fb12215124121a.com Open in urlscan Pro
2a02:4780:3:694:0:255d:b6ab:1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response fb12215124121a.com/	56 KB 11 KB	525ms 166ms	Document text/html	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://fb12215124121a.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 1e2fddfccf78b6624b6432db937736988a954cc31c4d5c18ec98130daacb1346 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html last-modified Thu, 04 Nov 2021 12:05:39 GMT etag "de8e-6183cc93-d39f2e1dd1e5f540;br" accept-ranges bytes content-encoding br vary Accept-Encoding content-length 10848 date Mon, 08 Nov 2021 03:12:02 GMT server LiteSpeed content-security-policy upgrade-insecure-requests alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	404	request fb12215124121a.com/Confirmed_files/	0 0	167ms 166ms	Script text/html	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://fb12215124121a.com/Confirmed_files/request Requested by Host: fb12215124121a.com URL: https://fb12215124121a.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://fb12215124121a.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 03:12:03 GMT content-encoding br last-modified Fri, 29 Oct 2021 20:03:57 GMT server LiteSpeed etag "999-617c53ad-f4f93dec8660e9ed;br" vary Accept-Encoding content-type text/html accept-ranges bytes content-length 914
GET H2	200	F8n3WrEc0rCC.png fb12215124121a.com/Confirmed_files/	79 KB 79 KB	167ms 167ms	Image image/png	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://fb12215124121a.com/Confirmed_files/F8n3WrEc0rCC.png Requested by Host: fb12215124121a.com URL: https://fb12215124121a.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 1471cc727502133d1eec36368a868ddd84019312c8586cc9d01b7a8ac23e39f0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Accept-Language de-DE,de;q=0.9 Referer https://fb12215124121a.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 03:12:03 GMT last-modified Thu, 04 Nov 2021 12:05:49 GMT server LiteSpeed etag "13ad3-6183cc9d-b1b32eab4eafd01c;;;" content-type image/png cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes content-length 80595 expires Mon, 15 Nov 2021 03:12:03 GMT
GET H2	200	PASDAKSDSD.jpg fb12215124121a.com/Confirmed_files/	5 KB 5 KB	493ms 492ms	Image image/jpeg	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://fb12215124121a.com/Confirmed_files/PASDAKSDSD.jpg Requested by Host: fb12215124121a.com URL: https://fb12215124121a.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash c59bef54056ca9907b7753f6cee6e0c57d736c1ef5619912721313054123fce2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Accept-Language de-DE,de;q=0.9 Referer https://fb12215124121a.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 03:12:03 GMT last-modified Thu, 04 Nov 2021 12:05:51 GMT server LiteSpeed etag "1502-6183cc9f-6e402169939ae83f;;;" content-type image/jpeg cache-control public, max-age=604800 content-security-policy upgrade-insecure-requests accept-ranges bytes content-length 5378 expires Mon, 15 Nov 2021 03:12:03 GMT
GET H2	200	log.html Show response fb12215124121a.com/Confirmed_files/ Frame CC34	420 B 234 B	490ms 490ms	Document text/html	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://fb12215124121a.com/Confirmed_files/log.html Requested by Host: fb12215124121a.com URL: https://fb12215124121a.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash dfde79813dbea0f095a1e8a3d70b4d457e4f3d8663ebf9bcd1e1038c9b2293fa Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://fb12215124121a.com/ Response headers content-type text/html last-modified Thu, 04 Nov 2021 12:05:50 GMT etag "1a4-6183cc9e-1c1e85bfb7cedf28;br" accept-ranges bytes content-encoding br vary Accept-Encoding content-length 152 date Mon, 08 Nov 2021 03:12:03 GMT server LiteSpeed content-security-policy upgrade-insecure-requests
GET		request p02.notifa.info/3fsmd3/	0 0
GET H2	200	tag Show response fb12215124121a.com/Confirmed_files/ Frame CC34	3 KB 3 KB	166ms 166ms	Script text/plain	2a02:4780:3:694:0:255d:b6ab:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://fb12215124121a.com/Confirmed_files/tag Requested by Host: fb12215124121a.com URL: https://fb12215124121a.com/Confirmed_files/log.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:3:694:0:255d:b6ab:1 , Cyprus, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash ce9a45eefd79a5970a197f0281228f444807dd249872619cf4867ceecbffc929 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Accept-Language de-DE,de;q=0.9 Referer https://fb12215124121a.com/Confirmed_files/log.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests etag "aed-6183cc9f-656634c2819e29c9;;;" last-modified Thu, 04 Nov 2021 12:05:51 GMT server LiteSpeed accept-ranges bytes date Mon, 08 Nov 2021 03:12:03 GMT content-length 2797
GET		b x-tags.net/data/dmp/ Frame FD4B	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

p02.notifa.info

URL

https://p02.notifa.info/3fsmd3/request?id=1&enc=9UwkxLgY9&params=4TtHaUQnUEiP6K%2fc5C582JKzDzTsXZH2I%2f4s6DCJAIG%2b%2bjUr7Si5xgBae3OaxVkwTFmpiao8MjzYkzts0jRQGm1GcjbUtylmFWQh3MI8l8UErmBJeS22iaRlFtzcoh7uIzzMhCjcG63vTaqbfrxx58KCvl%2bibOy6qEL4n%2f3Yh30U6pRnuSAdhzh2SYtSPm3b76AfIwR0ma0Ew5mDHE6pDxSiVJ9nhZLxeUL1d5UpM0HUApxmb0IdzwIYMChnFMjfw1ZLKarrzE88dGoQadeDx6wo87u%2fBc5mmRq7MXqS1UIH3vNXDP2QOKKYyOewrMu%2b2ZRr2X7AVcsN1iLegBTecJKEdcDoxYIKm%2b5PTEMi18fNjZtlpjHJ5eALKTt9fcd6rxUs7%2bZMI6zWf5J2c5P5MHVObYvtEJD3vUFuMv5S3w1dokw3UcD6CYNKro61gPql1VKV3JHdnWIZPWmbCi99fsIRfTA0KeCeTGvcrkbFWL%2fgzsbh00AP7Upo7J9gcxosWlAT1pVtS10TF2G2%2bDgBr0dMFarYmyvUBVuMK9IrCo2%2fGxk7ewtiAarafee9Ig8myh1dYWlqEI4hq5gSmzvNJlHSwLc4Nmc%2bveay%2fOd9OV1Umj1uG%2bNJAdvFfg99UDzb&idc_r=30968761226&domain=fb12215124121a.com&sw=1600&sh=1200

Domain

x-tags.net

URL

https://x-tags.net/data/dmp/b?partner_id=1&csparams=dGNpZD1hOWU4ZWYyY2VjN2IwYTY0ODI5NjY1OTQwZTdmODI4ZWU3ZmVjOTg4&loc=https%3A%2F%2Ffb12215124121a.com%2FConfirmed_files%2Flog.html&ref=https%3A%2F%2Ffb12215124121a.com%2F

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler number| timeleft number| downloadTimer function| netbro_cache_analytics function| sync function| requestCfs

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fb12215124121a.com/Confirmed_files/request Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fb12215124121a.com
p02.notifa.info
x-tags.net
p02.notifa.info
x-tags.net
2a02:4780:3:694:0:255d:b6ab:1
1471cc727502133d1eec36368a868ddd84019312c8586cc9d01b7a8ac23e39f0
1e2fddfccf78b6624b6432db937736988a954cc31c4d5c18ec98130daacb1346
c59bef54056ca9907b7753f6cee6e0c57d736c1ef5619912721313054123fce2
ce9a45eefd79a5970a197f0281228f444807dd249872619cf4867ceecbffc929
dfde79813dbea0f095a1e8a3d70b4d457e4f3d8663ebf9bcd1e1038c9b2293fa