fridaynightquiz.com Open in urlscan Pro
2606:4700:3031::ac43:d9db Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Effective URL:
https://fridaynightquiz.com/wp-content/aslian/dod/ba.php
Submission: On June 27 via manual (June 27th 2023, 7:25:59 am UTC) from DE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3031::ac43:d9db, located in United States and belongs to CLOUDFLARENET, US. The main domain is fridaynightquiz.com.
TLS certificate: Issued by GTS CA 1P5 on June 7th 2023. Valid for: 3 months.

This is the only time fridaynightquiz.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ING Group (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	108.138.17.99 108.138.17.99	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:400... 2a04:4e42:400::282	54113 (FASTLY) (FASTLY)
4	2600:9000:223... 2600:9000:223c:6400:1c:d937:ae40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223f:cc00:f:e793:dc40:21	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:f400:13:b2ca:a980:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	45.33.29.14 45.33.29.14	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	2606:4700:303... 2606:4700:3031::ac43:d9db	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	7

2 108.138.17.99 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-99.fra56.r.cloudfront.net

newsletter221.systeme.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::282 (United States)

ASN54113 (FASTLY, US)

cdn.polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:223c:6400:1c:d937:ae40:93a1 (United States)

ASN16509 (AMAZON-02, US)

d3fit27i5nzkqh.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:cc00:f:e793:dc40:21 (United States)

ASN16509 (AMAZON-02, US)

d3syewzhvzylbl.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:f400:13:b2ca:a980:93a1 (United States)

ASN16509 (AMAZON-02, US)

editor.systeme.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.33.29.14 (Richardson, United States) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: aspen.phplist.com

ohphrpdnszykby.hosted.phplist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:d9db (United States)

ASN13335 (CLOUDFLARENET, US)

fridaynightquiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	cloudfront.net d3fit27i5nzkqh.cloudfront.net d3syewzhvzylbl.cloudfront.net	457 KB
3	systeme.io 1 redirects newsletter221.systeme.io editor.systeme.io — Cisco Umbrella Rank: 490219	21 KB
1	fridaynightquiz.com fridaynightquiz.com	176 KB
1	phplist.com 1 redirects ohphrpdnszykby.hosted.phplist.com	534 B
1	polyfill.io cdn.polyfill.io — Cisco Umbrella Rank: 3460	681 B
10	5

	Domain	Requested by
4	d3fit27i5nzkqh.cloudfront.net	newsletter221.systeme.io
2	newsletter221.systeme.io	1 redirects
1	fridaynightquiz.com	fridaynightquiz.com
1	ohphrpdnszykby.hosted.phplist.com	1 redirects
1	editor.systeme.io	newsletter221.systeme.io
1	d3syewzhvzylbl.cloudfront.net	newsletter221.systeme.io
1	cdn.polyfill.io	newsletter221.systeme.io
10	7

This site contains no links.

Subject Issuer	Validity	Valid
systeme.io Amazon RSA 2048 M01	`2023-03-02` - `2024-01-24`	a year	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-10` - `2024-01-11`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
editor.systeme.io Amazon RSA 2048 M01	`2023-02-20` - `2023-09-27`	7 months	crt.sh
fridaynightquiz.com GTS CA 1P5	`2023-06-07` - `2023-09-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fridaynightquiz.com/wp-content/aslian/dod/ba.php
Frame ID: E79726D71094422DB2F2931F9D4B0975
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ING Login

Page URL History Show full URLs

http://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3 HTTP 301
https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3 Page URL
https://ohphrpdnszykby.hosted.phplist.com/lists/lt.php?tid=eE8AClcEBg9WBh1SUVEAHVFQAFEZWQgDUEkNA1dcBA0FAVZcUFYZDFUGCAY... HTTP 303
https://fridaynightquiz.com/wp-content/aslian/dod/ba.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Page Statistics

10
Requests

90 %
HTTPS

71 %
IPv6

5
Domains

7
Subdomains

7
IPs

1
Countries

745 kB
Transfer

2380 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3 HTTP 301
https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3 Page URL
https://ohphrpdnszykby.hosted.phplist.com/lists/lt.php?tid=eE8AClcEBg9WBh1SUVEAHVFQAFEZWQgDUEkNA1dcBA0FAVZcUFYZDFUGCAYBVQIdBFVdBxlVXgRYSVgHAQcfDQcDBw9XVwQBAQYISFdXVFVcAgFQGQcOVANJDQ8EVh8AVFFRFAsCUQsDAFMCUVJUCQ HTTP 303
https://fridaynightquiz.com/wp-content/aslian/dod/ba.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3 HTTP 301
https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3

10 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

3a747dd1-dd8a5e70-c221e5e3 Show response
newsletter221.systeme.io/
Redirect Chain

http://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3

37 KB
9 KB

157ms
136ms

Document
text/html

108.138.17.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-99.fra56.r.cloudfront.net

Software

nginx/1.24.0 /

Resource Hash

dd03bb3a55eb0bc9d2169c79cb2d99327fbd629b2e28bc9d58a27da9c7320375

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, must-revalidate, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 27 Jun 2023 07:25:53 GMT
expires: Tue, 27 Jun 2023 07:25:53 GMT
server: nginx/1.24.0
vary: Accept-Encoding
via: 1.1 57ba1933a852bdb178dbe4a1e2e3a5fa.cloudfront.net (CloudFront)
x-amz-cf-id: Q57vOqh6xRWztovDeYkGWkILgVscYQG8IcCsMT2w7bRaxIr_cIWGkw==
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 167
Content-Type: text/html
Date: Tue, 27 Jun 2023 07:25:53 GMT
Location: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Server: CloudFront
Via: 1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: G1HQ_U0N9C8o4Z4W7jnwg1TSB1D-B0qS8Py2zfMy8kwmY6UG0INBvA==
X-Amz-Cf-Pop: FRA56-P7
X-Cache: Redirect from cloudfront

GET
H2 200 polyfill.min.js Show response
cdn.polyfill.io/v2/ 100 B
681 B 80ms
19ms Script
text/javascript 2a04:4e42:400::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.polyfill.io/v2/polyfill.min.js?features=Intl.~locale.en%2CmatchMedia

Requested by

Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 27 Jun 2023 07:25:53 GMT
age: 956954
detected-user-agent: Chrome Mobile/92.0.4515
useragent_normaliser: chrome/92.0.0
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=2
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 113
referrer-policy: origin-when-cross-origin
last-modified: Wed, 03 May 2023 00:17:37 GMT
fastly_service_version: 195
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
normalized-user-agent: chrome/92.0.0
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 all.min.css
d3fit27i5nzkqh.cloudfront.net/assets/css/ 486 KB
82 KB 80ms
20ms Stylesheet
text/css 2600:9000:223c:6400:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/assets/css/all.min.css
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6400:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a35f901d01118e5649091bd03ac5784a7db52e111fb3806524c412f3d1dcfc5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Thu, 25 May 2023 15:08:50 GMT
content-encoding: gzip
via: 1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
last-modified: Wed, 18 May 2022 12:25:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 2823424
etag: W/"325672b036bab9b57f6873aed5eccc43"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000,public
x-amz-cf-id: VR4jiHRuSZV4fxHjbmT3T_v12VRGoCk7wN8ouehnF0vtb9qVcY7n4Q==

GET
H2 200 runtimeSimplePage.6525755ed16e40f11e2f.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 2 KB
1 KB 100ms
41ms Script
application/javascript 2600:9000:223c:6400:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/runtimeSimplePage.6525755ed16e40f11e2f.js
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6400:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6e6bcec8cf0fab66c48aea5ba1e6cfa240580212d714019a81493caad1c2b99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Sun, 21 May 2023 10:00:25 GMT
content-encoding: gzip
via: 1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 14:58:30 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 3187529
etag: W/"7e48280fb388cda9c9571931b0370d17"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: mEHQKS2KyeLEZFX5D6cI0V5JVo83Jmw2Yurt-MsBL-cRjjGVIsOdPw==

GET
H2 200 simplePage.4f2781bf09bd8a81ef78.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 489 KB
80 KB 102ms
44ms Script
application/javascript 2600:9000:223c:6400:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/simplePage.4f2781bf09bd8a81ef78.js
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6400:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5bbe8ea83773e0d5cc7a3e94bd8d63048236239eb02f4dffe6d21689b71f992b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Thu, 15 Jun 2023 16:08:24 GMT
content-encoding: br
via: 1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
last-modified: Thu, 15 Jun 2023 16:08:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 1005450
etag: W/"65732aac8d9f6517a2b1e4811591e5fa"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: w-qYyjXAUPao_fmmnvgYdhj1JFLbyDPkdiFyAxuwrLtIfwXVJETHKw==

GET
H2 200 vendors~simplePage.1fb37d24bdd9e96a0de1.js Show response
d3fit27i5nzkqh.cloudfront.net/js/ 845 KB
247 KB 120ms
61ms Script
application/javascript 2600:9000:223c:6400:1c:d937:ae40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3fit27i5nzkqh.cloudfront.net/js/vendors~simplePage.1fb37d24bdd9e96a0de1.js
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6400:1c:d937:ae40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f5c6aae10644f6795f7f6ce1d1fdca28f1b3ced34ac660b1ae53c2bab0b88462

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Sun, 14 May 2023 09:00:12 GMT
content-encoding: gzip
via: 1.1 2af4ee189e50805a67bd62bbd51ad0dc.cloudfront.net (CloudFront)
last-modified: Fri, 12 May 2023 09:24:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 3795942
etag: W/"b2bc303c095b22a0cc7f837ed711d581"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: gwH3xQTcLcFOp6mMPu73Y8MIgTcEsQl8F8oMUKkriqIXcL75BtaHDg==

GET
H2 200 regular.woff2
d3syewzhvzylbl.cloudfront.net/fonts/google-fonts/poppins/ 46 KB
47 KB 68ms
10ms Font
font/woff2 2600:9000:223f:cc00:f:e793:dc40:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3syewzhvzylbl.cloudfront.net/fonts/google-fonts/poppins/regular.woff2
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:cc00:f:e793:dc40:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://newsletter221.systeme.io/
Origin: https://newsletter221.systeme.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Tue, 27 Jun 2023 03:49:34 GMT
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 13111
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 47436
last-modified: Fri, 14 Apr 2023 06:25:02 GMT
server: AmazonS3
etag: "cad4f07ea4f99fe6568f91c7320cbbce"
access-control-max-age: 31536000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: hqimUT22K7Y0HZ-H9hviL5lRpF34kGdo9brF08shV3cSvi-AHnVPRA==

GET
H2 200 affiliate_badge_logo.png
editor.systeme.io/assets/images/ 10 KB
11 KB 120ms
9ms Image
image/png 2600:9000:223c:f400:13:b2ca:a980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://editor.systeme.io/assets/images/affiliate_badge_logo.png
Requested by: Host: newsletter221.systeme.io
URL: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:f400:13:b2ca:a980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newsletter221.systeme.io/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Thu, 22 Jun 2023 14:56:21 GMT
via: 1.1 50c53efe331c3da25a4faf191817af8c.cloudfront.net (CloudFront)
last-modified: Thu, 22 Jun 2023 14:55:55 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 404974
etag: "8ef4308d7726d4ff8621170e787130ed"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000,public
accept-ranges: bytes
content-length: 10472
x-amz-cf-id: o7RQ1wf5LB0i-FuE0djtz29UZA1kfRBVnwQx7eina86jzL6WbhCf5g==

GET
H2

200

Primary Request ba.php Show response
fridaynightquiz.com/wp-content/aslian/dod/
Redirect Chain

https://ohphrpdnszykby.hosted.phplist.com/lists/lt.php?tid=eE8AClcEBg9WBh1SUVEAHVFQAFEZWQgDUEkNA1dcBA0FAVZcUFYZDFUGCAYBVQIdBFVdBxlVXgRYSVgHAQcfDQcDBw9XVwQBAQYISFdXVFVcAgFQGQcOVANJDQ8EVh8AVFFRFAsCUQ...
https://fridaynightquiz.com/wp-content/aslian/dod/ba.php

313 KB
176 KB

383ms
318ms

Document
text/html

2606:4700:3031::ac43:d9db
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fridaynightquiz.com/wp-content/aslian/dod/ba.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:d9db , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 6b04b89543cd04df470f303b843499b1776eee5da79f94b9b260551edf8a3b89

Request headers

Referer: https://newsletter221.systeme.io/3a747dd1-dd8a5e70-c221e5e3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ddbf5738be2914c-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Jun 2023 07:25:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e8TsC5hV9HeJtB15mNrZr41aMameR0HqljcGwh75oCyfGq8kFjcJ15OekmFnLJMxEi4UjPt043DS7BLZB9DjE8Tw16xIvmkGG%2BeS1QeZQVHRUeJZpxHQCJx%2FbmJOTcZGfIXTphTZurR38vkV%2BAhd0Och"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 27 Jun 2023 07:25:54 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://fridaynightquiz.com/wp-content/aslian/dod/ba.php
pragma: no-cache
server: Apache/2.4.38 (Debian)

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1470546a5f8d7a68deb045a9f3be48c3fa818c53c0b4f8c854d6acdec64aa225

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 30 KB
30 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e

Request headers

Referer
Origin: https://fridaynightquiz.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 29 KB
29 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155

Request headers

Referer
Origin: https://fridaynightquiz.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8

Request headers

Referer
Origin: https://fridaynightquiz.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 44 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type: image/png

GET email-decode.min.js
fridaynightquiz.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fridaynightquiz.com
URL: https://fridaynightquiz.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ING Group (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
newsletter221.systeme.io/	1969-12-31 23:59:59	Name: user Value: rjc4aifv0e4ogbtmrg0poek7al
newsletter221.systeme.io/	1970-01-20 22:26:50	Name: v Value: 5ccf00820e25f78600083281f84b05a43e02329202786e7e3ede325f4a8acf66
.phplist.com/	1969-12-31 23:59:59	Name: WebblerSession Value: bc99pk9hvaeo2u5ol4si13o5l1
ohphrpdnszykby.hosted.phplist.com/	1969-12-31 23:59:59	Name: SERVERID Value: pqserver1\|ZJqPB\|ZJqPB

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://fridaynightquiz.com/wp-content/aslian/dod/ba.php Message: Refused to load the script 'https://fridaynightquiz.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-inline' data:". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.polyfill.io
d3fit27i5nzkqh.cloudfront.net
d3syewzhvzylbl.cloudfront.net
editor.systeme.io
fridaynightquiz.com
newsletter221.systeme.io
ohphrpdnszykby.hosted.phplist.com
fridaynightquiz.com
108.138.17.99
2600:9000:223c:6400:1c:d937:ae40:93a1
2600:9000:223c:f400:13:b2ca:a980:93a1
2600:9000:223f:cc00:f:e793:dc40:21
2606:4700:3031::ac43:d9db
2a04:4e42:400::282
45.33.29.14
1470546a5f8d7a68deb045a9f3be48c3fa818c53c0b4f8c854d6acdec64aa225
305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8
34e4e4e998d1023cadeeda959be0f4fce5abe4eaf9d241782ae404e36446ecbf
3a135f82b209a59959b162a1fbc9b0b38856d1332af286f86046b06357b3811e
5bbe8ea83773e0d5cc7a3e94bd8d63048236239eb02f4dffe6d21689b71f992b
6b04b89543cd04df470f303b843499b1776eee5da79f94b9b260551edf8a3b89
9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf
a35f901d01118e5649091bd03ac5784a7db52e111fb3806524c412f3d1dcfc5d
dd03bb3a55eb0bc9d2169c79cb2d99327fbd629b2e28bc9d58a27da9c7320375
e6e6bcec8cf0fab66c48aea5ba1e6cfa240580212d714019a81493caad1c2b99
f5c6aae10644f6795f7f6ce1d1fdca28f1b3ced34ac660b1ae53c2bab0b88462
f74c344733a85af20d2754b208f12309e2a30c591795d0881cb0ad94c4be6155
fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e

fridaynightquiz.com Open in urlscan Pro 2606:4700:3031::ac43:d9db Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

71 %IPv6

5 Domains

7 Subdomains

7 IPs

1 Countries

745 kBTransfer

2380 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

4 Cookies

1 Console Messages

Security Headers

Indicators

fridaynightquiz.com Open in urlscan Pro
2606:4700:3031::ac43:d9db Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

71 %
IPv6

5
Domains

7
Subdomains

7
IPs

1
Countries

745 kB
Transfer

2380 kB
Size

4
Cookies

10 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!