urlscan.io logo urlscan.io
SecurityTrails logo

fastlog.org Open in urlscan Pro
2a02:4780:11:779:0:23c9:b328:7  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://fastlog.org/MzYmYW1wO2k9MTI5MzU5
Submission: On July 10 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2a02:4780:11:779:0:23c9:b328:7, located in Mumbai, India and belongs to AS-HOSTINGER, CY. The main domain is fastlog.org.
TLS certificate: Issued by R3 on May 30th 2023. Valid for: 3 months.
This is the only time fastlog.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 2a02:4780:11:... 47583 (AS-HOSTINGER)
7 50.87.249.216 46606 (UNIFIEDLA...)
1 2a03:2880:f08... 32934 (FACEBOOK)
1 2a03:2880:f17... 32934 (FACEBOOK)
10 4
Apex Domain
Subdomains		 Transfer
7 nihmatougestion.com
nihmatougestion.com
78 KB
1 facebook.com
facebook.com — Cisco Umbrella Rank: 30
1 KB
1 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 660
2 KB
1 fastlog.org
fastlog.org
865 B
10 4
Domain Requested by
7 nihmatougestion.com fastlog.org
nihmatougestion.com
1 facebook.com nihmatougestion.com
1 static.xx.fbcdn.net nihmatougestion.com
1 fastlog.org
10 4

This site contains no links.

Subject Issuer Validity Valid
fastlog.org
R3		 2023-05-30 -
2023-08-28		 3 months crt.sh
nihmatougestion.com
R3		 2023-06-05 -
2023-09-03		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-04-18 -
2023-07-17		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://fastlog.org/MzYmYW1wO2k9MTI5MzU5
Frame ID: DD91AE7E383527378EF7C510FCDE9644
Requests: 1 HTTP requests in this frame

Frame: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Frame ID: 237D8F1A87E6FAA5A7C833731D61B94D
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Hello - Welcome! Please log in to continue...zabi

Page Statistics

10
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

82 kB
Transfer

223 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request MzYmYW1wO2k9MTI5MzU5
fastlog.org/ 		1010 B
865 B 		Document
General
Check archive.org
Download Go to
Full URL
https://fastlog.org/MzYmYW1wO2k9MTI5MzU5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:4780:11:779:0:23c9:b328:7 Mumbai, India, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.33
Resource Hash
4f52e5570fe19bc9c154ca25627e6dc53910ecc3380d1b7ac86edd0bbd664b90
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
548
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Mon, 10 Jul 2023 06:01:09 GMT
platform
hostinger
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
/
nihmatougestion.com/build/scss/cache/slider/ Frame 237D 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Requested by
Host: fastlog.org
URL: https://fastlog.org/MzYmYW1wO2k9MTI5MzU5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
7d93c53cb9caded75b242445a7f4adae8708d64be6308c7f46dc82ca337f9314

Request headers

Referer
https://fastlog.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=7200
content-encoding
gzip
content-length
3565
content-type
text/html; charset=UTF-8
date
Mon, 10 Jul 2023 06:01:10 GMT
expires
Mon, 10 Jul 2023 08:01:10 GMT
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
x-nginx-cache
WordPress
fak.css
nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/ Frame 237D 		15 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/fak.css
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
dfa6b65f287498c1423afff9c2e2e6ca235fcab9ca5716fc17f7c7546e1c66f9

Request headers

Referer
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Origin
https://nihmatougestion.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Wed, 09 Nov 2022 22:59:38 GMT
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
4880
expires
Wed, 09 Aug 2023 06:01:10 GMT
Lili.css
nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/ Frame 237D 		90 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/Lili.css
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
779865d0e75fc073f1577ab0dc8c1e1d6aeabba5ee40a7c53d984d149bd2b918

Request headers

Referer
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Origin
https://nihmatougestion.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Wed, 09 Nov 2022 22:59:38 GMT
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
expires
Wed, 09 Aug 2023 06:01:10 GMT
banana.css
nihmatougestion.com/build/scss/cache/slider/Fbm/sat/ Frame 237D 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/Fbm/sat/banana.css
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
d7476964b6524d83272bd58967b3fa74530843bcefdbe727544f2af8d1e00489

Request headers

Referer
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Origin
https://nihmatougestion.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Wed, 09 Nov 2022 22:59:38 GMT
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
text/css
cache-control
max-age=2592000
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
2179
expires
Wed, 09 Aug 2023 06:01:10 GMT
zab.js
nihmatougestion.com/build/scss/cache/slider/Fbm/sat/ Frame 237D 		98 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/Fbm/sat/zab.js
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
5b0df72a353d4337c21af23f3f15d3f738e6ccc1680e2ab45e85eccedb396804

Request headers

Referer
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Origin
https://nihmatougestion.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Wed, 09 Nov 2022 22:59:38 GMT
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
application/javascript
cache-control
max-age=21600
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
expires
Mon, 10 Jul 2023 12:01:10 GMT
Lili.js
nihmatougestion.com/build/scss/cache/slider/Fbm/sat/ Frame 237D 		857 B
495 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nihmatougestion.com/build/scss/cache/slider/Fbm/sat/Lili.js
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
8b6e74d56bcb7fe1d99c6cb8e522abffbd5fbd508553811abe6e375c9b5ad60f

Request headers

Referer
https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Origin
https://nihmatougestion.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Wed, 09 Nov 2022 22:59:38 GMT
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
application/javascript
cache-control
max-age=21600
accept-ranges
bytes
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
458
expires
Mon, 10 Jul 2023 12:01:10 GMT
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ Frame 237D 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://nihmatougestion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 10 Jul 2023 06:01:10 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1027
x-fb-debug
1X/rAjqQHXjVekn51vI0RqLqCBQyD7Ig/uhYKnY3rGPt3z83fry8Dt3uqt6Bc2jd7Ioxt92Z9SUolyRF1GFcsg==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin
*
expires
Mon, 08 Jul 2024 11:23:22 GMT
hsts-pixel.gif
facebook.com/security/ Frame 237D 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://facebook.com/security/hsts-pixel.gif
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/?1=36&i=129359
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://nihmatougestion.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
date
Mon, 10 Jul 2023 06:01:10 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
pragma
no-cache
x-fb-debug
YLq81a3Eht1+f3m20KVNOrxi7AO/6PA67RRL9/qNMFuofkPcsbCmcvRu/do1IHug1yG7mimDqY8OnGxxkRSzHA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/gif
access-control-allow-origin
*
origin-agent-cluster
?0
cache-control
private, no-cache, no-store, must-revalidate
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
EDFsehamV8T.png
nihmatougestion.com/rsrc.php/v3/yj/r/ Frame 237D 		66 B
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nihmatougestion.com/rsrc.php/v3/yj/r/EDFsehamV8T.png
Requested by
Host: nihmatougestion.com
URL: https://nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/fak.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.87.249.216 , Canada, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box2078.bluehost.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://nihmatougestion.com/build/scss/cache/slider/Fbm/maroc/fak.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 10 Jul 2023 06:01:11 GMT
content-encoding
gzip
x-nginx-cache
WordPress
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
78
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests