6ca.tw Open in urlscan Pro
2606:4700:3034::6815:2adb  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request g5cq Show response 6ca.tw/	64 B 938 B	153ms 117ms	Document text/html	2606:4700:3034::6815:2adb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6ca.tw/g5cq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:2adb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c98f05bb81a26618bc497d4fe5ba1c9fea9179df15aa226b18a1975e3a46e540 Security Headers Name Value Content-Security-Policy default-src *;img-src * 'self' data: https:; script-src '*' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' * X-Frame-Options SAMEORIGIN Request headers :method GET :authority 6ca.tw :scheme https :path /g5cq pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 04:30:44 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=de989f063e4191b573cfe4259f79451891619325044; expires=Tue, 25-May-21 04:30:44 GMT; path=/; domain=.6ca.tw; HttpOnly; SameSite=Lax; Secure x-frame-options SAMEORIGIN access-control-allow-origin https://script-esm.xyz vary Origin access-control-allow-credentials true content-security-policy default-src *;img-src * 'self' data: https:; script-src '*' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' * cache-control public, max-age=0 last-modified Sat, 24 Apr 2021 19:02:46 GMT cf-cache-status DYNAMIC cf-request-id 09a8e45f9a00004e985f08d000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HB7I%2Fqf%2BYeyR66JlEncq%2F7iOSlY4guHJS1GDvvAF4JXHi1JsRibJ3xTRKWCLm%2FbaOM%2BcekTJ2oWHvCwhMSOXZlEsopWCiJuyfMUePNns3werVrU%3D"}],"max_age":604800,"group":"cf-nel"} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 6454d678fe1d4e98-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	/ Show response 1sk.re/	33 KB 16 KB	353ms 320ms	Script text/javascript	2606:4700:3033::6815:27a0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://1sk.re/ Requested by Host: 6ca.tw URL: https://6ca.tw/g5cq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:27a0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a35c1fdcb0917d72b56462fab29666e197892453a397169b7acd332e96950e6 Request headers Referer https://6ca.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers cf-request-id 09a8e4603e00004e67c384e000000001 content-encoding br cf-cache-status DYNAMIC nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare date Sun, 25 Apr 2021 04:30:45 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6cna0LZC7wxGTePoCfZeqS2VeXjEV30VbuVh1oJ61vS53vy3tRZlPmw3G%2BYtZyJszr1tJZUYRSGRY6%2Fg6NzVzvB57msNu54%3D"}]} content-type text/javascript;charset=UTF-8 cf-ray 6454d679ffc94e67-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET DATA	200 OK	truncated /	512 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	160 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	/ whos.amung.us/pingjs/	27 B 27 B	443ms 147ms	Image text/javascript	67.202.114.212 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=2378x351&t=https://anti-brecheros.com/&x=Tu%20que%20ves Requested by Host: 6ca.tw URL: https://6ca.tw/g5cq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.212 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://6ca.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 25 Apr 2021 04:30:45 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	875 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _0x5092 function| _0x309a function| _0xcd4b function| _0x37cf3a function| _0xb4ccd1 function| _slicedToArray function| _nonIterableRest function| _unsupportedIterableToArray function| _arrayLikeToArray function| _iterableToArrayLimit function| _arrayWithHoles function| init function| _0x1a88e8

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.6ca.tw/	1970-01-19 18:31:57	Name: __cfduid Value: de989f063e4191b573cfe4259f79451891619325044

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src *;img-src * 'self' data: https:; script-src '*' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' *
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1sk.re
6ca.tw
whos.amung.us
2606:4700:3033::6815:27a0
2606:4700:3034::6815:2adb
67.202.114.212
6a35c1fdcb0917d72b56462fab29666e197892453a397169b7acd332e96950e6
6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625
c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5
c98f05bb81a26618bc497d4fe5ba1c9fea9179df15aa226b18a1975e3a46e540
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85