photo.s1f04.com Open in urlscan Pro
2a06:98c1:3121::3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Y7Vqhy7j Show response photo.s1f04.com/	1 KB 2 KB	249ms 176ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://photo.s1f04.com/Y7Vqhy7j Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eac84321df79cb18bcaffa2c02c72f2ef6298f0e26e311d5a8209e0ec9daea07 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 7289b42daaa5b7ef-AMS content-encoding br content-type text/html; charset=UTF-8 date Sun, 10 Jul 2022 13:39:09 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" expires 0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KckKKNe94ID4XD52Qo62rZY%2BGZ%2BEgn1OO%2FF%2B0N%2BTY%2BRF2ix%2BMKikdCIegtWAR%2Bf4rzL0NGaqcIt%2B%2F50jbTyUaGdC7b2TRXkVIqRLI8oxqQLa%2Bq%2BvXfNqlbxUpMGqcsYCA9wq3wWJIGFD9ILzQ0Y%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	/ Show response san2val.r0xdz.com/	41 KB 8 KB	422ms 105ms	Script application/javascript	159.223.103.134 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://san2val.r0xdz.com/?api=1&lan=mobil2&ht=2 Requested by Host: photo.s1f04.com URL: https://photo.s1f04.com/Y7Vqhy7j Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.223.103.134 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx / PHP/7.4.30, PleskLin Resource Hash 8f249ccf2bcc50320f314472f63994e6a77b8dd8c92973cf7c845f945c3eae67 Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers pragma no-cache date Sun, 10 Jul 2022 13:39:09 GMT content-encoding br server nginx x-powered-by PHP/7.4.30, PleskLin content-type application/javascript cache-control no-store, no-cache, must-revalidate expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	wCOStwT.png i.imgur.com/	9 KB 9 KB	113ms 39ms	Image image/png	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/wCOStwT.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 10 Jul 2022 13:39:09 GMT x-content-type-options nosniff age 1667144 x-cache HIT, HIT content-length 9180 x-served-by cache-iad-kjyo7100051-IAD, cache-hhn4038-HHN last-modified Mon, 08 Mar 2021 04:50:40 GMT server cat factory 1.0 x-timer S1657460350.762019,VS0,VE0 etag "168c57cb0a4861565d8db5b896f40218" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 32, 3821
GET H2	200	dF5SId3UHWd.svg static.xx.fbcdn.net/rsrc.php/y8/r/	2 KB 1 KB	112ms 36ms	Image image/svg+xml	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 10 Jul 2022 13:39:09 GMT content-encoding br x-content-type-options nosniff content-md5 NiMA5zHIsmaYxSYEaw9fHg== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 1027 x-fb-rlafr 0 x-fb-debug TgGTDwYtakOxaQJGNUgIsqITse++fFL7DybiTemZnLoGQZOkLXOhSjuZfUd0mc6hkFiYxAuqj6eZM0CrNiDKRw== x-fb-trip-id 2050670934 last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Sun, 02 Jul 2023 22:11:43 GMT
GET H2	200	/ whos.amung.us/pingjs/	28 B 28 B	363ms 119ms	Image text/javascript	67.202.114.212 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=polo5151&t=san2val&x=https://www.google.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.212 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 10 Jul 2022 13:39:09 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	5NR43BsYs8o.png static.xx.fbcdn.net/rsrc.php/v3/yO/r/	1 KB 1 KB	110ms 35ms	Image image/png	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/5NR43BsYs8o.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 10 Jul 2022 13:39:09 GMT x-content-type-options nosniff content-md5 zS7nNbuF+qoavNDFbgWDdA== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 1307 x-fb-rlafr 0 x-fb-debug 0FYAfiYYocJwtGHTRrCJpAvwMPnnpxJdqHOYBZgt+TRGRkDrV3hctypyzfa9qs03YbllMt7fEZ5NYq3zu6FDkw== x-fb-trip-id 2050670934 last-modified Mon, 01 Jan 2001 08:00:00 GMT content-type image/png access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Mon, 03 Jul 2023 00:06:10 GMT
GET H2	200	lqbz1hqlAFx.png static.xx.fbcdn.net/rsrc.php/v3/yo/r/	1 KB 2 KB	110ms 35ms	Image image/png	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/lqbz1hqlAFx.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://photo.s1f04.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Sun, 10 Jul 2022 13:39:09 GMT x-content-type-options nosniff content-md5 8kNJ+LeRDyhmr8oF+ZZjoQ== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 1364 x-fb-rlafr 0 x-fb-debug s8aueICmTcg9R2IfuKJperC/JYXvAKyW3arciquN+HTcACUyvdjMRNuAaoJ+EVDdhKwYyz+KmsB1WRgguDXsuQ== x-fb-trip-id 2050670934 last-modified Mon, 01 Jan 2001 08:00:00 GMT content-type image/png access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * priority u=3,i expires Sat, 01 Jul 2023 07:51:02 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			photo.s1f04.com/	1970-01-20 05:08:58	Name: _subid Value: 103g8p433ka
			photo.s1f04.com/	1970-02-08 08:50:07	Name: ee3b1 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMyOTBcIjoxNjU3NDYwMzQ5fSxcImNhbXBhaWduc1wiOntcIjE2NDRcIjoxNjU3NDYwMzQ5fSxcInRpbWVcIjoxNjU3NDYwMzQ5fSJ9.Uyc_Dd6H6fk2uTJUomrQHGj0tx435e5LLOKgzlkaHSA

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
photo.s1f04.com
san2val.r0xdz.com
static.xx.fbcdn.net
whos.amung.us
151.101.112.193
159.223.103.134
2a03:2880:f01c:216:face:b00c:0:3
2a06:98c1:3121::3
67.202.114.212
0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
8f249ccf2bcc50320f314472f63994e6a77b8dd8c92973cf7c845f945c3eae67
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eac84321df79cb18bcaffa2c02c72f2ef6298f0e26e311d5a8209e0ec9daea07