154069f006a57d78cd8b36a93541ac0ea161b9f53cf8082cf65662ec` Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 11:58:52 GMT Server nginx Vary Accept-Encoding Content-Type text/css Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate Transfer-Encoding chunked Connection keep-alive Expires Sat, 12 Sep 2020 15:34:49 GMT
GET H/1.1	404 Not Found	2gmbnh27.css dreamjoker.0fees.us/cc/	0 0	55ms 42ms	Stylesheet text/html	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc/2gmbnh27.css Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Content-Encoding gzip Last-Modified Fri, 17 Nov 2017 21:43:05 GMT Server nginx Vary Accept-Encoding Content-Type text/html Cache-Control max-age=5, public, proxy-revalidate, public, proxy-revalidate Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	3c47fjyf.xml dreamjoker.0fees.us/cc/	714 B 815 B	56ms 42ms	Stylesheet application/xml	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc/3c47fjyf.xml Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `19b3843d0a40dd13c6a14d70f2f6b33f6168bd9e1a801685ed7cffe865dea77c` Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 11:58:48 GMT Server nginx Vary Accept-Encoding Content-Type application/xml Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate Transfer-Encoding chunked Connection keep-alive Expires Sat, 12 Sep 2020 15:34:49 GMT
GET H/1.1	404 Not Found	mootools.js dreamjoker.0fees.us/cc/	0 0	57ms 43ms	Script text/html	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc/mootools.js Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Content-Encoding gzip Last-Modified Fri, 17 Nov 2017 21:43:05 GMT Server nginx Vary Accept-Encoding Content-Type text/html Cache-Control max-age=5, public, proxy-revalidate, public, proxy-revalidate Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	rkmxcsx.png dreamjoker.0fees.us/cc/	3 KB 3 KB	56ms 42ms	Image image/png	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Show image Full URL http://dreamjoker.0fees.us/cc/rkmxcsx.png Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `d4e472701c379e9c53e500c8553df8ad519cac06b6efdea822c1afa4017e0025` Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Last-Modified Mon, 01 Jun 2015 11:58:53 GMT Server nginx Content-Type image/png Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 3212 Expires Sat, 12 Sep 2020 15:34:49 GMT
GET H/1.1	404 Not Found	mootools.js dreamjoker.0fees.us/cc/	0 0	28ms 28ms	Script text/html	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL http://dreamjoker.0fees.us/cc/mootools.js Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Content-Encoding gzip Last-Modified Fri, 17 Nov 2017 21:43:05 GMT Server nginx Vary Accept-Encoding Content-Type text/html Cache-Control max-age=5, public, proxy-revalidate, public, proxy-revalidate Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	facebook.png dreamjoker.0fees.us/cc/	380 B 713 B	27ms 27ms	Image image/png	185.27.134.46 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Show image Full URL http://dreamjoker.0fees.us/cc/facebook.png Requested by Host: dreamjoker.0fees.us URL: http://dreamjoker.0fees.us/cc.html?i=1 Protocol HTTP/1.1 Server 185.27.134.46 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS Software nginx / Resource Hash `8b383325f03e8c098d956cf2cbe78746e492dee143402f6456387bf7a4d2b0c6` Request headers Referer http://dreamjoker.0fees.us/cc.html?i=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 15:34:49 GMT Last-Modified Mon, 01 Jun 2015 11:58:52 GMT Server nginx Content-Type image/png Cache-Control max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 380 Expires Sat, 12 Sep 2020 15:34:49 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dreamjoker.0fees.us/	1970-01-25 20:05:16	Name: __test Value: 2b1ba57d7e2d97f7aad30e05e0347331

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dreamjoker.0fees.us
185.27.134.46
02b9bd6228442c7eb2114e090209dcd030b63af2ce3704961b0c1044083e45d6
19b3843d0a40dd13c6a14d70f2f6b33f6168bd9e1a801685ed7cffe865dea77c
5913917b154069f006a57d78cd8b36a93541ac0ea161b9f53cf8082cf65662ec
8b383325f03e8c098d956cf2cbe78746e492dee143402f6456387bf7a4d2b0c6
a566b6f02ce007eefb26eb055781c56bcd2f80c04f417245918ee6b41ff7d40a
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
d4e472701c379e9c53e500c8553df8ad519cac06b6efdea822c1afa4017e0025

dreamjoker.0fees.us Open in urlscan Pro 185.27.134.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

46 kBTransfer

65 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

dreamjoker.0fees.us Open in urlscan Pro
185.27.134.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

46 kB
Transfer

65 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!