fb-appeal-terms-938420.web.app Open in urlscan Pro
199.36.158.100  Malicious Activity! Public Scan

Submitted URL: https://linkedin.com/slink?code=eabSSBFH
Effective URL: https://fb-appeal-terms-938420.web.app/
Submission: On August 12 via manual from AU — Scanned from AU

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 199.36.158.100, located in United States and belongs to FASTLY, US. The main domain is fb-appeal-terms-938420.web.app.
TLS certificate: Issued by GTS CA 1D4 on July 10th 2023. Valid for: 3 months.
This is the only time fb-appeal-terms-938420.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 2 13.107.42.14 8068 (MICROSOFT...)
5 199.36.158.100 54113 (FASTLY)
2 172.67.69.226 13335 (CLOUDFLAR...)
3 185.244.212.120 9009 (M247)
10 4
Apex Domain
Subdomains
Transfer
5 web.app
fb-appeal-terms-938420.web.app
162 KB
3 flexflex.online
whoop.flexflex.online
573 B
2 ipapi.co
ipapi.co — Cisco Umbrella Rank: 16237
1 KB
2 linkedin.com
linkedin.com — Cisco Umbrella Rank: 215
www.linkedin.com — Cisco Umbrella Rank: 543
3 KB
10 4
Domain Requested by
5 fb-appeal-terms-938420.web.app fb-appeal-terms-938420.web.app
3 whoop.flexflex.online fb-appeal-terms-938420.web.app
2 ipapi.co fb-appeal-terms-938420.web.app
1 www.linkedin.com 1 redirects
1 linkedin.com 1 redirects
10 5

This site contains no links.

Subject Issuer Validity Valid
web.app
GTS CA 1D4
2023-07-10 -
2023-10-08
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-04-16 -
2024-04-15
a year crt.sh
whoop.flexflex.online
R3
2023-07-31 -
2023-10-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://fb-appeal-terms-938420.web.app/
Frame ID: AC0EF28E246B5652CA1BF6EA05C25C22
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Meta for Business

Page URL History Show full URLs

  1. https://linkedin.com/slink?code=eabSSBFH HTTP 301
    https://www.linkedin.com/slink?code=eabSSBFH HTTP 301
    https://fb-appeal-terms-938420.web.app/ Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

164 kB
Transfer

475 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://linkedin.com/slink?code=eabSSBFH HTTP 301
    https://www.linkedin.com/slink?code=eabSSBFH HTTP 301
    https://fb-appeal-terms-938420.web.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
fb-appeal-terms-938420.web.app/
Redirect Chain
  • https://linkedin.com/slink?code=eabSSBFH
  • https://www.linkedin.com/slink?code=eabSSBFH
  • https://fb-appeal-terms-938420.web.app/
881 B
644 B
Document
General
Full URL
https://fb-appeal-terms-938420.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dd742176e25ec110c1235f9ee004dd663629c27f85e85c7821f6eda0733d0bd6
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=3600
content-encoding
br
content-length
275
content-type
text/html; charset=utf-8
date
Sat, 12 Aug 2023 23:31:23 GMT
etag
"1e2832653d9fab651bdfbbcbb7eb0614c2e9de79403dcc321fa1943479531ae3-br"
last-modified
Sat, 12 Aug 2023 12:47:03 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
x-cache-hits
1
x-served-by
cache-bfi-kbfi7400069-BFI
x-timer
S1691883083.180689,VS0,VE1

Redirect headers

cache-control
no-cache, no-store
content-encoding
gzip
content-security-policy
default-src 'none'; connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com *.adnxs.com; script-src 'report-sample' 'sha256-SSoodjUD3LGm2FfFCVHGqEb8D4UM3OOigidT2UKDcYg=' 'sha256-cKTgdnmO6+hXd85a9wKg1effVfVzenUAtUCyOKY9bQE=' 'sha256-DwtT8+ZZKpxH9pqZNAmJ3GdbLAh5SsYaXR3omTXPCns=' 'sha256-sV9jZa797T0QWBzcU/CNd4tpBhTnh+TFdLnfjlitl28=' 'sha256-aa/Q8CRBDSqTQbCIyioPhZaz+G+dbPyu7BzsjInEmiU=' 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-zTIusdVJJeXz9+iox2a+pdDglzbpRpFVRzEwvW4AONk=' 'sha256-iC8MPqNLw0FDnsBf4DlSkFLNTwhkI85aouiAEB819ic=' 'sha256-2EqrEvcPzl8c6/TSGVvaVMEe7lg700MAz/te4/3kTYY=' 'sha256-y5uW69VItKj51mcc7UD9qfptDVUqicZL+bItEpvVNDw=' 'sha256-DatsFGoJ8gFkzzxo47Ou76WZ+3QBPOQHtBu9p9b3DhA=' 'sha256-k95cyM8gFgPziZe5VQ2IvJvBUVyd5zFt2CokIUwqdHE=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' 'sha256-3RIGhhApBii1KY+aW1xk7kFyoQY8vSVE5DfT7E9SJUc=' 'sha256-9pXOIwF4N0gPltLd3AI69lkCjSC2H/Eb3sc5zdmUyYU=' 'sha256-jou6v/Nleyzoc+LXktAv1Fp8M807dVVxy7E/yzVljHc=' 'sha256-6E4e/3dSvj/8JZT2S2yR91mspqM6MyOpKl5lrhHsZa8=' 'sha256-3woF8BZ54TeXM+czaH3aXoaJsVpiamuAKFsXDykAR/Q=' 'sha256-vIfNcKb8ixJg1cfJIoNNYjWcm0lezj1/XpUNFiZyVsU=' 'sha256-cLsHUHFgT/VGX04cZrJ9xgm4HbzTR7ptutkxK+7BlMk=' 'sha256-BwU8jMnQYUhjOpsDVABpfddV/DlP1ZYrFcTumYw7x54=' 'sha256-wz6ika9i3WU3bpUPdhYDZeO/NrDQniDyiscN0LWnyaY=' 'sha256-wy4DvlEW9PHPIGvQJW6Wv4woBSa/0LJHs8LHsBVVXCs=' 'sha256-065A0cJTDQ+hyKvufSL/flW02hIbgLndOINLRWux6To=' 'sha256-Ga5SLB8hPdWUE8Wb6LgZ05D9Z5vrdLAaPbDBW2m3BI8=' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com snap.licdn.com; img-src data: blob: * android-webview-video-poster:; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src 'self' *.licdn.com *.lynda.com; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src 'self' www.youtube.com/embed/ www.youtube-nocookie.com/embed/ lnkd.demdex.net smartlock.google.com accounts.google.com player.vimeo.com *.linkedin.com www.slideshare.net *.megaphone.fm *.omny.fm *.sounder.fm msit.powerbi.com app.powerbi.com linkedin.github.io *.licdn.com *.adnxs.com acdn.adnxs-simple.com radar.cedexis.com; frame-ancestors 'self' *.www.linkedin.com:*; manifest-src 'self'; report-uri https://www.linkedin.com/security/csp?f=default
date
Sat, 12 Aug 2023 23:31:21 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://fb-appeal-terms-938420.web.app
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
pragma
no-cache
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-content-type-options
nosniff
x-frame-options
sameorigin
x-li-fabric
prod-ltx1
x-li-pop
afd-prod-ltx1-x
x-li-proto
http/2
x-li-uuid
AAYCwjofKr73xvTBh6g3Hw==
x-msedge-ref
Ref A: 9928160FE9934DEA991FB81852DD8765 Ref B: SYD03EDGE1018 Ref C: 2023-08-12T23:31:22Z
main.18abcc86.js
fb-appeal-terms-938420.web.app/static/js/
259 KB
76 KB
Script
General
Full URL
https://fb-appeal-terms-938420.web.app/static/js/main.18abcc86.js
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b196dd9a377dcc0b5d1a48476883e1ca0265c12b86949080987177b4bf5b9efe
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://fb-appeal-terms-938420.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-served-by
cache-bfi-kbfi7400069-BFI
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sat, 12 Aug 2023 23:31:23 GMT
last-modified
Sat, 12 Aug 2023 12:47:03 GMT
x-timer
S1691883083.418773,VS0,VE1
etag
"2c5e95fb7a50825b4fb8c61f546401f318f61339306b7501bf2ba7ab77e9421c-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
77539
x-cache-hits
1
main.c1c9e2a9.css
fb-appeal-terms-938420.web.app/static/css/
140 KB
24 KB
Stylesheet
General
Full URL
https://fb-appeal-terms-938420.web.app/static/css/main.c1c9e2a9.css
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
502e38454249c5e31c9cb8a9474fb099524ce011295cda2bd5a9f03f489273d8
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://fb-appeal-terms-938420.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-served-by
cache-bfi-kbfi7400069-BFI
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sat, 12 Aug 2023 23:31:23 GMT
last-modified
Sat, 12 Aug 2023 12:47:03 GMT
x-timer
S1691883083.418891,VS0,VE1
etag
"9d5f8c4a1904f356b4403ef02a6dbd26dd4caa33249b858cf75c45c0ef135a3b-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
24700
x-cache-hits
1
/
ipapi.co/json//
748 B
875 B
XHR
General
Full URL
https://ipapi.co/json//
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/static/js/main.18abcc86.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.67.69.226 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47869d25d2d818514672a92bfda43cb1b23fb6ec2910e6cc8e0c8954c496947a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
application/json, text/plain, */*
Referer
https://fb-appeal-terms-938420.web.app/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sat, 12 Aug 2023 23:31:24 GMT
content-encoding
br
x-content-type-options
nosniff
referrer-policy
same-origin
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Host, origin
allow
OPTIONS, HEAD, POST, OPTIONS, GET
content-type
application/json
access-control-allow-origin
https://fb-appeal-terms-938420.web.app
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZQOlEkOeF3h13zpaVWAUgtwaekwbI%2BQLmON27LCRKrHVKKZETw4FBFuf1emBf%2BuUkng4OHPw7SV9rXrcVV6G7FpmrS%2BHwQ8LdhKThmZ7F80Ct8%2FJdCJzxhew"}],"group":"cf-nel","max_age":604800}
x-frame-options
DENY
cf-ray
7f5c82fe9f72a814-SYD
shadow
whoop.flexflex.online/api/activity/
0
0
Preflight
General
Full URL
https://whoop.flexflex.online/api/activity/shadow
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.244.212.120 , Austria, ASN9009 (M247, RO),
Reverse DNS
no-mans-land.m247.com
Software
nginx/1.25.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://fb-appeal-terms-938420.web.app
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
2
Content-Type
text/plain; charset=utf-8
Date
Sat, 12 Aug 2023 23:31:25 GMT
Server
nginx/1.25.1
access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin
https://fb-appeal-terms-938420.web.app
access-control-max-age
600
vary
Origin
shadow
whoop.flexflex.online/api/activity/
85 B
311 B
XHR
General
Full URL
https://whoop.flexflex.online/api/activity/shadow
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/static/js/main.18abcc86.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.244.212.120 , Austria, ASN9009 (M247, RO),
Reverse DNS
no-mans-land.m247.com
Software
nginx/1.25.1 /
Resource Hash
5bca00413d504d784b3974bb8d78ec197273152c0e4ce073d51250e69e8ee53c

Request headers

Accept
application/json, text/plain, */*
Referer
https://fb-appeal-terms-938420.web.app/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
*
Date
Sat, 12 Aug 2023 23:31:26 GMT
access-control-allow-credentials
true
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
85
Content-Type
application/json
init
whoop.flexflex.online/api/set_status/null/
36 B
262 B
XHR
General
Full URL
https://whoop.flexflex.online/api/set_status/null/init
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/static/js/main.18abcc86.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.244.212.120 , Austria, ASN9009 (M247, RO),
Reverse DNS
no-mans-land.m247.com
Software
nginx/1.25.1 /
Resource Hash
3a81f99aaef5363691cb6067c2fe3c2b5eea5da386a7f80fcf7eafdd42e90de1

Request headers

Accept
application/json, text/plain, */*
Referer
https://fb-appeal-terms-938420.web.app/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-origin
*
Date
Sat, 12 Aug 2023 23:31:26 GMT
access-control-allow-credentials
true
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
36
Content-Type
application/json
humanIcon.62b0718b3254f2a8ab0f.png
fb-appeal-terms-938420.web.app/static/media/
48 KB
49 KB
Image
General
Full URL
https://fb-appeal-terms-938420.web.app/static/media/humanIcon.62b0718b3254f2a8ab0f.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e43b722e09d8ee493d73b4f584aa8e2f78c442cfc4043f2e7f1b355e3ff40832
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://fb-appeal-terms-938420.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-served-by
cache-bfi-kbfi7400069-BFI
strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Sat, 12 Aug 2023 23:31:26 GMT
last-modified
Sat, 12 Aug 2023 12:47:03 GMT
x-timer
S1691883087.639374,VS0,VE190
etag
"3694b4c786979c51761baf5e779bf0934360134b8833ac95e9772d74d69f7754"
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
49604
x-cache-hits
0
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f95ec6c859f4afa3cdc887673121919c3cf6fa04c41b4304a9bc71463bd84d0

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
montserrat-latin-400-normal.acb6629fe45c43ad5d8b.woff2
fb-appeal-terms-938420.web.app/static/media/
12 KB
13 KB
Font
General
Full URL
https://fb-appeal-terms-938420.web.app/static/media/montserrat-latin-400-normal.acb6629fe45c43ad5d8b.woff2
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/static/css/main.c1c9e2a9.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://fb-appeal-terms-938420.web.app/static/css/main.c1c9e2a9.css
Origin
https://fb-appeal-terms-938420.web.app
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-served-by
cache-bfi-kbfi7400069-BFI
strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Sat, 12 Aug 2023 23:31:26 GMT
last-modified
Sat, 12 Aug 2023 12:47:03 GMT
x-timer
S1691883087.641615,VS0,VE66
etag
"9936ad15e4effac7653de2aa961f683f422c699706361895a0a6713eebfb29ea"
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
font/woff2
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
12708
x-cache-hits
0
/
ipapi.co/json//
748 B
660 B
XHR
General
Full URL
https://ipapi.co/json//
Requested by
Host: fb-appeal-terms-938420.web.app
URL: https://fb-appeal-terms-938420.web.app/static/js/main.18abcc86.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.67.69.226 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47869d25d2d818514672a92bfda43cb1b23fb6ec2910e6cc8e0c8954c496947a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
application/json, text/plain, */*
Referer
https://fb-appeal-terms-938420.web.app/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Sat, 12 Aug 2023 23:31:27 GMT
content-encoding
br
x-content-type-options
nosniff
referrer-policy
same-origin
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Host, origin
allow
HEAD, OPTIONS, POST, OPTIONS, GET
content-type
application/json
access-control-allow-origin
https://fb-appeal-terms-938420.web.app
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZT1%2BoV6ErzGXEuzxjm87YpJqXkpJq5Ol1bFoifHVdC1qqZPp3kPN6xuxeZtksSxmNiFbhlMtZuXzNgbzJ4MQfht4ijoDiahjOdOakB9syZqjO99r09WY8XM5"}],"group":"cf-nel","max_age":604800}
x-frame-options
DENY
cf-ray
7f5c8311d8a0a814-SYD

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkst3

3 Cookies

Domain/Path Name / Value
.linkedin.com/ Name: bcookie
Value: "v=2&0ff9c988-cda4-4aed-8ab1-ffc3f17ba4b0"
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023081223312220eee193-7d1e-4ed0-8b71-f8789bc4cdb2AQH5UXarYFr2PZaQIphm0oYCuw4hhYZI"
.linkedin.com/ Name: lidc
Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2989:u=1:x=1:i=1691883082:t=1691969482:v=2:sig=AQGNHi_Esws0W4_ifIHJRVeXx3Ur8Kxz"

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload