mail.confirmationhelpmeta.io.vn Open in urlscan Pro
103.18.7.220  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request test1.php Show response mail.confirmationhelpmeta.io.vn/	54 KB 12 KB	1325ms 615ms	Document text/html	103.18.7.220
General Check archive.org Show headers Download Go to Full URL https://mail.confirmationhelpmeta.io.vn/test1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.18.7.220 , Viet Nam, ASN (), Reverse DNS shost003.tenten.vn Software LiteSpeed / PHP/7.4.8 Resource Hash af71196dc68ca527a2437ac5371317f5776ac7623cb7dc3a7f83d126c1621f9c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-type text/html; charset=UTF-8 date Thu, 14 Nov 2024 03:02:31 GMT server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.4.8
GET H/1.1	200 OK	css.css cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/	23 KB 6 KB	151ms 27ms	Stylesheet text/css	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/css.css Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7cd684139d86fdd64582a8d2e26e0738ebe2b1d9454e1db69d9a9fe3a7688d94 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers Content-Encoding br Cf-Bgj minify ETag W/"06f9449818c01039f25e5cd4686d9c8a" Age 1773380 CF-Cache-Status HIT Expires Fri, 14 Nov 2025 03:02:31 GMT Cf-Polished origSize=23775 alt-svc h3=":443"; ma=86400 Date Thu, 14 Nov 2024 03:02:31 GMT Content-Type text/css Last-Modified Sat, 13 Jan 2024 14:48:24 GMT Vary Accept-Encoding Transfer-Encoding chunked Strict-Transport-Security max-age=31536000; includeSubDomains; preload Cache-Control public, max-age=31536000 Connection keep-alive CF-RAY 8e23c3619e28901c-FRA Server cloudflare
GET H/1.1	200 OK	js.js Show response cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/	126 KB 27 KB	151ms 27ms	Script application/javascript	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/js.js Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2756f49df3178ef871e65b44956598f975f93c8c37a1461376f8e7f53089c707 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers Content-Encoding br CF-Cache-Status HIT ETag W/"5c6537f6043b1d1a2271ca63cad46d52" Age 73676 Expires Fri, 14 Nov 2025 03:02:31 GMT alt-svc h3=":443"; ma=86400 Date Thu, 14 Nov 2024 03:02:31 GMT Content-Type application/javascript Last-Modified Sat, 13 Jan 2024 14:48:24 GMT Vary Accept-Encoding Transfer-Encoding chunked Strict-Transport-Security max-age=31536000; includeSubDomains; preload Cache-Control public, max-age=31536000 Connection keep-alive CF-RAY 8e23c36198b11cc3-FRA Server cloudflare
GET H3	200	/ Show response r3-pages-views.greatpages.com.br/	0 221 B	45ms 21ms	Script application/javascript	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://r3-pages-views.greatpages.com.br/?g=eyJ2IjoxLCJhIjoicGFnZXZpZXciLCJzIjoiV1Zka2JHTjVOWGRqYlRoMVdXNUpkbHB0Um1wYVYwcDJZakp6ZEdNeVRtaGlaMGxxTTB4MlNrdEliRWhLUzFKMVR6bHRSSGRFYkZwaFNGSXdZMGhOTmt4NU9YcFpNa1oxVEZkYWVWbFhOV3BhVXpWMyIsImQiOiIyMDI0LTAxLTE2IDA4OjE4OjA2IiwiZSI6IkdQYWdlcy42NTE2MTcwNTM2Nzg4NjQ2NiIsImkiOiJjMGx0YkhWa1IxWnVZMjFHYWxsWE9XWmFiVVpxV2xkS2RtSXlkR1pqUjJ3MFdsZDRabHBZV214aWJsSjJXREpHYWxwWVRucGlNVGwzV2xoS2VtSXlOV2hpUjJ3MldWZFNka2xxY0hWa1YzaHpURU5LY0dKdVVteGFNMHBvV1RKR2RsZ3lXbWhaTWxacFlqSTVjbGd6UW5CbFIxWnpXREpXTWxwWE5UQmllVWsyU1d4Q2FGb3lWbGRoVjFZelNXbDNhV0ZYTlRCYVYyUjVXVmRPYUdJeE9XMVpWMDVzV1cwNWRtRXhPWGRoV0doc1lrWTViR1J0Vm5Wa1J6bG1ZMGRXZVdNeU9YVlpWM2h3WlcxR2EySjVTVFppYmxaellrTjNhV0ZYTlRCYVYyUjVXVmRPYUdJeE9XMVpWMDVzV1cwNWRtRXhPWGRoV0doc1lrWTViR1J0Vm5Wa1J6bG1XVEk1ZFdSSFZqRmFSemxtWkcxR2MySXpTV2xQYlRVeFlrZDNjMGx0YkhWa1IxWnVZMjFHYWxsWE9XWmFiVVpxV2xkS2RtSXlkR1pqUjJ3MFdsZDRabHBZV214aWJsSjJXREpPZG1KdVVteGtWMUoyV0RJeGRscFhVbWhKYW05cFRVTktPV0ZvWmxSSlZFeDNZMDFpZWxSaldFZEpNM3BrTWpSbGVVcHdXa1k1YmtscWIybFBWRWt3VG1wTmFVeERTbkJhUmpsM1dWZGtjR0p0UldsUGFVa3dUWHBCTUUxVVVXbE1RMHB3V2tZNWEySXlNWEJpYld4MlNXcHZhVTFVVVROT2FtTTFTV2wzYVdGWE5UQmFWMlI1V1ZkT2FHSXhPVzFaVjA1c1dXMDVkbUV4T1RCaU1uUnNZbWxKTm1KdVZuTmlRM2RwWVZjMU1GcFhaSGxaVjA1b1lqRTViVmxYVG14WmJUbDJZVEU1ZDJGWWFHeGlSamx2V1ZkS2NHSkhiREJaV0VscFQyMDFNV0pIZDNOSmJXeDFaRWRXYm1OdFJtcFpWemxtV20xR2FscFhTblppTW5SbVkwZHNORnBYZUdaYVdGcHNZbTVTZGxnelVteGpNMUpzU1dwd2RXUlhlSE5NUTBwd1ltNVNiRm96U21oWk1rWjJXREphYUZreVZtbGlNamx5V0ROQ2NHVkhWbk5KYW5CMVpGZDRjMHhEU25CaWJsSnNXak5LYUZreVJuWllNbHBvV1RKV2FXSXlPWEpZTTBKd1pVZFdjMWd5VmpKYVZ6VXdZakU1YUZreVZucGpNamhwVDJsS1VWbFhaR3hXYld4c1pIbEoiLCJjIjoiIn0= Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload great-server GreatApps great-service gpages-r3-pages-views access-control-allow-methods * cf-ray 8e23c3617dc8dc9d-FRA access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 0 date Thu, 14 Nov 2024 03:02:31 GMT content-type application/javascript vary Accept-Encoding server cloudflare access-control-allow-headers *
GET H2	200	css2 fonts.googleapis.com/	33 KB 3 KB	84ms 21ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f4a344e8c6cc79636b489a5de56854fdc018a3a731eb59f843afbb65ff0a6983 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers content-encoding gzip x-content-type-options nosniff expires Thu, 14 Nov 2024 03:02:31 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 14 Nov 2024 03:02:31 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Thu, 14 Nov 2024 03:02:31 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response static.cloudflareinsights.com/beacon.min.js/	20 KB 7 KB	40ms 19ms	Script text/javascript	2606:4700::6810:5049 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317 Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://mail.confirmationhelpmeta.io.vn Referer https://mail.confirmationhelpmeta.io.vn/ Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2023.10.0" cross-origin-resource-policy cross-origin cf-ray 8e23c36179c5db08-FRA access-control-allow-origin * date Thu, 14 Nov 2024 03:02:31 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 06 Jun 2024 15:52:56 GMT vary Accept-Encoding server cloudflare
GET H3	200	/ Show response r3-pages-views.greatpages.com.br/	0 185 B	21ms 21ms	Script application/javascript	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://r3-pages-views.greatpages.com.br/?g=eyJ2IjoxLCJhIjoicGFnZXZpZXciLCJzIjoiV1Zka2JHTjVOWGRqYlRoMVdXNUpkbHB0Um1wYVYwcDJZakp6ZEdNeVRtaGlaMGxxTTB4MlNrdEliRWhLUzFKMVR6bHRSSGRFYkZwaFNGSXdZMGhOTmt4NU9YcFpNa1oxVEZkYWVWbFhOV3BhVXpWMyIsImQiOiIyMDI0LTExLTE0IDA0OjAyOjMxIiwiZSI6IkdQYWdlcy4wNTQ4MTczMTU1MzM1MTk2NyIsImkiOiJjMGx0YkhWa1IxWnVZMjFHYWxsWE9XWmFiVVpxV2xkS2RtSXlkR1pqUjJ3MFdsZDRabHBZV214aWJsSjJXREpHYWxwWVRucGlNVGwzV2xoS2VtSXlOV2hpUjJ3MldWZFNka2xxY0hWa1YzaHpURU5LY0dKdVVteGFNMHBvV1RKR2RsZ3lXbWhaTWxacFlqSTVjbGd6UW5CbFIxWnpXREpXTWxwWE5UQmllVWsyU1d4Q2FGb3lWbGRoVjFZelNXbDNhV0ZYTlRCYVYyUjVXVmRPYUdJeE9XMVpWMDVzV1cwNWRtRXhPWGRoV0doc1lrWTViR1J0Vm5Wa1J6bG1ZMGRXZVdNeU9YVlpWM2h3WlcxR2EySjVTVFppYmxaellrTjNhV0ZYTlRCYVYyUjVXVmRPYUdJeE9XMVpWMDVzV1cwNWRtRXhPWGRoV0doc1lrWTViR1J0Vm5Wa1J6bG1XVEk1ZFdSSFZqRmFSemxtWkcxR2MySXpTV2xQYlRVeFlrZDNjMGx0YkhWa1IxWnVZMjFHYWxsWE9XWmFiVVpxV2xkS2RtSXlkR1pqUjJ3MFdsZDRabHBZV214aWJsSjJXREpPZG1KdVVteGtWMUoyV0RJeGRscFhVbWhKYW05cFRVTktPV0ZvWmxSSlZFeDNZMDFpZWxSaldFZEpNM3BrTWpSbGVVcHdXa1k1YmtscWIybFBWRWt3VG1wTmFVeERTbkJhUmpsM1dWZGtjR0p0UldsUGFVa3dUWHBCTUUxVVVXbE1RMHB3V2tZNWEySXlNWEJpYld4MlNXcHZhVTFVVVROT2FtTTFTV2wzYVdGWE5UQmFWMlI1V1ZkT2FHSXhPVzFaVjA1c1dXMDVkbUV4T1RCaU1uUnNZbWxKTm1KdVZuTmlRM2RwWVZjMU1GcFhaSGxaVjA1b1lqRTViVmxYVG14WmJUbDJZVEU1ZDJGWWFHeGlSamx2V1ZkS2NHSkhiREJaV0VscFQyMDFNV0pIZDNOSmJXeDFaRWRXYm1OdFJtcFpWemxtV20xR2FscFhTblppTW5SbVkwZHNORnBYZUdaYVdGcHNZbTVTZGxnelVteGpNMUpzU1dwd2RXUlhlSE5NUTBwd1ltNVNiRm96U21oWk1rWjJXREphYUZreVZtbGlNamx5V0ROQ2NHVkhWbk5KYW5CMVpGZDRjMHhEU25CaWJsSnNXak5LYUZreVJuWllNbHBvV1RKV2FXSXlPWEpZTTBKd1pVZFdjMWd5VmpKYVZ6VXdZakU1YUZreVZucGpNamhwVDJsS1VWbFhaR3hXYld4c1pIbEoiLCJjIjoiIn0= Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload great-server GreatApps great-service gpages-r3-pages-views access-control-allow-methods * cf-ray 8e23c361de4ddc9d-FRA access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 0 date Thu, 14 Nov 2024 03:02:31 GMT content-type application/javascript vary Accept-Encoding server cloudflare access-control-allow-headers *
GET H/1.1	200 OK	430414_1_170515677165a2a0a333eba103486202.svg cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/imagens/desktop/	2 KB 1 KB	24ms 23ms	Image image/svg+xml	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/imagens/desktop/430414_1_170515677165a2a0a333eba103486202.svg Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers Content-Encoding br CF-Cache-Status HIT ETag W/"ecd94021d2c853c3b8deb8203ba17300" Age 3013513 Expires Fri, 14 Nov 2025 03:02:31 GMT alt-svc h3=":443"; ma=86400 Date Thu, 14 Nov 2024 03:02:31 GMT Content-Type image/svg+xml Last-Modified Sat, 13 Jan 2024 14:48:23 GMT Vary Accept-Encoding Transfer-Encoding chunked Strict-Transport-Security max-age=31536000; includeSubDomains; preload Cache-Control public, max-age=31536000 Connection keep-alive CF-RAY 8e23c361d8c61cc3-FRA Server cloudflare
GET DATA	200 OK	truncated /	214 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba00f0bc83ac4d9a64a46b4dd7423a857f9cb13e681d3cff876ef326d4b5111d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	266 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba3b08e3f25ffa68840fbe7b311dad18727c97e84750025e723f99868ad9a2bf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v32/	18 KB 18 KB	159ms 8ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://mail.confirmationhelpmeta.io.vn Referer https://fonts.googleapis.com/ Response headers age 42149 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Thu, 13 Nov 2025 15:20:03 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 13 Nov 2024 15:20:03 GMT last-modified Thu, 01 Aug 2024 20:41:24 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 18536 x-xss-protection 0 server sffe
GET H3	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v40/	47 KB 47 KB	162ms 13ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://mail.confirmationhelpmeta.io.vn Referer https://fonts.googleapis.com/ Response headers age 41651 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Thu, 13 Nov 2025 15:28:21 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 13 Nov 2024 15:28:21 GMT last-modified Thu, 14 Dec 2023 02:08:40 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 48236 x-xss-protection 0 server sffe
GET H3	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v32/	18 KB 18 KB	155ms 7ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://mail.confirmationhelpmeta.io.vn Referer https://fonts.googleapis.com/ Response headers age 158612 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Wed, 12 Nov 2025 06:59:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 12 Nov 2024 06:59:00 GMT last-modified Thu, 01 Aug 2024 20:41:21 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 18596 x-xss-protection 0 server sffe
GET H3	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2 fonts.gstatic.com/s/opensans/v40/	46 KB 46 KB	160ms 11ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b0dab5300943d98f4f20de9d48a49e0186441f6fb8b5e95a9635a30c0b60e72 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://mail.confirmationhelpmeta.io.vn Referer https://fonts.googleapis.com/ Response headers age 52643 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Thu, 13 Nov 2025 12:25:09 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 13 Nov 2024 12:25:09 GMT last-modified Thu, 14 Dec 2023 02:04:09 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 47136 x-xss-protection 0 server sffe
GET H/1.1	200 OK	430414_1_170515677165a2a0a3363f7647845769.jpg cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/imagens/desktop/	21 KB 21 KB	31ms 30ms	Image image/jpeg	2606:4700::6812:9c1b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.greatpages.com.br/scan-france.pages.pro.br-facebook-scan/1705157302/imagens/desktop/430414_1_170515677165a2a0a3363f7647845769.jpg Requested by Host: mail.confirmationhelpmeta.io.vn URL: https://mail.confirmationhelpmeta.io.vn/test1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:9c1b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1b95e1c292b78d8043492112cb1974361f2faeba5b4d073489c9e9eac178ddd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers Cf-Bgj imgq:100,h2pri ETag "7c74e2dcef49cccb0bac7fe071f38166" Age 3013513 CF-Cache-Status HIT Expires Fri, 14 Nov 2025 03:02:32 GMT Cf-Polished status=not_needed alt-svc h3=":443"; ma=86400 Date Thu, 14 Nov 2024 03:02:32 GMT Content-Type image/jpeg Last-Modified Sat, 13 Jan 2024 14:48:23 GMT Vary Accept-Encoding Strict-Transport-Security max-age=31536000; includeSubDomains; preload Cache-Control public, max-age=31536000 Connection keep-alive CF-RAY 8e23c36288fe1cc3-FRA Accept-Ranges bytes Content-Length 21314 Server cloudflare
POST H2	404	rum Show response mail.confirmationhelpmeta.io.vn/cdn-cgi/	1 KB 1 KB	310ms 306ms	XHR text/html	103.18.7.220
General Check archive.org Show headers Download Go to Full URL https://mail.confirmationhelpmeta.io.vn/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.18.7.220 , Viet Nam, ASN (), Reverse DNS shost003.tenten.vn Software LiteSpeed / Resource Hash 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 content-type application/json Referer https://mail.confirmationhelpmeta.io.vn/test1.php Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 1238 pragma no-cache date Thu, 14 Nov 2024 03:02:32 GMT content-type text/html server LiteSpeed
GET H3	200	92463-6dbe34fd484da95ac56978e70c542594.png cdn.greatsoftwares.com.br/arquivos/paginas/	4 KB 5 KB	226ms 21ms	Other image/webp	2606:4700:4400::6812:26ca
General Check archive.org Show headers Download Go to Full URL https://cdn.greatsoftwares.com.br/arquivos/paginas/92463-6dbe34fd484da95ac56978e70c542594.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:4400::6812:26ca , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 7ef93be314d95d860acead11ee2a2945fcc2fb231104034b19f78d17be18a14f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.confirmationhelpmeta.io.vn/ Response headers x-goog-metageneration 1 access-control-expose-headers Content-Type x-goog-hash crc32c=Y04hBw==, md5=u1+uc8YAh7cyljFuUdK1bA== cf-bgj imgq:85,h2pri etag "bb5fae73c60087b73296316e51d2b56c" age 66768 cf-cache-status HIT x-content-type-options nosniff x-goog-stored-content-encoding identity expires Fri, 14 Nov 2025 03:02:32 GMT cf-polished origFmt=png, origSize=9208 alt-svc h3=":443"; ma=86400 x-goog-stored-content-length 9208 date Thu, 14 Nov 2024 03:02:32 GMT content-type image/webp content-disposition inline; filename="92463-6dbe34fd484da95ac56978e70c542594.webp" vary Accept last-modified Sat, 13 Jan 2024 14:43:04 GMT x-guploader-uploadid AHmUCY2I1mVyM3OTV0J-TyYNPcfbbphfwIwPoxFC_zuWYuifVj3BUxbp5kexjBR-6Yz7NYhmWa5ipHqH2A strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 x-goog-storage-class STANDARD cf-ray 8e23c364ae6dd3ac-FRA accept-ranges bytes access-control-allow-origin * x-goog-generation 1705156984925499 content-length 4304 server cloudflare

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getCrawler object| css object| scripts object| data object| g function| FormatarDigitosData string| eid object| elementos_css object| blocos_posicao object| elementos_posicao object| elementos_popup object| elementos_botoes_evento object| pagina_controle function| GreatResize function| GreatFontes object| gle_fontes object| gle_css object| gle_scripts function| GreatLoader function| InserirFontes function| CarregarFontes function| InserirCss function| InserirScripts object| elementos_formulario_redirecionamento function| ValidacaoFormularios function| ValidacaoPasso function| ValidacaoCampos function| ValidarTelefone function| ValidarCpf function| ValidarCnpj function| EnviarFormulario function| bindEvents function| Mobile object| GLoading object| GFM function| AbrirGM function| PosicionarGM function| FecharGM function| PulsarGM object| GModalApproval object| GTooltip object| gqa_fila number| gqa_executando function| ControlarFilaGQA function| AdicionarFilaGQA function| ExecutarFilaGQA function| EnviarAjaxGQA function| FormatarUriGQA object| go_elementos object| GObserver function| InserirScriptsInline object| scripts_estatisticas object| scripts_marketing function| $ function| cash number| tempo_tela_obrigado function| smoothScrollTo object| __cfBeacon

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://mail.confirmationhelpmeta.io.vn/test1.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://mail.confirmationhelpmeta.io.vn/cdn-cgi/rum? Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.greatpages.com.br
cdn.greatsoftwares.com.br
fonts.googleapis.com
fonts.gstatic.com
mail.confirmationhelpmeta.io.vn
r3-pages-views.greatpages.com.br
static.cloudflareinsights.com
103.18.7.220
2606:4700:4400::6812:26ca
2606:4700::6810:5049
2606:4700::6812:9c1b
2a00:1450:4001:802::200a
2a00:1450:4001:80b::2003
0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a
2756f49df3178ef871e65b44956598f975f93c8c37a1461376f8e7f53089c707
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
6b0dab5300943d98f4f20de9d48a49e0186441f6fb8b5e95a9635a30c0b60e72
7cd684139d86fdd64582a8d2e26e0738ebe2b1d9454e1db69d9a9fe3a7688d94
7ef93be314d95d860acead11ee2a2945fcc2fb231104034b19f78d17be18a14f
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
af71196dc68ca527a2437ac5371317f5776ac7623cb7dc3a7f83d126c1621f9c
ba00f0bc83ac4d9a64a46b4dd7423a857f9cb13e681d3cff876ef326d4b5111d
ba3b08e3f25ffa68840fbe7b311dad18727c97e84750025e723f99868ad9a2bf
d1b95e1c292b78d8043492112cb1974361f2faeba5b4d073489c9e9eac178ddd
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4a344e8c6cc79636b489a5de56854fdc018a3a731eb59f843afbb65ff0a6983