gzo4cq5q93.projects.webpages.one Open in urlscan Pro
143.198.248.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gzo4cq5q93.projects.webpages.one/
Submission: On February 07 via manual (February 7th 2022, 8:32:50 am UTC) from IN — Scanned from NL

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 8 domains to perform 14 HTTP transactions. The main IP is 143.198.248.15, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is gzo4cq5q93.projects.webpages.one.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 20th 2021. Valid for: a year.

This is the only time gzo4cq5q93.projects.webpages.one was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	143.198.248.15 143.198.248.15	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	178.128.136.210 178.128.136.210	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
5	2600:9000:225... 2600:9000:225e:8e00:9:685b:3d00:21	16509 (AMAZON-02) (AMAZON-02)
1 3	145.14.151.200 145.14.151.200	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	170.10.160.83 170.10.160.83	32748 (STEADFAST) (STEADFAST)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	67.202.94.94 67.202.94.94	32748 (STEADFAST) (STEADFAST)
14	9

1 143.198.248.15 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

gzo4cq5q93.projects.webpages.one	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.128.136.210 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

app.fastpages.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:225e:8e00:9:685b:3d00:21 (United States)

ASN16509 (AMAZON-02, US)

d1zviajkun9gxg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 145.14.151.200 (Netherlands) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

kills2022.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 170.10.160.83 (United States)

ASN32748 (STEADFAST, US)
PTR: serverchat24.com

mamerculo.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.94 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	cloudfront.net d1zviajkun9gxg.cloudfront.net	123 KB
3	kills2022.com 1 redirects kills2022.com	41 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 92	49 KB
1	amung.us whos.amung.us — Cisco Umbrella Rank: 12727	24 B
1	facebook.com facebook.com — Cisco Umbrella Rank: 32	2 KB
1	mamerculo.eu mamerculo.eu	1 KB
1	fastpages.io app.fastpages.io	82 B
1	webpages.one gzo4cq5q93.projects.webpages.one	2 KB
14	8

	Domain	Requested by
5	d1zviajkun9gxg.cloudfront.net	gzo4cq5q93.projects.webpages.one
3	kills2022.com	1 redirects gzo4cq5q93.projects.webpages.one
2	www.youtube.com	gzo4cq5q93.projects.webpages.one www.youtube.com
1	whos.amung.us	gzo4cq5q93.projects.webpages.one
1	facebook.com	gzo4cq5q93.projects.webpages.one
1	mamerculo.eu	gzo4cq5q93.projects.webpages.one
1	app.fastpages.io	gzo4cq5q93.projects.webpages.one
1	gzo4cq5q93.projects.webpages.one
14	8

This site contains no links.

Subject Issuer	Validity	Valid
*.projects.webpages.one Sectigo RSA Domain Validation Secure Server CA	`2021-08-20` - `2022-08-20`	a year	crt.sh
app.fastpages.io Sectigo RSA Domain Validation Secure Server CA	`2021-10-21` - `2022-10-26`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
kills2022.com ZeroSSL RSA Domain Secure Site CA	`2021-12-30` - `2022-03-30`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
mamerculo.eu cPanel, Inc. Certification Authority	`2021-12-24` - `2022-03-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-11-16` - `2022-02-14`	3 months	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://gzo4cq5q93.projects.webpages.one/
Frame ID: 958F80E5E615D29B1B0739A9946A02D1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log into Facebook | Facebook

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

93 %
HTTPS

38 %
IPv6

8
Domains

8
Subdomains

9
IPs

3
Countries

219 kB
Transfer

887 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

https://kills2022.com/location HTTP 301
https://kills2022.com/location/

14 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
gzo4cq5q93.projects.webpages.one/ 4 KB
2 KB 306ms
29ms Document
text/html 143.198.248.15
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.198.248.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty/1.19.3.1 / Express
Resource Hash: 201cebe23774d71adb48f61d2b044858261444f3e4e92dcd3bc5883b6aa5b67e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9

Response headers

Server: openresty/1.19.3.1
Date: Mon, 07 Feb 2022 08:32:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: Express
Cache-Set: 1644220098441
Cache-Hit: hit
X-Response-Time: 8.353ms
Content-Encoding: gzip

GET
H/1.1 200
OK fire
app.fastpages.io/api/project/public/ 82 B
82 B 921ms
151ms Image
image/gif 178.128.136.210
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://app.fastpages.io/api/project/public/fire?uuid=1544ebc5-98fa-434a-91ee-1c3bb4726204&evId=14442160-1b24-480d-9166-b3c6dcfc1338
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.128.136.210 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: openresty/1.17.8.2 / PHP/7.4.27
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 08:32:46 GMT
Server: openresty/1.17.8.2
X-Powered-By: PHP/7.4.27
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-Control: no-cache, private
Connection: keep-alive
x-request-id: ef8b13f9-649c-45f2-bef3-38cd3e189e58

GET
H2 200 client.css
d1zviajkun9gxg.cloudfront.net/project/v0.4.30/ 396 KB
51 KB 80ms
24ms Stylesheet
text/css 2600:9000:225e:8e00:9:685b:3d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1zviajkun9gxg.cloudfront.net/project/v0.4.30/client.css
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8e00:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1b3272c0144d77a5e78f21b2e23ab3561e43f585de11ec6572fe33bb4abea65d

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 05 Feb 2022 17:57:33 GMT
content-encoding: gzip
last-modified: Fri, 04 Feb 2022 15:55:28 GMT
server: AmazonS3
age: 138913
etag: W/"ac047ad3d8436ffb3ec43de94338226e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: null
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-type: text/css
x-amz-cf-id: vqJDweo-ldtOnARKYRiyTjjZdef0QJZz3pMDwVHNLiuAaVrASZ86Ow==

GET
H2 200 / Show response
kills2022.com/ 119 KB
40 KB 561ms
22ms Script
application/javascript 145.14.151.200
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://kills2022.com/?api=1&lan=lapara&ht=2

Requested by

Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

145.14.151.200 , Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/7.4.26

Resource Hash

122fed3e7db83b5ab402b1ac652de47ef69ab46b347069ad99e1c0e70ebf0517

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 08:32:45 GMT
content-encoding: br
server: LiteSpeed
x-powered-by: PHP/7.4.26
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 jquery-3.1.1.1.min.js Show response
d1zviajkun9gxg.cloudfront.net/content/vendor/jquery/ 85 KB
30 KB 102ms
47ms Script
text/javascript 2600:9000:225e:8e00:9:685b:3d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1zviajkun9gxg.cloudfront.net/content/vendor/jquery/jquery-3.1.1.1.min.js
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8e00:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 91a540f0a5679a1f9a9e5efb7415a3f34e1154b7df6deed35fcb6108f9720c14

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 16:51:00 GMT
content-encoding: gzip
last-modified: Wed, 29 May 2019 08:29:06 GMT
server: AmazonS3
age: 315706
etag: W/"48b9c0dda22c0ffe1297fb6556675a2e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: null
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
cache-control: max-age=1209600
x-amz-cf-pop: FRA60-P4
content-type: text/javascript
x-amz-cf-id: tDSwSvMrWADSDClSBQRwQ8gQpyAkUCz0fl6FpmFWyU2IJOwTS0ZGPw==

GET
H2 200 project.js Show response
d1zviajkun9gxg.cloudfront.net/content/general/ 2 KB
1 KB 106ms
51ms Script
text/javascript 2600:9000:225e:8e00:9:685b:3d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1zviajkun9gxg.cloudfront.net/content/general/project.js
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8e00:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 956f3df92829210efc814d57b1d9a79c89ee5890d01c5185a7c713dcec2c39f1

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 28 Jan 2022 08:52:17 GMT
content-encoding: gzip
last-modified: Wed, 15 Jan 2020 15:21:59 GMT
server: AmazonS3
age: 862829
etag: W/"b99bf4631e6ffd83ba4ce0db9d878942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: null
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-type: text/javascript
x-amz-cf-id: SQkRdWVf54P0weP8I7_gCJkPIfvNF03nu1T0rTPNL5zm9_dzmm032Q==

GET
H2 200 lazysizes.min.js Show response
d1zviajkun9gxg.cloudfront.net/content/vendor/lazysizes/ 7 KB
4 KB 106ms
51ms Script
text/javascript 2600:9000:225e:8e00:9:685b:3d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1zviajkun9gxg.cloudfront.net/content/vendor/lazysizes/lazysizes.min.js
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8e00:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06821251a29e71f8fd4f60349667c54d163b16d7bc8b1d47144c7f5042683eef

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: wOfhWuKhZUWg6cTPVmggDIMOoc9zOXto
content-encoding: gzip
last-modified: Thu, 11 Jul 2019 07:35:54 GMT
server: AmazonS3
age: 877924
etag: W/"149ff45fc6c2f13e892e438a58abb77f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
date: Fri, 28 Jan 2022 04:40:42 GMT
x-amz-cf-pop: FRA60-P4
x-amz-cf-id: EorTu_IuxiK0SR9T-8VgUn5wXePead3qeid295gqXEZMnQ612jjg0g==

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
2 KB 87ms
37ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8467a8357349298073591bd163beabc28e27331b03e6dc9bf7f9d2a66757bf7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 08:32:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=nl for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94"
expires: Mon, 07 Feb 2022 08:32:45 GMT

GET
H2 200 bundle.client.js Show response
d1zviajkun9gxg.cloudfront.net/project/v0.4.30/ 123 KB
38 KB 115ms
60ms Script
application/javascript 2600:9000:225e:8e00:9:685b:3d00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1zviajkun9gxg.cloudfront.net/project/v0.4.30/bundle.client.js
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8e00:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 73ad7e4d05e0d02b686a6416009c51d9dcdcd80dfc1e2cc89bb87d49298b0e9a

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 05 Feb 2022 17:57:33 GMT
content-encoding: gzip
last-modified: Fri, 04 Feb 2022 15:55:28 GMT
server: AmazonS3
age: 138913
etag: W/"41df6b032b354bf30f0bb3ffc559edc1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: null
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
content-type: application/javascript
x-amz-cf-id: cE1uG5TYjtoKChagbvHeQz8jVzzpZXcKKxalL-tBhGnxSln1icNmBQ==

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/0cd11746/www-widgetapi.vflset/ 146 KB
48 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/0cd11746/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

101df151aa008e88d6f4e497cc3558f63d2524f788e46e3e3a109a4620aff141

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 08:21:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 679
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48379
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 01:18:07 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 07 Feb 2023 08:21:26 GMT

GET
H3

200

/ Show response
kills2022.com/location/
Redirect Chain

https://kills2022.com/location
https://kills2022.com/location/

1 KB
618 B

16ms
16ms

Script
application/javascript

145.14.151.200
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://kills2022.com/location/

Requested by

Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/

Protocol

Server

145.14.151.200 , Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/7.4.26

Resource Hash

6ebfae6466d3964cd2ea9b003614f774305042f8dd81de7c8f3d0aa5cbab0798

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 08:32:45 GMT
content-encoding: br
server: LiteSpeed
x-powered-by: PHP/7.4.26
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
content-security-policy: upgrade-insecure-requests
content-length: 517
expires: Mon, 14 Feb 2022 08:32:45 GMT

Redirect headers

location: https://kills2022.com/location/
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
server: LiteSpeed
date: Mon, 07 Feb 2022 08:32:45 GMT
content-length: 707
content-type: text/html

GET
H2 200 dF5SId3UHWd.svg
mamerculo.eu/landings/facebooknew/images/ 2 KB
1 KB 715ms
102ms Image
image/svg+xml 170.10.160.83
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mamerculo.eu/landings/facebooknew/images/dF5SId3UHWd.svg
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 170.10.160.83 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: serverchat24.com
Software: LiteSpeed /
Resource Hash: 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 08:32:46 GMT
content-encoding: br
last-modified: Sat, 27 Nov 2021 19:24:33 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length: 1029
expires: Mon, 14 Feb 2022 08:32:46 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
2 KB 88ms
40ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* attachment.fbsbx.com blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: B9ipET1u7C2VIA+4nKFjTvAzZxVuapVUgnpaIOHI0dv6RI38A8PbP4SXzyfbBX01L9OwPeZd6hj95LSValvKPA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 07 Feb 2022 08:32:45 GMT
strict-transport-security: max-age=15552000; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-fb-rlafr: 0
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET
H2 200 /
whos.amung.us/pingjs/ 24 B
24 B 316ms
103ms Image
text/javascript 67.202.94.94
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whos.amung.us/pingjs/?k=andyus&t=%F0%9F%98%88QUE%20FUE?%F0%9F%94%A5&x=%20https://yahoo.com/
Requested by: Host: gzo4cq5q93.projects.webpages.one
URL: https://gzo4cq5q93.projects.webpages.one/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.202.94.94 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: amung.us
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://gzo4cq5q93.projects.webpages.one/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 08:32:46 GMT
content-encoding: gzip
content-type: text/javascript;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gzo4cq5q93.projects.webpages.one/	1970-01-20 09:29:18	Name: campaign-track Value: dHJhY2stMjEyLjcuMjEwLjE3NTE2NDQyMjI3NjUxNzg%3D
gzo4cq5q93.projects.webpages.one/	1970-01-20 09:29:18	Name: campaign-timer Value: dGltZXItMjEyLjcuMjEwLjE3NTE2NDQyMjI3NjUxNzg%3D
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: L_C9IxWMkbs
.youtube.com/	1970-01-20 05:02:54	Name: VISITOR_INFO1_LIVE Value: o7Dpm1VWkK4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.fastpages.io
d1zviajkun9gxg.cloudfront.net
facebook.com
gzo4cq5q93.projects.webpages.one
kills2022.com
mamerculo.eu
whos.amung.us
www.youtube.com
143.198.248.15
145.14.151.200
170.10.160.83
178.128.136.210
2600:9000:225e:8e00:9:685b:3d00:21
2a00:1450:4001:828::200e
2a03:2880:f11c:8183:face:b00c:0:25de
67.202.94.94
06821251a29e71f8fd4f60349667c54d163b16d7bc8b1d47144c7f5042683eef
101df151aa008e88d6f4e497cc3558f63d2524f788e46e3e3a109a4620aff141
122fed3e7db83b5ab402b1ac652de47ef69ab46b347069ad99e1c0e70ebf0517
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
1b3272c0144d77a5e78f21b2e23ab3561e43f585de11ec6572fe33bb4abea65d
201cebe23774d71adb48f61d2b044858261444f3e4e92dcd3bc5883b6aa5b67e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6ebfae6466d3964cd2ea9b003614f774305042f8dd81de7c8f3d0aa5cbab0798
73ad7e4d05e0d02b686a6416009c51d9dcdcd80dfc1e2cc89bb87d49298b0e9a
8467a8357349298073591bd163beabc28e27331b03e6dc9bf7f9d2a66757bf7a
91a540f0a5679a1f9a9e5efb7415a3f34e1154b7df6deed35fcb6108f9720c14
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
956f3df92829210efc814d57b1d9a79c89ee5890d01c5185a7c713dcec2c39f1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

gzo4cq5q93.projects.webpages.one Open in urlscan Pro 143.198.248.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

38 %IPv6

8 Domains

8 Subdomains

9 IPs

3 Countries

219 kBTransfer

887 kBSize

4 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

55 JavaScript Global Variables

4 Cookies

Indicators

gzo4cq5q93.projects.webpages.one Open in urlscan Pro
143.198.248.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

38 %
IPv6

8
Domains

8
Subdomains

9
IPs

3
Countries

219 kB
Transfer

887 kB
Size

4
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!