live-fb.bank-brinews.my.id Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://live-fb.bank-brinews.my.id/
Submission: On October 08 via automatic, source certstream-suspicious (October 8th 2023, 11:06:56 am UTC) — Scanned from NL

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is live-fb.bank-brinews.my.id.
TLS certificate: Issued by GTS CA 1P5 on August 17th 2023. Valid for: 3 months.

This is the only time live-fb.bank-brinews.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
4	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
1	162.19.58.156 162.19.58.156	16276 (OVH) (OVH)
1	2606:4700::68... 2606:4700::6810:7aaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	() ()
15	6

4 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

live-fb.bank-brinews.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.58.156 (France)

ASN16276 (OVH, FR)
PTR: ns3096358.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7aaf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:d:face:b00c:0:3 (None, )

ASN- ()

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	blogspot.com 1.bp.blogspot.com — Cisco Umbrella Rank: 10845 2.bp.blogspot.com — Cisco Umbrella Rank: 13973	94 KB
4	bank-brinews.my.id live-fb.bank-brinews.my.id	78 KB
1	fbcdn.net static.xx.fbcdn.net	4 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 1102
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 10991	9 KB
0	ambroseclover.com Failed ambroseclover.com Failed
15	6

	Domain	Requested by
5	1.bp.blogspot.com	live-fb.bank-brinews.my.id
4	live-fb.bank-brinews.my.id	live-fb.bank-brinews.my.id
2	2.bp.blogspot.com
1	static.xx.fbcdn.net
1	unpkg.com	live-fb.bank-brinews.my.id
1	i.ibb.co	live-fb.bank-brinews.my.id
0	ambroseclover.com Failed	live-fb.bank-brinews.my.id
15	7

This site contains no links.

Subject Issuer	Validity	Valid
bank-brinews.my.id GTS CA 1P5	`2023-08-17` - `2023-11-15`	3 months	crt.sh
misc-sni.blogspot.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
ibb.co R3	`2023-08-10` - `2023-11-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-07-17` - `2023-10-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://live-fb.bank-brinews.my.id/
Frame ID: FCAEA25E2DAC66A2BFD526FB946E90C8
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook Streaming - 18+ Vidios

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

80 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

185 kB
Transfer

303 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
live-fb.bank-brinews.my.id/ 156 KB
39 KB 317ms
239ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live-fb.bank-brinews.my.id/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa278887eda0d9b2b8a49360256edd6ef2aff8fd3d9088bd1a5ba1a6809f94db

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 812deab4dbd7bc03-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 08 Oct 2023 11:06:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WT7CZel86bw5VTbM9WM1nfojoOM1YFCB4HRVQJIhAsCHnn7oB533uTtGMsfHNYvHnZO3z7hf9%2BvPTI7IeBTyIPwBBi3Pk2MZn7OdT7kbzhCfXSfzR6gcJwzmnZh3rHyDbc5SuZWbJGjndtnWvFCCJgtsSlfsVGMuRA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 style.css
live-fb.bank-brinews.my.id/css/ 5 KB
1 KB 196ms
196ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live-fb.bank-brinews.my.id/css/style.css
Requested by: Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18237e058013d98f6303b910c0c4c4ea92b66f56ea599f4ff4fad12e4ccc0f30

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 21 Sep 2022 02:58:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uLWByxd8YHsD6dFtev6cijfk6G7ZGNHJiw97Pi%2FI7bRi3zcx1xgWzB1CRkxWvA%2BgRdNSVMmtWq4obzSQcOk7hyYcI%2FFfo%2B5iiymNk5UHRzAHac%2BUdg%2B%2BIl%2FJOuXl%2B4Qi6dIDlLWJQEgKUSV%2FJnrcvgNBZ8mnztkgdw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 812deab65d87bc03-FRA
alt-svc: h3=":443"; ma=86400

GET 6.mp4
ambroseclover.com/id/ 0
0

GET
H2 200 no_avatar.jpg
1.bp.blogspot.com/-0joo3x_HmEA/YDliRVbZCQI/AAAAAAABP64/3vvRrN7DSXQXmkEnh4RL3mJrmtoiUue7gCLcBGAsYHQ/s0/ 1 KB
1 KB 140ms
54ms Image
image/jpeg 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-0joo3x_HmEA/YDliRVbZCQI/AAAAAAABP64/3vvRrN7DSXQXmkEnh4RL3mJrmtoiUue7gCLcBGAsYHQ/s0/no_avatar.jpg

Requested by

Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

fc678930e3ca735466aa83305290fc821faa5fe7480cbe08d99b060136514d39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="no_avatar.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1291
x-xss-protection: 0
server: fife
etag: "v13fb0"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:51 GMT

GET
H2 200 17.png
1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/ 14 KB
14 KB 130ms
45ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png

Requested by

Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c128cdac81f1dec27e63591edbb8cf60b473a7f873d632f4fce9e5db0b9937a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="17.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14223
x-xss-protection: 0
server: fife
etag: "v1e2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:51 GMT

GET
H3 200 fbbanner.png
live-fb.bank-brinews.my.id/ 23 KB
24 KB 289ms
288ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live-fb.bank-brinews.my.id/fbbanner.png
Requested by: Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bb974b248e92e97f07d71ca6a78035dfae9d2d9a7e211b2dda3126b0910950c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
cf-cache-status: MISS
last-modified: Tue, 20 Sep 2022 05:42:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M%2BOq4ReqLoLrSCDaWwpqsRneO4JboHdnE4rTBERArh%2FyGLB369mY6l%2BeLaK%2B3HmjXVtb2%2FTvPLjqTfwJnf%2FV6eEsVa06wrXqTMypoC6XOsadTa2n0oTrJ9mNk8zE1h1v6XjpELQWO51rEIswNSljCAylgN%2FOlEz2jw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 812deab80af630db-FRA
alt-svc: h3=":443"; ma=86400
content-length: 24006

GET
H2 200 logofbb-removebg-preview.png
i.ibb.co/ThFWLfQ/ 9 KB
9 KB 148ms
19ms Image
image/png 162.19.58.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/ThFWLfQ/logofbb-removebg-preview.png
Requested by: Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.156 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096358.ip-162-19-58.eu
Software: nginx /
Resource Hash: 01de96097767803667b379b75c967fb1917eab1910a7a1e4288254930d992fae

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
last-modified: Mon, 18 Jul 2022 08:52:12 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 8979
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 jquery.min.js
unpkg.com/ajax-libs@9.0.1/ 0
0 756ms
710ms Script
text/plain 2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://unpkg.com/ajax-libs@9.0.1/jquery.min.js
Requested by: Host: live-fb.bank-brinews.my.id
URL: https://live-fb.bank-brinews.my.id/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

GET
H2 200 12.png
2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/ 14 KB
15 KB 43ms
42ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/12.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

42f95ccca2e10b2785b171fcd0a92921c6bc6a4fdd9710e8e99238050c78166f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:52 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="12.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14846
x-xss-protection: 0
server: fife
etag: "v1f3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:52 GMT

GET
H2 200 17.png
1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/ 14 KB
14 KB 32ms
31ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c128cdac81f1dec27e63591edbb8cf60b473a7f873d632f4fce9e5db0b9937a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
x-content-type-options: nosniff
age: 1
content-disposition: inline;filename="17.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14223
x-xss-protection: 0
server: fife
etag: "v1e2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:51 GMT

GET
H3 200 6.png
1.bp.blogspot.com/-eHYA0rj-ubM/Yx3h12LCcHI/AAAAAAAAAbk/tt1h9dNkYzcMHofQ10ooPZBzk5jLSHVwACK4BGAYYCw/s220/ 21 KB
21 KB 33ms
33ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-eHYA0rj-ubM/Yx3h12LCcHI/AAAAAAAAAbk/tt1h9dNkYzcMHofQ10ooPZBzk5jLSHVwACK4BGAYYCw/s220/6.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

20b35cb1589e6e495df6489f97e3e79bb1f1cd9705d76e23cfa0c35a64b42697

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:55 GMT
x-content-type-options: nosniff
server: fife
etag: "v1f3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="6.png"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21963
x-xss-protection: 0
expires: Mon, 09 Oct 2023 11:06:55 GMT

GET
H3 200 12.png
2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/ 14 KB
15 KB 20ms
20ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/12.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

42f95ccca2e10b2785b171fcd0a92921c6bc6a4fdd9710e8e99238050c78166f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:52 GMT
x-content-type-options: nosniff
age: 3
content-disposition: inline;filename="12.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14846
x-xss-protection: 0
server: fife
etag: "v1f3"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:52 GMT

GET
H3 200 17.png
1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/ 14 KB
14 KB 24ms
24ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

c128cdac81f1dec27e63591edbb8cf60b473a7f873d632f4fce9e5db0b9937a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:51 GMT
x-content-type-options: nosniff
age: 4
content-disposition: inline;filename="17.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14223
x-xss-protection: 0
server: fife
etag: "v1e2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 09 Oct 2023 11:06:51 GMT

GET
H3 200 /
live-fb.bank-brinews.my.id/ 14 KB
14 KB 212ms
211ms Image
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live-fb.bank-brinews.my.id/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:56 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PUmX3ynEgvOg24kmG%2BhOX3GdUw5eyPInEK8JDgnNqVhzp1QbCUJ7ELMYpNmtw%2FuL9NJxUQT4tXWckYYcD4Qm2oKl8pboPStV%2FXIDjpYzWhzLE1fJlStG7MaQhI%2BsrO8sCNj6pCxrty5%2FN610yX%2FjVfkuGW69yXX3JA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 812dead3db6930db-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 cvj8rfO8RgU.png
static.xx.fbcdn.net/rsrc.php/v3/y3/r/ 3 KB
4 KB 60ms
19ms Image
image/png 2a03:2880:f084:d:face:b00c:0:3

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y3/r/cvj8rfO8RgU.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 -, , ASN (),

Reverse DNS

Software

Resource Hash

a58b811b01139f699ada37a6a9bcdb5d3767790d6acc66a709750891a20fc6ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://live-fb.bank-brinews.my.id/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 11:06:56 GMT
x-content-type-options: nosniff
content-md5: Pb0/E/1+Z4AC+9LUZbnB1A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3404
x-fb-debug: A90y1rtuDCDoe5IE8YQ11GT9Wy6GlvYMe1mmam8ejPwK2k/Z2IeHmNeLdfe7szbyfgjq0v99HWwSKzTtT9/SEw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/png
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 04 Oct 2024 04:51:11 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ambroseclover.com
URL: https://ambroseclover.com/id/6.mp4

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ambroseclover.com/id/6.mp4 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://unpkg.com/ajax-libs@9.0.1/jquery.min.js Message: Failed to load resource: the server responded with a status of 404 ()
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/12.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://1.bp.blogspot.com/-eHYA0rj-ubM/Yx3h12LCcHI/AAAAAAAAAbk/tt1h9dNkYzcMHofQ10ooPZBzk5jLSHVwACK4BGAYYCw/s220/6.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://2.bp.blogspot.com/-HHZgUcnZJew/Yx3iEdGBD1I/AAAAAAAAAcY/wgNlmvemL4c_4f4BBFW1SF5Rn2GFgQt2ACK4BGAYYCw/s220/12.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://live-fb.bank-brinews.my.id/ Message: Mixed Content: The page at 'https://live-fb.bank-brinews.my.id/' was loaded over HTTPS, but requested an insecure element 'http://1.bp.blogspot.com/-QHnuwphzlZ0/Yx3iVfkE0fI/AAAAAAAAAdQ/RKXIs4CmiYQc0iwW9u3Ajmxi4ab4befRgCK4BGAYYCw/s220/17.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
2.bp.blogspot.com
ambroseclover.com
i.ibb.co
live-fb.bank-brinews.my.id
static.xx.fbcdn.net
unpkg.com
ambroseclover.com
162.19.58.156
2606:4700::6810:7aaf
2a00:1450:4001:811::2001
2a03:2880:f084:d:face:b00c:0:3
2a06:98c1:3121::3
01de96097767803667b379b75c967fb1917eab1910a7a1e4288254930d992fae
18237e058013d98f6303b910c0c4c4ea92b66f56ea599f4ff4fad12e4ccc0f30
20b35cb1589e6e495df6489f97e3e79bb1f1cd9705d76e23cfa0c35a64b42697
42f95ccca2e10b2785b171fcd0a92921c6bc6a4fdd9710e8e99238050c78166f
7bb974b248e92e97f07d71ca6a78035dfae9d2d9a7e211b2dda3126b0910950c
a58b811b01139f699ada37a6a9bcdb5d3767790d6acc66a709750891a20fc6ba
c128cdac81f1dec27e63591edbb8cf60b473a7f873d632f4fce9e5db0b9937a9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa278887eda0d9b2b8a49360256edd6ef2aff8fd3d9088bd1a5ba1a6809f94db
fc678930e3ca735466aa83305290fc821faa5fe7480cbe08d99b060136514d39

live-fb.bank-brinews.my.id Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

80 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

185 kBTransfer

303 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

live-fb.bank-brinews.my.id Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

80 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

185 kB
Transfer

303 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!