page-warring-403405.5632599.com Open in urlscan Pro
2606:4700:3030::6815:26af Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://page-warring-403405.5632599.com/
Submission: On November 22 via automatic, source openphish (November 22nd 2023, 11:23:45 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3030::6815:26af, located in United States and belongs to CLOUDFLARENET, US. The main domain is page-warring-403405.5632599.com.
TLS certificate: Issued by GTS CA 1P5 on October 24th 2023. Valid for: 3 months.

This is the only time page-warring-403405.5632599.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3030::6815:26af	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:7caf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	5

2 2606:4700:3030::6815:26af (United States)

ASN13335 (CLOUDFLARENET, US)

page-warring-403405.5632599.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7caf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 335	131 KB
2	5632599.com page-warring-403405.5632599.com	68 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 903	58 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 364	31 KB
9	4

	Domain	Requested by
5	cdn.jsdelivr.net	page-warring-403405.5632599.com cdn.jsdelivr.net
2	page-warring-403405.5632599.com	page-warring-403405.5632599.com
1	unpkg.com	page-warring-403405.5632599.com
1	ajax.googleapis.com	page-warring-403405.5632599.com
9	4

This site contains no links.

Subject Issuer	Validity	Valid
5632599.com GTS CA 1P5	`2023-10-24` - `2024-01-22`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://page-warring-403405.5632599.com/
Frame ID: B4018B41F0E816286E226313FD86C170
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Support Inbox

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

288 kB
Transfer

1065 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
page-warring-403405.5632599.com/ 117 KB
67 KB 532ms
487ms Document
text/html 2606:4700:3030::6815:26af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://page-warring-403405.5632599.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:26af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e60440e3002ae86aa1024a3190b550711cc20bbe6014ff0dfae3f7afbb8db3f0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache,no-store
cf-cache-status: DYNAMIC
cf-ray: 82a4ebdda9aa5d9d-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 22 Nov 2023 23:23:38 GMT
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A871fpine851Nii5ootE0B142B%2FVvxzTFIymHKYuzNn%2BuMsD4U0Fp7S7zJ%2BjWKa2I4br3c%2FUKQC5rViqG%2FXLnk9ymUyawhVZbz9ZWfFzEc4fBQuqVNndbe%2BTTTkddfeaEGGkHd6gvYNgv258ixlEtx7NYFRGecR5Ugydzt%2B4"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/css/ 227 KB
33 KB 36ms
17ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/css/bootstrap.min.css

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d939d21f27010c09b6c2966681d8b4cfcd64ca418f240922518f967fded16ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1099458
x-jsd-version: 5.3.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230055-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"38d97-sT73BUPXDB7H/dVqXrydfWQCOFE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RRfheJd1NyifM%2FKNDri0E8GtEY%2F48tmRPgX%2B%2FGWQxUKz0VG5qIprhEaYqv0y7ieEVRTH%2BiqqWhAbp%2BaS3vvUxaxkhx40x5ufsSxvUb4jOKQJm61odEakyNi7fyGHBzrGFa2%2BexE3j6iJ8Z%2BRiwk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 82a4ebe0dcfd6928-FRA

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/js/ 79 KB
24 KB 37ms
18ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.1/dist/js/bootstrap.bundle.min.js

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2ea6c1e0cabca20d18e924b25a1cd0187c38ba7c33f60ab06e1b0402b9bcdb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 841080
x-jsd-version: 5.3.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230122-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"13b1c-zlT4XyePvNXLIpL5wYbu32PNz4g"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9WNxcAklLYdpYG3XvDAYqXf7YS02UT3G%2FeumYwfy58zF47%2FBN3WM2T1uhupFGizqEKQSe91xQvyoctnOHmRUB9kcGd2Nnq0EcEhxvTVR2Xc3SZArrSC3LCG5Zxf5nBjJJipqdo7Y6vumBzdmje4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 82a4ebe0dd016928-FRA

GET
H2 200 intlTelInput.css
cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/css/ 24 KB
3 KB 42ms
24ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/css/intlTelInput.css

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69e8eadb82de98033b1ccfb0100f0d0bbcd34248f30e408df6e62530d677c1a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1974989
x-jsd-version: 18.2.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230028-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"5fb8-WnSvB+yaygmg0DeJxvUEpIoK3s4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZZOj8yAllAhd1QJyJ0o6Xl1hsJGD4RkJJntLFOH4682NDMS%2FkwcVdgqX3v%2FDQw2QABs8aRABHmO9wryYRnyvuNPJYsUYxmlaOpGCu7pXj%2Fc%2BqZIPQxK6ad5mmzb2WZdYmLv3jsjY9w1ZzJ9agVU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 82a4ebe0dcff6928-FRA

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ 88 KB
31 KB 33ms
7ms Script
text/javascript 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 22:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3987
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31154
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 03:27:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Nov 2024 22:17:12 GMT

GET
H2 200 intlTelInput.min.js Show response
cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/js/ 30 KB
12 KB 34ms
16ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/js/intlTelInput.min.js

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b80ed4d13bf572a788637e2e5e5d73519c4d65a2a9a70c27e41c893cc6fdc90e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 768209
x-jsd-version: 18.2.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230126-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"791e-xMKIO/wWFFQNCVWVf/bP0/hzEm8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLYdjIp97Uyi5jgVeK8GQC691s7fbMCxoqlOdK7PlRMt78I%2BaDMhpXJGnSrCsdVoUGr9XO52GBdYlfsYD%2BbagqNra9UR%2FOyq8r%2BK6D6MuXQCELoj2%2Bv%2FewvNaYOmwMGv8eyjceQlAo9HswVeMWU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 82a4ebe0dd006928-FRA

GET
H2 200 libphonenumber-max.js Show response
unpkg.com/libphonenumber-js@1.9.6/bundle/ 207 KB
58 KB 41ms
23ms Script
application/javascript 2606:4700::6810:7caf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/libphonenumber-js@1.9.6/bundle/libphonenumber-max.js

Requested by

Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2272c19206f51b44a7d763d806c91846406047f04db0bc252db433ede7bf0496

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1804536
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HE6WK4YXD8FP32J6ATSECAGH-fra
server: cloudflare
etag: W/"33dfb-81tzlDwsb/PFqDR3XG7+UApK/Ps"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 82a4ebe0dc742bc2-FRA

GET
H2 200 VfgdbEaa9lirdJO4AO4vR1b0U4st1.js Show response
page-warring-403405.5632599.com/js/ 3 KB
1 KB 325ms
324ms Script
application/javascript 2606:4700:3030::6815:26af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://page-warring-403405.5632599.com/js/VfgdbEaa9lirdJO4AO4vR1b0U4st1.js
Requested by: Host: page-warring-403405.5632599.com
URL: https://page-warring-403405.5632599.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:26af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb954456f050f593123561d496ea6a9dde4c6bd7238fd719bb0b5a44c3fcbdd4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 22 Nov 2023 16:15:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1da1d5f160e882a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qhisJSzc7lkzApmtanuOiLsmZfU7EXLdh5hkKbDsdjN%2BdHPa3cnihtxwsNPZJ7o%2B8uEBY6hM008pbey%2FPXA4OUhIEze3Rdnva6Hle2MRNd5nYPr3jk3if0nCCsDcbf1I3O8QTBrmImV5wu4H%2Fp%2BrVcP%2Fsq9q3TYF%2FLK%2F6oxe"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 82a4ebe0bbcf5d9d-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 41 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4420a80a297b68048f4fe40b6950cee830fec4c4dc3d8fb7f2580025f6edde85

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 utils.js Show response
cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/js/ 248 KB
59 KB 19ms
18ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/js/utils.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/intl-tel-input@18.2.1/build/js/intlTelInput.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b8fa25cbe5eda2c2e19eb168b100fffd42d2f75a0dcafe808ac61d139cb626e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://page-warring-403405.5632599.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 23:23:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1802965
x-jsd-version: 18.2.1
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230081-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"3e099-Jlty7YQyU8WV7mKdDJIB2+UyjX4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GjI4nbeW3drtvVz5%2BS%2FjdC9yp%2FFoFI3kAVki65kulZalovD1Sjfb7Fvo5j%2B9L%2FQdJHEuUBvzIHr6bsqFcyqSVpbtIUwvzqC%2BR2w3n%2F%2Bzz%2FgmcgXqIckgA5FNscaGEHouUH0331Hve3BL%2Bju3azw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 82a4ebe548496928-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			page-warring-403405.5632599.com/	1969-12-31 23:59:59	Name: .AspNetCore.Session Value: CfDJ8PFgVqVWlfZPoC2Q09Gf8sE6wIQAFRkn6SJQBKr0WQN4j3l1DXFyp2IZTdOOW%2B8vqLwQrpFsjycZ%2F138z8rjvvN7h9Sm2sLOyvCYpjlOe0Sq%2BaZ%2FXzR9rdeDlh1PaP33fpwohNYT0VdF64U%2FWixVYdZxT40zIW9EXryR3HVpUPGq

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
page-warring-403405.5632599.com
unpkg.com
2606:4700:3030::6815:26af
2606:4700::6810:5614
2606:4700::6810:7caf
2a00:1450:4001:810::200a
2272c19206f51b44a7d763d806c91846406047f04db0bc252db433ede7bf0496
4420a80a297b68048f4fe40b6950cee830fec4c4dc3d8fb7f2580025f6edde85
69e8eadb82de98033b1ccfb0100f0d0bbcd34248f30e408df6e62530d677c1a2
7b8fa25cbe5eda2c2e19eb168b100fffd42d2f75a0dcafe808ac61d139cb626e
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b80ed4d13bf572a788637e2e5e5d73519c4d65a2a9a70c27e41c893cc6fdc90e
d2ea6c1e0cabca20d18e924b25a1cd0187c38ba7c33f60ab06e1b0402b9bcdb5
d939d21f27010c09b6c2966681d8b4cfcd64ca418f240922518f967fded16ef6
e60440e3002ae86aa1024a3190b550711cc20bbe6014ff0dfae3f7afbb8db3f0
fb954456f050f593123561d496ea6a9dde4c6bd7238fd719bb0b5a44c3fcbdd4

page-warring-403405.5632599.com Open in urlscan Pro 2606:4700:3030::6815:26af Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

288 kBTransfer

1065 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

page-warring-403405.5632599.com Open in urlscan Pro
2606:4700:3030::6815:26af Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

288 kB
Transfer

1065 kB
Size

1
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!