breakingnews.netf.es Open in urlscan Pro
2a02:4780:27:1066:0:3921:26f0:3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response breakingnews.netf.es/	34 KB 9 KB	248ms 51ms	Document text/html	2a02:4780:27:1066:0:3921:26f0:3 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://breakingnews.netf.es/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:27:1066:0:3921:26f0:3 Paris, France, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / PHP/8.0.28 Resource Hash b594aa792cdcb4aa85f4bd4ad5c4b3d5ba5b2c1be1ea183282f0df4789715f27 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding br content-length 8774 content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Mon, 24 Apr 2023 02:33:08 GMT etag "48-1682039989;br" expires Thu, 19 Nov 1981 08:52:00 GMT link <https://breakingnews.netf.es/index.php/wp-json/>; rel="https://api.w.org/" platform hostinger pragma no-cache server LiteSpeed vary Accept-Encoding x-litespeed-cache hit x-powered-by PHP/8.0.28
GET H2	200	script Show response fenixpanel.net/profiles/	78 KB 57 KB	1248ms 739ms	Script application/javascript	2606:4700:3032::ac43:cea3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fenixpanel.net/profiles/script?user_id=13&template=mfacebook-v2 Requested by Host: breakingnews.netf.es URL: https://breakingnews.netf.es/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:cea3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc4f07d747c8e59327360ccd54a7bdb5a66f80bcb41b118cbc0df24ef624526b Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://breakingnews.netf.es/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Mon, 24 Apr 2023 02:33:09 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pFiKm9gU6DY4q7nXs%2BTST0UQJNjVQK5%2Fkd8HFjPfZtn%2B6mnve2yI2A0XdsGs22Ol4Z29kSj4tcGI4OQt7LslgN%2BEaZ9YEaWN%2Fe4GzJQQyfeEd%2F72cXo%2BvnEb8PcKxYLlzK2BnmuEzw%2FxZg2S%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control no-cache, private cf-ray 7bcaf096b8c36683-MAD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-xss-protection 1; mode=block
GET H2	200	wp-emoji-release.min.js Show response breakingnews.netf.es/wp-includes/js/	18 KB 5 KB	51ms 51ms	Script application/x-javascript	2a02:4780:27:1066:0:3921:26f0:3 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://breakingnews.netf.es/wp-includes/js/wp-emoji-release.min.js?ver=6.2 Requested by Host: breakingnews.netf.es URL: https://breakingnews.netf.es/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:27:1066:0:3921:26f0:3 Paris, France, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language es-ES,es;q=0.9 Referer https://breakingnews.netf.es/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Mon, 24 Apr 2023 02:33:08 GMT content-encoding br content-security-policy upgrade-insecure-requests last-modified Mon, 17 Apr 2023 04:47:58 GMT server LiteSpeed etag "4904-643ccf7e-9673d168353820f5;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 4605 expires Mon, 01 May 2023 02:33:08 GMT
GET H2	200	/ whos.amung.us/pingjs/	18 B 18 B	268ms 191ms	Image text/javascript	2606:4700:10::6816:4aab CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=&t=Laravel%20GLOBAL%20&x=https://browserleaks.com/ip Requested by Host: breakingnews.netf.es URL: https://breakingnews.netf.es/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language es-ES,es;q=0.9 Referer https://breakingnews.netf.es/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Mon, 24 Apr 2023 02:33:10 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 7bcaf09d0f5469e4-MAD content-type text/javascript;charset=UTF-8
GET H2	200	/ whos.amung.us/pingjs/	26 B 26 B	456ms 379ms	Image text/javascript	2606:4700:10::6816:4aab CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=pituford&t=Laravel%20&x=https://browserleaks.com/ip Requested by Host: breakingnews.netf.es URL: https://breakingnews.netf.es/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language es-ES,es;q=0.9 Referer https://breakingnews.netf.es/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Mon, 24 Apr 2023 02:33:10 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 7bcaf09d0f5569e4-MAD content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b Request headers accept-language es-ES,es;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	51 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f Request headers accept-language es-ES,es;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| _wpemojiSettings object| twemoji object| wp string| html string| user_counter string| back string| repeat boolean| ignoreHistoryChange boolean| ignoreHashChange function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

breakingnews.netf.es
fenixpanel.net
whos.amung.us
2606:4700:10::6816:4aab
2606:4700:3032::ac43:cea3
2a02:4780:27:1066:0:3921:26f0:3
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
b594aa792cdcb4aa85f4bd4ad5c4b3d5ba5b2c1be1ea183282f0df4789715f27
bc4f07d747c8e59327360ccd54a7bdb5a66f80bcb41b118cbc0df24ef624526b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855