urlscan.io logo urlscan.io
SecurityTrails logo

preview.projects.webpages.one Open in urlscan Pro
143.198.248.15  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://video2.ibsqn.com/kl13t9gr
Effective URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wF...
Submission: On April 18 via automatic, source openphish — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 9 HTTP transactions. The main IP is 143.198.248.15, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is preview.projects.webpages.one.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 15th 2022. Valid for: a year.
This is the only time preview.projects.webpages.one was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 2 2a0d:2787:1b:... 62068 (SPECTRAIP...)
1 143.198.248.15 14061 (DIGITALOC...)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 2a02:4780:b:6... 47583 (AS-HOSTINGER)
1 178.128.136.210 14061 (DIGITALOC...)
2 2600:9000:25a... 16509 (AMAZON-02)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
9 8
2    2a0d:2787:1b:b8::a (Amsterdam, Netherlands)

ASN62068 (SPECTRAIP SpectraIP B.V., NL)
video2.ibsqn.com
1    143.198.248.15 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
preview.projects.webpages.one
1    2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    2a02:4780:b:630:0:9ee:e952:4 (Phoenix, United States)

ASN47583 (AS-HOSTINGER, CY)
temu785.com
1    178.128.136.210 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
app.fastpages.io
2    2600:9000:25a2:9200:9:685b:3d00:21 (United States)

ASN16509 (AMAZON-02, US)
d1zviajkun9gxg.cloudfront.net
1    2606:4700:20::681a:64 (United States)

ASN13335 (CLOUDFLARENET, US)
get.geojs.io
1    2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)
whos.amung.us
Apex Domain
Subdomains		 Transfer
3 temu785.com
temu785.com
508 KB
2 cloudfront.net
d1zviajkun9gxg.cloudfront.net
46 KB
2 ibsqn.com
video2.ibsqn.com
1 KB
1 amung.us
whos.amung.us — Cisco Umbrella Rank: 14941
28 B
1 geojs.io
get.geojs.io — Cisco Umbrella Rank: 15161
869 B
1 fastpages.io
app.fastpages.io
82 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39
6 KB
1 webpages.one
preview.projects.webpages.one
42 KB
9 8
Domain Requested by
3 temu785.com 1 redirects preview.projects.webpages.one
2 d1zviajkun9gxg.cloudfront.net preview.projects.webpages.one
2 video2.ibsqn.com 2 redirects
1 whos.amung.us
1 get.geojs.io preview.projects.webpages.one
1 app.fastpages.io preview.projects.webpages.one
1 fonts.googleapis.com client
1 preview.projects.webpages.one
9 8

This site contains no links.

Subject Issuer Validity Valid
*.projects.webpages.one
Sectigo RSA Domain Validation Secure Server CA		 2022-08-15 -
2023-09-15		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-28 -
2023-06-20		 3 months crt.sh
temu785.com
R3		 2023-04-01 -
2023-06-30		 3 months crt.sh
app.fastpages.io
Sectigo RSA Domain Validation Secure Server CA		 2022-10-17 -
2023-10-26		 a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2022-12-08 -
2023-12-07		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-11 -
2024-04-10		 a year crt.sh
*.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2022-05-18 -
2023-06-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Frame ID: 76968A0998695147BE9D4DDD1E9588C0
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log into Facebook | Facebook

Page URL History Show full URLs

  1. http://video2.ibsqn.com/kl13t9gr HTTP 301
    https://video2.ibsqn.com/kl13t9gr HTTP 302
    https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y... Page URL

Page Statistics

9
Requests

89 %
HTTPS

75 %
IPv6

8
Domains

8
Subdomains

8
IPs

3
Countries

602 kB
Transfer

1378 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://video2.ibsqn.com/kl13t9gr HTTP 301
    https://video2.ibsqn.com/kl13t9gr HTTP 302
    https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://temu785.com/google/location HTTP 301
  • https://temu785.com/google/location/

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
preview.projects.webpages.one/
Redirect Chain
  • http://video2.ibsqn.com/kl13t9gr
  • https://video2.ibsqn.com/kl13t9gr
  • https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943...
347 KB
42 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.198.248.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty/1.19.3.1 / Express
Resource Hash
29b4500527c4fe640ae0cdde1041779642e13d7c0f218f89916ef138fbbc1099

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Cache-Hit
skipped
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 18 Apr 2023 01:18:08 GMT
Server
openresty/1.19.3.1
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Powered-By
Express
X-Response-Time
34.349ms

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 18 Apr 2023 01:18:08 GMT
Expires
0
Location
https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Pragma
no-cache
Server
nginx
Vary
Accept-Encoding
css2
fonts.googleapis.com/ 		128 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Source+Sans+Pro:ital,wght@0,400;0,700;1,400;1,700&family=Alegreya+Sans:ital,wght@0,400;0,700;1,400;1,700&family=Fira+Sans:ital,wght@0,400;0,700;1,400;1,700&family=Work+Sans:ital,wght@0,400;0,700;1,400;1,700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&family=Lato:ital,wght@0,400;0,700;1,400;1,700&family=Raleway:ital,wght@0,400;0,700;1,400;1,700&family=Roboto:ital,wght@0,400;0,700;1,400;1,700&family=Montserrat:ital,wght@0,400;0,700;1,400;1,700&family=Poppins:ital,wght@0,400;0,700;1,400;1,700&family=Dosis:ital,wght@0,400;0,700;1,400;1,700&family=Exo:ital,wght@0,400;0,700;1,400;1,700&family=Quicksand:ital,wght@0,400;0,700;1,400;1,700&family=Hind:ital,wght@0,400;0,700;1,400;1,700&family=Rubik:ital,wght@0,400;0,700;1,400;1,700&family=Kanit:ital,wght@0,400;0,700;1,400;1,700&family=Rokkitt:ital,wght@0,400;0,700;1,400;1,700&family=Yantramanav:ital,wght@0,400;0,700;1,400;1,700&family=Cormorant:ital,wght@0,400;0,700;1,400;1,700&family=Spectral:ital,wght@0,400;0,700;1,400;1,700&family=Mada:ital,wght@0,400;0,700;1,400;1,700&family=Prompt:ital,wght@0,400;0,700;1,400;1,700&family=Khand:ital,wght@0,400;0,700;1,400;1,700&family=Saira:ital,wght@0,400;0,700;1,400;1,700&family=Yrsa:ital,wght@0,400;0,700;1,400;1,700&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
433877840e9e013b4047fc83170ac3b32eb684aa864792b62f69d107891f9884
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 18 Apr 2023 01:18:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 18 Apr 2023 00:55:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 18 Apr 2023 01:18:08 GMT
/
temu785.com/google/ 		718 KB
507 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://temu785.com/google/?api=1&lan=facebooknew&ht=1
Requested by
Host: preview.projects.webpages.one
URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:4780:b:630:0:9ee:e952:4 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.3.33
Resource Hash
f6bdb2c145127f05034a4c174559ccd8a1d52af4cf4ba54b66f56d2c1fc89710
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 18 Apr 2023 01:18:09 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
server
LiteSpeed
x-powered-by
PHP/7.3.33
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-store, no-cache, must-revalidate
platform
hostinger
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
expires
Thu, 19 Nov 1981 08:52:00 GMT
fire
app.fastpages.io/api/project/public/ 		82 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.fastpages.io/api/project/public/fire?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&evId=94a5c46e-b64b-4cd9-92e4-65588399b4bd
Requested by
Host: preview.projects.webpages.one
URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.128.136.210 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
openresty/1.19.9.1 / PHP/7.4.27
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date
Tue, 18 Apr 2023 01:18:09 GMT
Server
openresty/1.19.9.1
X-Powered-By
PHP/7.4.27
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-Control
no-cache, private
Connection
keep-alive
x-request-id
0de24176-b170-4155-93a4-80944fdd4bf0
lazysizes.min.js
d1zviajkun9gxg.cloudfront.net/content/vendor/lazysizes/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d1zviajkun9gxg.cloudfront.net/content/vendor/lazysizes/lazysizes.min.js
Requested by
Host: preview.projects.webpages.one
URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:25a2:9200:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06821251a29e71f8fd4f60349667c54d163b16d7bc8b1d47144c7f5042683eef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Wed, 15 Mar 2023 08:53:27 GMT
x-amz-version-id
wOfhWuKhZUWg6cTPVmggDIMOoc9zOXto
content-encoding
gzip
last-modified
Thu, 11 Jul 2019 07:35:54 GMT
server
AmazonS3
via
1.1 20e88007b6f5218ef5942bc3581c73b8.cloudfront.net (CloudFront)
x-amz-cf-pop
ZRH55-P1
etag
W/"149ff45fc6c2f13e892e438a58abb77f"
age
2910282
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript
x-amz-cf-id
JLHpFYKl08zQXdwPgyAMRsJlqcwDJCOdTzbPTN7SUhT3iFeU7zD1Wg==
bundle.client.js
d1zviajkun9gxg.cloudfront.net/project/v0.20.1/ 		124 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d1zviajkun9gxg.cloudfront.net/project/v0.20.1/bundle.client.js
Requested by
Host: preview.projects.webpages.one
URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:25a2:9200:9:685b:3d00:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44f2f8af948a9c593913eafbe208cdcadb0466c8fdec26ddb373706538897580

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Wed, 05 Apr 2023 08:02:53 GMT
x-amz-version-id
null
content-encoding
gzip
last-modified
Wed, 05 Apr 2023 08:00:03 GMT
server
AmazonS3
via
1.1 20e88007b6f5218ef5942bc3581c73b8.cloudfront.net (CloudFront)
x-amz-cf-pop
ZRH55-P1
etag
W/"dd241ee804c023590b6dd0a4f0697111"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript
age
1098916
x-amz-cf-id
rWBnPMVv4jngcsX7YZGV-CtHZKfUgPXvdKfEQ_krgruth2X1OyFqPg==
/
temu785.com/google/location/
Redirect Chain
  • https://temu785.com/google/location
  • https://temu785.com/google/location/
1 KB
600 B 		Script
General
Check archive.org
Download Go to
Full URL
https://temu785.com/google/location/
Protocol
H2
Server
2a02:4780:b:630:0:9ee:e952:4 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.3.33
Resource Hash
6ebfae6466d3964cd2ea9b003614f774305042f8dd81de7c8f3d0aa5cbab0798
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 01:18:10 GMT
content-encoding
br
content-security-policy
upgrade-insecure-requests
server
LiteSpeed
x-powered-by
PHP/7.3.33
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
platform
hostinger
content-length
517
expires
Tue, 25 Apr 2023 01:18:10 GMT

Redirect headers

location
https://temu785.com/google/location/
date
Tue, 18 Apr 2023 01:18:10 GMT
content-security-policy
upgrade-insecure-requests
server
LiteSpeed
platform
hostinger
content-length
707
content-type
text/html
geo.json
get.geojs.io/v1/ip/ 		345 B
869 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://get.geojs.io/v1/ip/geo.json
Requested by
Host: preview.projects.webpages.one
URL: https://preview.projects.webpages.one/?uuid=6ce1c39e-6a39-48f5-8702-9743055c5a95&ap_token=xIUnCKtMMdBqXrzyrph5YW7y8BnnzQSZlG3fHDnKU2wFtWhyJC4fyyszOjfPDz0rJj2jNVsr4jMfV7l1UPKMD3knmsBrmhtmlte0vtqh943P0ukG6xNt9u4W8AVAcoUW&fbclid=HNoG2S
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:64 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ee098f3123f8da1025b1c71b472e38144e5704019c91d7b6e0a85c626599f3f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 01:18:10 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id
69c4242e67f8aa02c72540f7cdbef2da-AMS
x-geojs-location
AMS
pragma
no-cache
server
cloudflare
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2Fu5rXn7%2FJLMKQFGR1e1VmsF3Yfq2aMrIVnXSFXU2lOCurhAdMV9d17p%2BzKTEHTWo6Mgsg%2FPHgDJk%2F9kxffAzYlxdzMfwnfrdQlRvBBZUP47D0cZqc5lnsWolCj6dqlEU8mUOyAf0mOS2A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate, private, max-age=0
cf-ray
7b991280bd6bb8ea-AMS
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Content-Type
image/png
/
whos.amung.us/pingjs/ 		28 B
28 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://whos.amung.us/pingjs/?k=polo5151&t=san2val&x=https://www.google.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://preview.projects.webpages.one/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 01:18:10 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7b991280c90bb7ac-AMS
content-type
text/javascript;charset=UTF-8
truncated
/ 		51 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| process object| __CONTACT_ID__ string| __AGENCY_DOMAIN__ string| __PROJECT_UUID__ boolean| __INSTALLED_FB__ boolean| __INSTALLED_TT__ string| __EVENT_ID__ boolean| __BUTTON_ENABLED__ string| __PROJECT_TYPE__ object| __INITIAL_STATE__ object| lazySizes object| webpackChunkadpage_project function| sendRequestHeightMessage function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt object| to_object string| a function| checking function| creatingInput function| searchingForms

3 Cookies

Domain/Path Name / Value
video2.ibsqn.com/ Name: _subid
Value: tscjt3lnp
video2.ibsqn.com/ Name: c4f69
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE0MzM1XCI6MTY4MTc4MDY4OH0sXCJjYW1wYWlnbnNcIjp7XCI3MTY0XCI6MTY4MTc4MDY4OH0sXCJ0aW1lXCI6MTY4MTc4MDY4OH0ifQ.yLyPo50fUg0sC85zfmw5wujR5hM_JjO1aH2P16vHkbQ
preview.projects.webpages.one/ Name: campaign-track
Value: test-cookie