approval-page-review-changes.s23terms.us Open in urlscan Pro
2606:4700:3037::ac43:d4d5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://approval-page-review-changes.s23terms.us/
Submission: On November 06 via automatic, source certstream-suspicious (November 6th 2024, 8:26:22 pm UTC) — Scanned from US

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 20 HTTP transactions. The main IP is 2606:4700:3037::ac43:d4d5, located in United States and belongs to CLOUDFLARENET, US. The main domain is approval-page-review-changes.s23terms.us.
TLS certificate: Issued by WE1 on October 17th 2024. Valid for: 3 months.

This is the only time approval-page-review-changes.s23terms.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
13	2606:4700:303... 2606:4700:3037::ac43:d4d5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::5f	15169 (GOOGLE) (GOOGLE)
1	2620:0:861:ed... 2620:0:861:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
4	2606:4700:303... 2606:4700:3034::6815:1adf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:fa87:fff... 2a04:fa87:fffd::c000:42c9	2635 (AUTOMATTIC) (AUTOMATTIC)
20	5

13 2606:4700:3037::ac43:d4d5 (United States)

ASN13335 (CLOUDFLARENET, US)

approval-page-review-changes.s23terms.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::5f (Washington, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:861:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3034::6815:1adf (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffd::c000:42c9 (Ireland)

ASN2635 (AUTOMATTIC, US)

indonesia.fb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	s23terms.us approval-page-review-changes.s23terms.us	700 KB
4	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 5838	31 KB
1	fb.com indonesia.fb.com	1 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 3371	28 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412	31 KB
20	5

	Domain	Requested by
13	approval-page-review-changes.s23terms.us	approval-page-review-changes.s23terms.us
4	ka-f.fontawesome.com	approval-page-review-changes.s23terms.us
1	indonesia.fb.com
1	upload.wikimedia.org	approval-page-review-changes.s23terms.us
1	ajax.googleapis.com	approval-page-review-changes.s23terms.us
20	5

This site contains no links.

Subject Issuer	Validity	Valid
s23terms.us WE1	`2024-10-17` - `2025-01-15`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.wikipedia.org E6	`2024-10-15` - `2025-01-13`	3 months	crt.sh
ka-f.fontawesome.com WE1	`2024-10-27` - `2025-01-25`	3 months	crt.sh
indonesia.fb.com DigiCert SHA2 High Assurance Server CA	`2024-08-02` - `2025-08-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://approval-page-review-changes.s23terms.us/
Frame ID: 11D4DB5AD6D9774CD0BDD29D6FE40F1E
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Business Help Center

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

791 kB
Transfer

1440 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
approval-page-review-changes.s23terms.us/ 286 KB
39 KB 690ms
556ms Document
text/html 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a29a5b70ec0fe16bcbca718e0ce64774fcab9f9801012e6d580d620a700e2263

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8de7d1499e8cde95-EWR
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Wed, 06 Nov 2024 20:26:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b%2BQ9%2FLRYcaXM935P4xIGpVyupKGIcl%2F3FjfudfugymdwUnsdVYI8zkKMvoMEEJH5AJDunqS8SoPDWTZriAoT4ZxAbdJr0dbwid6MW1xlq9HEVekMUKSV3OJnxXYK%2B%2F0YBp0gavpi14MUwdwtntXzWL6UU4sOaQmKtiYBJiiNvwX3R9g2N%2BKj"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=26325&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4155&recv_bytes=4442&delivery_rate=549&cwnd=12000&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=566&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H3 200 bootstrap.min.css
approval-page-review-changes.s23terms.us/css/ 156 KB
26 KB 806ms
805ms Stylesheet
text/css 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/css/bootstrap.min.css
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5PcneuKUhI2BK7aIQzNwTyFYsRWlpm8lJ%2F%2BXf53PNSRjbd2siQhmmG79GVTWo3nefxmDjFOuPYTuP6vX6BVE2DzcHK%2BD8lDm0r5GOurTeqwdZEm0zKP1%2B0LSe73vQyR4gEyd165GThRycfLhseI4DX8pVLLXCZtVhZwkNh7exX4dsxM7I%2F83"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d14eac54de95-EWR
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=26845&sent=59&recv=37&lost=0&retrans=0&sent_bytes=52828&recv_bytes=7267&delivery_rate=74066&cwnd=28800&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=1623&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:17 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/css
last-modified: Mon, 23 Oct 2023 23:35:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 83fd8385f7.js Show response
approval-page-review-changes.s23terms.us/js/ 11 KB
5 KB 571ms
570ms Script
text/javascript 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/js/83fd8385f7.js
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dc1b850e94055cb2e1d197420f0ac66eb2d8cce333f847533d195ec2e4af2dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Bv7SNGAbqPKFslTTywtZ4FICIPsTYpYYWMN9hyqgLZKIag%2BoduH5%2BPey%2BA7%2Blqhjop0%2F5dreJwTI9UWtmt2Unbsc4FWLxTkcYc1SuqsA52m45%2BTIZLYzSpcCida92LY2Sr2jxa3fiyKT%2BcmqaW5yhfNe8OmoBd8TwKEddpqEabN8roor%2FKV"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d14eac58de95-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27120&sent=51&recv=32&lost=0&retrans=0&sent_bytes=45554&recv_bytes=6682&delivery_rate=662546&cwnd=28800&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=1389&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:17 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/javascript
last-modified: Mon, 23 Oct 2023 23:37:04 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 144ms
47ms Script
text/javascript 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

content-encoding: gzip
age: 103007
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 05 Nov 2025 15:49:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 05 Nov 2024 15:49:29 GMT
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31017
x-xss-protection: 0
server: sffe

GET
H2 200 1024px-Meta_Platforms_Inc._logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/7/7b/Meta_Platforms_Inc._logo.svg/ 27 KB
28 KB 161ms
68ms Image
image/png 2620:0:861:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/7/7b/Meta_Platforms_Inc._logo.svg/1024px-Meta_Platforms_Inc._logo.svg.png

Requested by

Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:861:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

envoy /

Resource Hash

10a8a398ab76b546f1afe5f494877c67a28d43bdde1222c533d6da265df105f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
etag: 3117999997600b697ace8948279f16d0
age: 0
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
x-content-type-options: nosniff
server-timing: cache;desc="hit-local", host;desc="cp1101"
x-cache: cp1101 hit, cp1101 miss
date: Wed, 06 Nov 2024 20:26:16 GMT
content-type: image/png
content-disposition: inline;filename*=UTF-8''Meta_Platforms_Inc._logo.svg.png
last-modified: Tue, 09 Jul 2024 08:13:00 GMT
x-client-ip: 2600:803:a88:3112::112
x-cache-status: hit-local
strict-transport-security: max-age=106384710; includeSubDomains; preload
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27399
server: envoy

GET
H3 200 search-13-64.a9254a55959a7da573f4.ico
approval-page-review-changes.s23terms.us/img/ 17 KB
2 KB 574ms
573ms Image
image/x-icon 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/search-13-64.a9254a55959a7da573f4.ico
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55717da5f0bc7b97c87e7abdc4e097054048bc1c23998d5cc4b83a960d691062

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctJEGs2P0WWGOfZ3J5q%2Bx65DMcA7u2zfI1Jns6WyS7riKFOEZxAyW%2B5xz%2BWM4NkE7QSPwLCkekp9KCP8IXNGeSaOYKICYz2P3fCK%2FQJdxvUc17RERYlY0PmyqQ%2Bf7uZK%2Flfp5yGvw7axoS79%2BfCUeagVHbR9M0KaVfBnvW5jw6zD1EY8Z1bx"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d14efdb1de95-EWR
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=26851&sent=56&recv=35&lost=0&retrans=0&sent_bytes=50819&recv_bytes=6812&delivery_rate=10206&cwnd=28800&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=1444&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:17 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/x-icon
last-modified: Sun, 06 Aug 2023 23:52:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 MetaSecure.png
approval-page-review-changes.s23terms.us/img/ 48 KB
49 KB 1094ms
1094ms Image
image/png 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/MetaSecure.png
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 545c3781cff9f7114a31b0de7323250d7abbbea4c567cabd7025efb0f6a290e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ko6rG7DL1%2FLhudX5%2BPKnke7Z9DAXVwi4r3fO4tcgP7TxEEYS3N8j%2BtcoTVcIadWhCaYHic%2FdN6vf75fhUkl%2F%2BjgAxLLlAK3QWUrEIIY2WyaksJeuWQ5otNn%2FGTmG8fnjKgZ527rOCeg9bckRAedwyqbeS8APgmoJhmbmLEAN2JDyhAsHv6P"}],"group":"cf-nel","max_age":604800}
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32956&sent=83&recv=56&lost=0&retrans=0&sent_bytes=79798&recv_bytes=10368&delivery_rate=151683&cwnd=28800&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2116&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
content-type: image/png
last-modified: Wed, 25 Oct 2023 15:12:04 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8de7d14ffa44de95-EWR
accept-ranges: bytes
content-length: 49084
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H3 200 30175859_1847141705586364_4634876909090504704_n.png
approval-page-review-changes.s23terms.us/img/ 237 KB
238 KB 1139ms
1139ms Image
image/png 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/30175859_1847141705586364_4634876909090504704_n.png
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac480d945a4e3d99a8ace1c55e619289ce1e865955b52f214ce0dd356a384825

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gHOfP8c1N3BzMH1G07sA3muBvL23Bu2gr84mvlU8%2BGPMKwe7sNnSkiTzdQrXqxSz7ksXX4ySmvzLv%2FcjZQDygQVIcxZy4ooELMLERDCZEiqNb8R2uePhc%2B4Amu4hduQZuxW1b35uJyfkOaiEsHV9nUmr3tlQ4atOgBBFmWwUddIDhLBudYfV"}],"group":"cf-nel","max_age":604800}
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30948&sent=197&recv=78&lost=0&retrans=0&sent_bytes=207995&recv_bytes=11351&delivery_rate=511274&cwnd=55200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2583&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
content-type: image/png
last-modified: Mon, 23 Oct 2023 14:12:42 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8de7d1529e24de95-EWR
accept-ranges: bytes
content-length: 242663
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H3 200 278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.png
approval-page-review-changes.s23terms.us/img/ 25 KB
26 KB 814ms
813ms Image
image/png 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.png
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f8213d2e8073eccc067eef5422416c7528f3e9bd3594f3ed8c0ec52b46018c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=64cXwVi2OBgAOp6iH2Wbm0a8HYMOaZPDPNaA%2FX1RUH%2BhVaXEsTI55hV109jcKLJhn0pcvkxIR7PWUVm8bC30ZckVnA1wizSwsgLS0U%2BLZeCPaM7ALlKqextItM6gZgkemxsMUPsZu3DHK6Zp%2BgUtRLieTXGp0msPhD7GN2Qh7dPGvlDynnbI"}],"group":"cf-nel","max_age":604800}
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=36692&sent=154&recv=71&lost=0&retrans=0&sent_bytes=161330&recv_bytes=11031&delivery_rate=208247&cwnd=43200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2475&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
content-type: image/png
last-modified: Sun, 06 Aug 2023 23:58:34 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed25de95-EWR
accept-ranges: bytes
content-length: 25771
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H3 200 recovery.png
approval-page-review-changes.s23terms.us/img/ 267 KB
268 KB 1142ms
1141ms Image
image/png 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/recovery.png
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7fa8b6a6d8fb4ff2b71397516a22e120028fd6f023591e255a8910ff32a8fae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ciuq6lt7DUAXT%2FTlPLMP0cDxUpArrgd90eGtarEIkzeBU6KaMC0Dg%2Bly7XZ6Ni1eNsksI6JFO2GVQczj2dB3RhZPPuq%2BFz5Nd8F9aeLk0uIAEZ%2FTgEdWER1gJzEYNddRIU56ZA%2BCBX0ArcwFg1gXFRXQj19MPYQAskd8iJYCgh%2F26nU2ySsE"}],"group":"cf-nel","max_age":604800}
expires: Wed, 13 Nov 2024 20:26:18 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31101&sent=224&recv=81&lost=0&retrans=0&sent_bytes=240119&recv_bytes=11484&delivery_rate=1068844&cwnd=55200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2801&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
content-type: image/png
last-modified: Wed, 25 Oct 2023 15:19:42 GMT
vary: Accept-Encoding
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed27de95-EWR
accept-ranges: bytes
content-length: 273625
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H3 200 278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.svg
approval-page-review-changes.s23terms.us/img/ 4 KB
2 KB 573ms
573ms Image
image/svg+xml 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://approval-page-review-changes.s23terms.us/img/278052525_813944336231788_2126819975299864928_n.2ca221b227e5e50b2861f74e67923f35.svg
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c038058600a811b8a96de485a224bcc30eb673972fe39954075bcf70ce74e04

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mwq2EDq2LLEJuPP2p4Fme7gsFeqXaISG7pZx5FTf0ShVtpgWOct3prKrrv93Cb1kqr9Wi6Z9m8CiBUeFt7MEVnxBilcWEStn3d7rFQLZ8xYilFFYuqJHuN6BDW8SpM3vYwRKBfPEjf%2FYlBRIROEYv9eTniMHkZB0quL4kMTQQXLN6xvoL4CP"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed2bde95-EWR
expires: Wed, 13 Nov 2024 20:26:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38070&sent=131&recv=70&lost=0&retrans=0&sent_bytes=134803&recv_bytes=10986&delivery_rate=77834&cwnd=43200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2235&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/svg+xml
last-modified: Sun, 06 Aug 2023 23:52:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 813944336231212681997529lenzz.js Show response
approval-page-review-changes.s23terms.us/js/ 4 KB
2 KB 571ms
570ms Script
text/javascript 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/js/813944336231212681997529lenzz.js
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f2fc2bcb2ff87b686257b729ac14962b7df11a8c271c1064729327753f79518

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3teX%2FZNYLKRnIOGPsK32uQIoC%2FmKk1qN8Wr%2F8Ev%2Fu%2F%2BmTIqofUGNm1tqaYop64diyExLhsk2aHs3dbfDeLT0hZuEXq2L8HK50%2FgtbTtS%2BOpRTlxRuIvUMSSpWlcXskJow2LJFaMDF0zDAHIE3rwfZEohq2fo8Mi2f5qLUcP305QGbTdIJ2W3"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed16de95-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38070&sent=126&recv=70&lost=0&retrans=0&sent_bytes=130699&recv_bytes=10986&delivery_rate=77834&cwnd=43200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2233&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/javascript
last-modified: Mon, 23 Oct 2023 17:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 813944336231212681997529original.js Show response
approval-page-review-changes.s23terms.us/js/ 5 KB
2 KB 574ms
572ms Script
text/javascript 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/js/813944336231212681997529original.js
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd7e7b8355a1f11980b8deeef8aea4218c06b08ae5af701887f2528043bfd0f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tAZt7ahtg12lZfJnDbup0IVePK1f8Qlq%2Fu4W5FwxoQEMoqnFqGrcq%2FVdKxVuHazgOEdGsLH6xNtI%2FNn2nTZdKsENfTmaC2bN3jky0fsl%2Be6Fm0mpQZHISwQupENvuENph5q6VBaAZguBdl%2FNkkJlvWK0N3I6%2F6DsSTbI2hMs7pXHNSPhctU1"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed19de95-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=38070&sent=128&recv=70&lost=0&retrans=0&sent_bytes=132296&recv_bytes=10986&delivery_rate=77834&cwnd=43200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2235&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/javascript
last-modified: Thu, 26 Oct 2023 18:25:50 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 bootstrap.bundle.min.js Show response
approval-page-review-changes.s23terms.us/js/ 77 KB
24 KB 813ms
812ms Script
text/javascript 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/js/bootstrap.bundle.min.js
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=36IdxH45sBSjQKviAU4FXFv6ySCkzjs%2FC4LrgJcjXxQj7cy%2Fv4cEK%2BtvpuYApcCCEMM9rfQYjfxu9z1z%2BaD%2BndHvvM0%2Fu6BBmWXPF91CtB7dRnGDWumracWu%2B9V%2FGuY9%2FhoUo7N65aqIAXQTTmYUq4bo3AHoKsIly6fKlfdI3%2Bt0sJptGuQ8"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed1dde95-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=36692&sent=134&recv=71&lost=0&retrans=0&sent_bytes=137330&recv_bytes=11031&delivery_rate=208247&cwnd=43200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2474&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/javascript
last-modified: Mon, 23 Oct 2023 23:38:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 bootstrap.min.js Show response
approval-page-review-changes.s23terms.us/js/ 59 KB
17 KB 882ms
881ms Script
text/javascript 2606:4700:3037::ac43:d4d5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://approval-page-review-changes.s23terms.us/js/bootstrap.min.js
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:d4d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O2iXJC8HqkjRblrLkInGPdvd1uj7eMZmvD7XFePViNHTD2FmTjrlea8ygp8vxbKjIh4ovEBnDSd8%2Byeh1L4soFI%2FlOWQUA2xSMs0k0KgfI5OnpoH40hOt3Nfm4b2znPXNQiwv2C4os%2B2WRkHsFn6s5nmyJP%2BySbaogtAcxr8iL9LcxJzukxj"}],"group":"cf-nel","max_age":604800}
cf-ray: 8de7d153ed22de95-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=32369&sent=180&recv=76&lost=0&retrans=0&sent_bytes=189710&recv_bytes=11262&delivery_rate=1217371&cwnd=55200&unsent_bytes=0&cid=e9bf73e7f4b94025&ts=2545&x=1", cfHdrFlush;dur=0
date: Wed, 06 Nov 2024 20:26:18 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/javascript
last-modified: Mon, 23 Oct 2023 23:38:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 100 KB
23 KB 133ms
57ms Fetch
text/css 2606:4700:3034::6815:1adf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free.min.css?token=83fd8385f7
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/js/83fd8385f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e0821588462d15b0ff8e911760fc041332c162e2e30ab4b1071bcc8eb6c8223

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

access-control-max-age: 3000
content-encoding: gzip
cf-cache-status: MISS
etag: W/"ae737a19e46fd502ba9cbe9e33213861"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lK17jHKVQ7U4Yyoz2p1gm8iMHUBZC6BTsflKnt4%2Fbvwq25cmp2Xlm2UA5Nza%2BX6yXxkEi1fzFPWkU2n%2F92MqBhdcvwu%2Fv4ALXIDrS7eOT3q2wAY%2Bd%2FaRKYFlvIFVdMa8Rwc57ih0mmOuQVEg5kyo5d%2FVPw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: u0Rlp3ELkZcS61jRq6xsZsbj3NUPfr7jD-bnJvM0xGtZrbofc6-UXA==
date: Wed, 06 Nov 2024 20:26:17 GMT
content-type: text/css
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: fa-kit-token
server-timing: cfL4;desc="?proto=QUIC&rtt=26589&sent=11&recv=12&lost=0&retrans=0&sent_bytes=4195&recv_bytes=5522&delivery_rate=22407&cwnd=12000&unsent_bytes=0&cid=6378d2895c54b083&ts=62&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 258e36f8d5b4bc35294b1885246887c8.cloudfront.net (CloudFront)
cf-ray: 8de7d15449cbc3ff-EWR
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 27 KB
5 KB 162ms
87ms Fetch
text/css 2606:4700:3034::6815:1adf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-shims.min.css?token=83fd8385f7
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/js/83fd8385f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 236e285339a2a692e9491d356489cdf83513cfb1add049a0620123d644e47554

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

access-control-max-age: 3000
content-encoding: gzip
cf-cache-status: MISS
etag: W/"da06df503ced6ee507b5fb4fa0999f74"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CH%2BODoFQGdfpHkbQ79KQpYA5UDWlIPBbw%2F8MAyK19YNhP0DM8IWt6bfAThKPdhMEKXMHTPIvARNj3DXQGy7RbO9uKA3v30KPMOMWJUSAprPick4RZmT9HQzEtxSQe%2BOtzHOYp50c82MihKLgKqw45Idakw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: RuNuvUyC5vR1QjxBWu_LvcsZ3dHuGdsM-0LlEdvghpnmoXk2AktF_w==
date: Wed, 06 Nov 2024 20:26:17 GMT
content-type: text/css
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: fa-kit-token
server-timing: cfL4;desc="?proto=QUIC&rtt=26589&sent=21&recv=12&lost=0&retrans=0&sent_bytes=16167&recv_bytes=5522&delivery_rate=22407&cwnd=12000&unsent_bytes=0&cid=6378d2895c54b083&ts=73&x=1", cfExtPri, cfHdrFlush;dur=16
cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 15c2cf85eb6b1f3e4b8c8d0befbed77a.cloudfront.net (CloudFront)
cf-ray: 8de7d15449d6c3ff-EWR
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 823 B
1 KB 161ms
86ms Fetch
text/css 2606:4700:3034::6815:1adf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v5-font-face.min.css?token=83fd8385f7
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/js/83fd8385f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e81443469aa4b967191ce19b7474eb223746a2b8d5dc42d3786da84d99dfad9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

access-control-max-age: 3000
content-encoding: zstd
cf-cache-status: MISS
etag: W/"dbf296002d53e56d340b105d9d764940"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WEmYKaE3zYvimYhFg8XYAOY2Bf2%2B3Cup6iuUf5CyppCcuHAZyB7w1yKb9npLHeMjDdr2BeJMIM5%2B4LZRHx8xDovSR7B223U16VeD7hMEs4jIU5A2pHW24%2FPHphM9ILGGUdF3jPJb3akbeImTvssAitmvGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GPGOTDaYBIZ5XA-pHX5uF6sVxYQm9loV_HNVag6tlEYxxsXG8Qbnng==
date: Wed, 06 Nov 2024 20:26:17 GMT
content-type: text/css
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: fa-kit-token
server-timing: cfL4;desc="?proto=QUIC&rtt=26589&sent=21&recv=12&lost=0&retrans=0&sent_bytes=16167&recv_bytes=5522&delivery_rate=22407&cwnd=12000&unsent_bytes=0&cid=6378d2895c54b083&ts=69&x=1", cfExtPri, cfHdrFlush;dur=20
cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 595266d427582990356e9f138eba5bf2.cloudfront.net (CloudFront)
cf-ray: 8de7d15449d3c3ff-EWR
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 2 KB
2 KB 161ms
86ms Fetch
text/css 2606:4700:3034::6815:1adf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-font-face.min.css?token=83fd8385f7
Requested by: Host: approval-page-review-changes.s23terms.us
URL: https://approval-page-review-changes.s23terms.us/js/83fd8385f7.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:1adf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c58c4804370b9c347d517491c450416ca371fb1403aceaa1d6f751403b07c48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

access-control-max-age: 3000
content-encoding: gzip
cf-cache-status: MISS
etag: W/"9b853b50f37dd0ca770ce0f294d427df"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5vArgsuaRQNY5f%2Fki%2Busw7hjBmp%2BGEV9Vk796nkJN26Q%2BurGHIsBfgAmLpVuW02KkqG7liy2UmWdaFFubuqkEqZ4I5zYfPZ9TEzrMU3dG11XJNWbtJMxBiA5UmAQctFD%2B2CRXiXsm3D%2Fmu8lZ69%2FFabIDw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: iz5k8N3RWJLpSUBjeyriNYMQIJabbvJA8iby-ciBgYtVO_Fr6kOPnQ==
date: Wed, 06 Nov 2024 20:26:17 GMT
content-type: text/css
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
vary: Accept-Encoding
priority: u=1,i
access-control-allow-headers: fa-kit-token
server-timing: cfL4;desc="?proto=QUIC&rtt=26589&sent=21&recv=12&lost=0&retrans=0&sent_bytes=16167&recv_bytes=5522&delivery_rate=22407&cwnd=12000&unsent_bytes=0&cid=6378d2895c54b083&ts=75&x=1", cfExtPri, cfHdrFlush;dur=14
cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via: 1.1 166be199c4ed93f2d4bedd80b1b241de.cloudfront.net (CloudFront)
cf-ray: 8de7d15449d0c3ff-EWR
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P6
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 meta.png
indonesia.fb.com/wp-content/uploads/sites/68/2022/06/ 1 KB
1 KB 190ms
39ms Other
image/webp 2a04:fa87:fffd::c000:42c9
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://indonesia.fb.com/wp-content/uploads/sites/68/2022/06/meta.png?w=32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c9 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

dff95801a35fd238883e234733a649a741fe7afd1b28819c995752a407ff5957

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://approval-page-review-changes.s23terms.us/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=31536000
x-rq: jfk2 98 226 443
etag: "fd7361c0428f90f3"
accept-ranges: bytes, bytes
x-cache: HIT
content-length: 1064
date: Wed, 06 Nov 2024 20:26:19 GMT
content-type: image/webp
last-modified: Sun, 22 Sep 2024 20:07:44 GMT
server: nginx
vary: Accept

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 2 elements with non-unique id #FirstLoginValidateDataForm: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 3 elements with non-unique id #LenzzEmail: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 3 elements with non-unique id #LenzzPassword: (More info: https://goo.gl/9p2vKq) %o %o %o
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 2 elements with non-unique id #Marga: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 2 elements with non-unique id #MargaEmail: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	warning	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Found 2 elements with non-unique id #MargaPassword: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://approval-page-review-changes.s23terms.us/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
approval-page-review-changes.s23terms.us
indonesia.fb.com
ka-f.fontawesome.com
upload.wikimedia.org
2606:4700:3034::6815:1adf
2606:4700:3037::ac43:d4d5
2607:f8b0:4004:c1b::5f
2620:0:861:ed1a::2:b
2a04:fa87:fffd::c000:42c9
0c038058600a811b8a96de485a224bcc30eb673972fe39954075bcf70ce74e04
0e81443469aa4b967191ce19b7474eb223746a2b8d5dc42d3786da84d99dfad9
10a8a398ab76b546f1afe5f494877c67a28d43bdde1222c533d6da265df105f9
236e285339a2a692e9491d356489cdf83513cfb1add049a0620123d644e47554
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
545c3781cff9f7114a31b0de7323250d7abbbea4c567cabd7025efb0f6a290e9
55717da5f0bc7b97c87e7abdc4e097054048bc1c23998d5cc4b83a960d691062
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
5e0821588462d15b0ff8e911760fc041332c162e2e30ab4b1071bcc8eb6c8223
6c58c4804370b9c347d517491c450416ca371fb1403aceaa1d6f751403b07c48
6f8213d2e8073eccc067eef5422416c7528f3e9bd3594f3ed8c0ec52b46018c0
7dc1b850e94055cb2e1d197420f0ac66eb2d8cce333f847533d195ec2e4af2dd
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
7f2fc2bcb2ff87b686257b729ac14962b7df11a8c271c1064729327753f79518
a29a5b70ec0fe16bcbca718e0ce64774fcab9f9801012e6d580d620a700e2263
ac480d945a4e3d99a8ace1c55e619289ce1e865955b52f214ce0dd356a384825
c7fa8b6a6d8fb4ff2b71397516a22e120028fd6f023591e255a8910ff32a8fae
cd7e7b8355a1f11980b8deeef8aea4218c06b08ae5af701887f2528043bfd0f8
dff95801a35fd238883e234733a649a741fe7afd1b28819c995752a407ff5957
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

approval-page-review-changes.s23terms.us Open in urlscan Pro 2606:4700:3037::ac43:d4d5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

100 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

791 kBTransfer

1440 kBSize

0 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

approval-page-review-changes.s23terms.us Open in urlscan Pro
2606:4700:3037::ac43:d4d5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

791 kB
Transfer

1440 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!