app.funnel-preview.com
Open in
urlscan Pro
104.16.16.194
Malicious Activity!
Public Scan
Effective URL: https://app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com/optin1631810711017?updated_at=1cfbed014c837f6787
Submission: On September 21 via manual — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 23rd 2021. Valid for: a year.
This is the only time app.funnel-preview.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.21.87.25 104.21.87.25 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.16.16.194 104.16.16.194 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 7 | 104.16.13.194 104.16.13.194 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.21.78.7 104.21.78.7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.186.138 142.250.186.138 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 172.67.218.254 172.67.218.254 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.16.94.65 104.16.94.65 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.16.14.194 104.16.14.194 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 54.155.182.199 54.155.182.199 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY) | |
1 | 67.202.94.86 67.202.94.86 | 32748 (STEADFAST) (STEADFAST) | |
2 | 31.13.92.14 31.13.92.14 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 151.101.66.137 151.101.66.137 | 54113 (FASTLY) (FASTLY) | |
1 | 162.247.243.147 162.247.243.147 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
24 | 14 |
ASN13335 (CLOUDFLARENET, US)
www.clickfunnels.com | |
images.clickfunnels.com | |
app.clickfunnels.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net
fonts.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-155-182-199.eu-west-1.compute.amazonaws.com
track.addevent.com |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-frt3.fbcdn.net
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
clickfunnels.com
1 redirects
www.clickfunnels.com images.clickfunnels.com app.clickfunnels.com |
744 KB |
2 |
fbcdn.net
static.xx.fbcdn.net |
3 KB |
2 |
2bpr.xyz
1 redirects
2bpr.xyz |
10 KB |
2 |
fontawesome.com
use.fontawesome.com |
17 KB |
2 |
funnel-preview.com
app.funnel-preview.com |
14 KB |
1 |
nr-data.net
bam-cell.nr-data.net |
925 B |
1 |
newrelic.com
js-agent.newrelic.com |
12 KB |
1 |
amung.us
whos.amung.us |
26 B |
1 |
imgur.com
i.imgur.com |
9 KB |
1 |
addevent.com
track.addevent.com |
|
1 |
cloudflareinsights.com
static.cloudflareinsights.com |
5 KB |
1 |
googleapis.com
fonts.googleapis.com |
3 KB |
1 |
5fiuq.us
1 redirects
5fiuq.us |
728 B |
24 | 13 |
Domain | Requested by | |
---|---|---|
6 | app.clickfunnels.com |
1 redirects
app.funnel-preview.com
www.clickfunnels.com app.clickfunnels.com |
4 | www.clickfunnels.com |
app.funnel-preview.com
|
2 | static.xx.fbcdn.net |
app.funnel-preview.com
|
2 | 2bpr.xyz |
1 redirects
app.funnel-preview.com
|
2 | use.fontawesome.com |
app.funnel-preview.com
|
2 | app.funnel-preview.com |
static.cloudflareinsights.com
|
1 | bam-cell.nr-data.net |
js-agent.newrelic.com
|
1 | js-agent.newrelic.com |
app.funnel-preview.com
|
1 | whos.amung.us |
app.funnel-preview.com
|
1 | i.imgur.com |
app.funnel-preview.com
|
1 | track.addevent.com |
app.funnel-preview.com
|
1 | static.cloudflareinsights.com |
app.funnel-preview.com
|
1 | images.clickfunnels.com |
app.funnel-preview.com
|
1 | fonts.googleapis.com |
app.funnel-preview.com
|
1 | 5fiuq.us | 1 redirects |
24 | 15 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
app.funnel-preview.com Cloudflare Inc ECC CA-3 |
2021-08-23 - 2022-08-22 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-08-23 - 2022-08-22 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
addevent.com Amazon |
2021-02-25 - 2022-03-26 |
a year | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-09-09 - 2021-12-08 |
3 months | crt.sh |
*.newrelic.com R3 |
2021-09-17 - 2021-12-16 |
3 months | crt.sh |
*.nr-data.net DigiCert SHA2 Secure Server CA |
2020-02-05 - 2022-02-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com/optin1631810711017?updated_at=1cfbed014c837f6787
Frame ID: 5EB58FFF4C0FA5FEE9C4B94D5A79583C
Requests: 25 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://5fiuq.us/YrKt6o
HTTP 302
https://app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com/optin1631810711017?updated_at=1cfbe... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://5fiuq.us/YrKt6o
HTTP 302
https://app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com/optin1631810711017?updated_at=1cfbed014c837f6787 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://2bpr.xyz/async?&user=nygmael&html=mobile HTTP 301
- https://2bpr.xyz/async/?&user=nygmael&html=mobile
- https://app.clickfunnels.com/cf.js HTTP 301
- https://www.clickfunnels.com/cf.js
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
optin1631810711017
app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com/ Redirect Chain
|
44 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lander.css
www.clickfunnels.com/assets/ |
425 KB 70 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.9.0/css/ |
55 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v4-shims.css
use.fontawesome.com/releases/v5.9.0/css/ |
26 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
44 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application.js
www.clickfunnels.com/assets/userevents/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
2bpr.xyz/async/ Redirect Chain
|
43 KB 9 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lander.js
www.clickfunnels.com/assets/ |
2 MB 659 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ClickfunnelsTag.png
images.clickfunnels.com/3d/392630953c4119a324492bb1c05778/ |
5 KB 6 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pushcrew.js
app.clickfunnels.com/assets/ |
637 B 460 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.min.js
static.cloudflareinsights.com/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.js
www.clickfunnels.com/ Redirect Chain
|
18 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
app.clickfunnels.com/userevents/ |
0 311 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
app.clickfunnels.com/userevents/ |
0 810 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
app.clickfunnels.com/userevents/ |
0 308 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
track.addevent.com/atc/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wCOStwT.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
26 B 26 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lqbz1hqlAFx.png
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1210.min.js
js-agent.newrelic.com/ |
31 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
track
app.clickfunnels.com/v1/ |
120 B 475 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
app.funnel-preview.com/cdn-cgi/ |
0 204 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NRJS-fc902efb332119fff33
bam-cell.nr-data.net/1/ |
49 B 925 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
19 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com | Name: updated_at Value: 1cfbed014c837f6787 |
|
app.funnel-preview.com/for_domain/nolazco14452.clickfunnels.com | Name: addevent_track_cookie Value: f9fb036d-dc4d-40f1-9148-50bedb2d386f |
|
.app.funnel-preview.com/ | Name: __cf_bm Value: WVTlQGO35fMhE5vfkVNtkVgYdOsrNL5UTDYTgy5yB7E-1632265610-0-AahQgomvRU32UeAa7wECH1ZtnMpGFF3CuP/NYDPgW67x57x1c3JNWZFwqrlMmgQrYZzVchHtQO6W/yfoT+yK/95uDcgXQkfWyyOsFRo1OPZ/ |
|
.clickfunnels.com/ | Name: __cf_bm Value: Us3E3TDSxdbd5tw2a2VPn7KmKmWL45bBTWFNcdrHqAA-1632265610-0-AagyAZm0bO+1TM5drYALyu94QoP1V8ENdEPv9x2DTmd6NSo6NP8ERHR9g9XX3SkZ6hHS1lgKibksOFW4zKHm5KmDATPIDGdf1RCg1PCrAI3Q |
|
app.funnel-preview.com/ | Name: cf:aff_sub2 Value: |
|
app.funnel-preview.com/ | Name: cf:aff_sub3 Value: |
|
app.funnel-preview.com/ | Name: cf:aff_sub Value: |
|
app.funnel-preview.com/ | Name: cf:affiliate_id Value: |
|
app.funnel-preview.com/ | Name: cf:cf_affiliate_id Value: |
|
app.funnel-preview.com/ | Name: cf:content Value: |
|
app.funnel-preview.com/ | Name: cf:medium Value: |
|
app.funnel-preview.com/ | Name: cf:name Value: |
|
app.funnel-preview.com/ | Name: cf:source Value: |
|
app.funnel-preview.com/ | Name: cf:term Value: |
|
app.funnel-preview.com/ | Name: cf:NTA3NTkxNDE Value: :visited=true |
|
app.funnel-preview.com/ | Name: cf:visitor_id Value: 3d3ff9be-3d12-437e-a028-d6eba6f24994 |
|
app.funnel-preview.com/ | Name: is_eu Value: true |
|
app.funnel-preview.com/ | Name: yqpp2drrfy5ji736 Value: true |
|
app.funnel-preview.com/ | Name: 11425931_viewed_166 Value: 1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Frame-Options | ALLOWALL |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2bpr.xyz
5fiuq.us
app.clickfunnels.com
app.funnel-preview.com
bam-cell.nr-data.net
fonts.googleapis.com
i.imgur.com
images.clickfunnels.com
js-agent.newrelic.com
static.cloudflareinsights.com
static.xx.fbcdn.net
track.addevent.com
use.fontawesome.com
whos.amung.us
www.clickfunnels.com
104.16.13.194
104.16.14.194
104.16.16.194
104.16.94.65
104.21.78.7
104.21.87.25
142.250.186.138
151.101.12.193
151.101.66.137
162.247.243.147
172.67.218.254
31.13.92.14
54.155.182.199
67.202.94.86
004e3565fa58bd4ff0cbf31deb5451508a5ec7d46c4480f9bfa23326f187a158
0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784
0d1c5ba4b29db42dadf61f9e7304331fa835fe732bbb02822ada17a9a63c215f
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
4a0362a7d773b13d0193337d2fd320c8fdb8b902f843ea031caa48ecf175a2e6
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
5b8810ee64bade6fc49a6c0948f933337663c3df9526ed7e21694b728a15818e
5dfa88a4dc8b6c0b834a62e45daee28a8dc37ed6ae7eb1545e4ed8b6382c0474
7422e50efbaea439fda7ef3b0eb54ee1a9fe73ea2f919d78a33bf6fb9e3e059d
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
9c66e4598b710bdbc3c1b878ea451756d414dcc4d99e3066a4cd311897b95780
c4efeeb957e361500bf19ba26282beae1a8e4083c5ccff10dccab2eaa09acd45
caec52356d28a445e7ad10d92d410b52fa537697b3b453ef1c01c65ec01ff86d
d36f175e6975e588e830e3f097b2cc57517c6f19c68d56e4c1b65a192ca9d16c
d71338cfee3e007469ad029703fe2f7730ddb8cb7655c44f98f7b3a163b70a39
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5bbf72f9e7ad89d7de59776fcfc7c5e3dabb74face618afe17ca0dae4a72b72
f7464960133d530dfa52ce0ab9a5c33f0a709a946ad16298b000a7560738f422