urlscan.io logo urlscan.io
SecurityTrails logo

zm1e7.csb.app Open in urlscan Pro
2606:4700::6812:1a72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://zm1e7.csb.app/
Effective URL: https://zm1e7.csb.app/
Submission: On February 28 via manual from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2606:4700::6812:1a72, located in United States and belongs to CLOUDFLARENET, US. The main domain is zm1e7.csb.app.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 14th 2020. Valid for: a year.
This is the only time zm1e7.csb.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 77.73.70.76 43317 (FISHNET-AS)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 1 67.202.94.94 32748 (STEADFAST)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
5 5
1    2606:4700::6812:1a72 (United States)

ASN13335 (CLOUDFLARENET, US)
zm1e7.csb.app
2    77.73.70.76 (St Petersburg, Russian Federation)

ASN43317 (FISHNET-AS, RU)
mixdrink.workingpronton.com
1    2a02:26f0:6c00:2a0::13b2 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
mondrian.mashable.com
1    67.202.94.94 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
1    2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)
widgets.amung.us
Domain Requested by
2 mixdrink.workingpronton.com zm1e7.csb.app
1 widgets.amung.us
1 whos.amung.us 1 redirects
1 mondrian.mashable.com
1 zm1e7.csb.app
5 5

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-06-14 -
2021-06-14		 a year crt.sh
mixdrink.workingpronton.com
R3		 2021-01-21 -
2021-04-21		 3 months crt.sh
ziffdavis.com
DigiCert SHA2 Secure Server CA		 2021-01-09 -
2022-01-13		 a year crt.sh
whos.amung.us
Sectigo RSA Domain Validation Secure Server CA		 2020-05-21 -
2022-05-21		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://zm1e7.csb.app/
Frame ID: FB1878EFE99392C1AFCD602DC75C970F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://zm1e7.csb.app/ HTTP 307
    https://zm1e7.csb.app/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • headers via /^1\.1 google$/i

Page Statistics

5
Requests

100 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

22 kB
Transfer

29 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://zm1e7.csb.app/ HTTP 307
    https://zm1e7.csb.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://whos.amung.us/widget/benditos0206 HTTP 307
  • https://widgets.amung.us/classic/00/22.png

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
zm1e7.csb.app/
Redirect Chain
  • http://zm1e7.csb.app/
  • https://zm1e7.csb.app/
137 B
638 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zm1e7.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1a72 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d442e2db307cd0e0d0848acbd355e0091b2fd2b4b1a667cf592fdb21d8c69bc

Request headers

:method
GET
:authority
zm1e7.csb.app
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 28 Feb 2021 22:33:01 GMT
content-type
text/html
set-cookie
__cfduid=d24c0e6f5904ed947487b9bdc7091c7821614551581; expires=Tue, 30-Mar-21 22:33:01 GMT; path=/; domain=.csb.app; HttpOnly; SameSite=Lax signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly
vary
Accept-Encoding
cache-control
private, max-age=0, no-cache, no-store
x-request-id
FmgKG9d6_IV5b-UIPVMD
via
1.1 google
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-request-id
088c5f199a0000c2c7f4270000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
628d9ad5cf76c2c7-FRA
content-encoding
br

Redirect headers

Location
https://zm1e7.csb.app/
Non-Authoritative-Reason
HSTS
/
mixdrink.workingpronton.com/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2
Requested by
Host: zm1e7.csb.app
URL: https://zm1e7.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.73.70.76 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),
Reverse DNS
Software
/
Resource Hash
83740d694e0aad65d4bcad58c20510f2920feae44d731813d57e554cc21d827f

Request headers

Referer
https://zm1e7.csb.app/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 28 Feb 2021 22:33:01 GMT
content-encoding
br
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-store, no-cache, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length
4835
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
mixdrink.workingpronton.com/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://mixdrink.workingpronton.com/location
Requested by
Host: zm1e7.csb.app
URL: https://zm1e7.csb.app/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
77.73.70.76 St Petersburg, Russian Federation, ASN43317 (FISHNET-AS, RU),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://zm1e7.csb.app/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
uploads%252Fcard%252Fimage%252F1536412%252Fc570cb39-478c-43ff-9bda-c42e3e44cee1.jpg%252F950x534__filters%253Aquality%252880%2529.jpg
mondrian.mashable.com/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mondrian.mashable.com/uploads%252Fcard%252Fimage%252F1536412%252Fc570cb39-478c-43ff-9bda-c42e3e44cee1.jpg%252F950x534__filters%253Aquality%252880%2529.jpg?signature=r1mS9yf0mZgS8XTDMG7DcnJrnz0=&source=https%3A%2F%2Fblueprint-api-production.s3.amazonaws.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:2a0::13b2 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
47b5013437430d4bd269e3e6be1e7ea7100bd432d9b997fe816fdf7239ec61ee

Request headers

Referer
https://zm1e7.csb.app/WACTH-VIDEO-194.99.105.99
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
34k5rOsAbGdKO3q_wps2Oc30eN_s49Gk
last-modified
Wed, 14 Oct 2020 08:34:03 GMT
x-amz-cf-pop
FRA6-C1
etag
"36405dec8c006149cdf289cef11a450f"
content-type
image/jpeg
cache-control
max-age=2592000
date
Sun, 28 Feb 2021 22:33:01 GMT
content-length
14352
x-amz-cf-id
tGEzaO8dX62o6BPj3dnpOKemagw-s_bZe2KRtcKkwnKbgdsuPbXuVQ==
expires
Tue, 30 Mar 2021 22:33:01 GMT
truncated
/ 		954 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cae74ee5bad20861dee4906df15d793b948297238f4da81c1b0d7adf3d25f38

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
22.png
widgets.amung.us/classic/00/
Redirect Chain
  • https://whos.amung.us/widget/benditos0206
  • https://widgets.amung.us/classic/00/22.png
1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.amung.us/classic/00/22.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
661eb5c0d17e6f1af15becbb1a925e2a53447d3555bc265324b311a936b20a41

Request headers

Referer
https://zm1e7.csb.app/WACTH-VIDEO-194.99.105.99
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 28 Feb 2021 22:33:02 GMT
cf-cache-status
HIT
age
136705
content-length
1390
cf-request-id
088c5f1f430000e003692ae000000001
last-modified
Sun, 13 Jun 2010 09:03:09 GMT
server
cloudflare
etag
"4c149ecd-56e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=432000
accept-ranges
bytes
cf-ray
628d9adedb54e003-FRA
expires
Sun, 28 Feb 2021 08:34:37 GMT

Redirect headers

location
https://widgets.amung.us/classic/00/22.png
date
Sun, 28 Feb 2021 22:33:02 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| __updateOrientation

1 Cookies

Domain/Path Name / Value
.csb.app/ Name: __cfduid
Value: d24c0e6f5904ed947487b9bdc7091c7821614551581

8 Console Messages

Source Level URL
Text
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]
console-api log URL: https://mixdrink.workingpronton.com/?api=1&lan=facebookmessenger&ht=2(Line 71)
Message:
[object HTMLScriptElement]