zn5prp-5000.fc-eu-0.pitcher.csb.app Open in urlscan Pro
167.235.8.253  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response zn5prp-5000.fc-eu-0.pitcher.csb.app/	10 KB 3 KB	91ms 28ms	Document text/html	167.235.8.253 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.235.8.253 Bühl, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.253.8.235.167.clients.your-server.de Software / Resource Hash 631ad0e6f5fc193c16882f98c32ccc0a0ff188c29a9bbe86e2a226f7d3d23212 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-disposition inline; filename="index.html" content-encoding br content-type text/html; charset=utf-8 date Mon, 29 Jul 2024 19:07:01 GMT etag W/"63b37428e6f7645511ebf9a24bed8a5ddb9ac543" strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding Accept-Encoding
GET H2	404	style.css zn5prp-5000.fc-eu-0.pitcher.csb.app/	0 0	50ms 49ms	Stylesheet text/html	167.235.8.253 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://zn5prp-5000.fc-eu-0.pitcher.csb.app/style.css Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.235.8.253 Bühl, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.253.8.235.167.clients.your-server.de Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:01 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding content-type text/html; charset=utf-8
GET		search-icon-lob.png cdn.glitch.global/d08141de-e7af-45a5-916b-2f09d06ac286/	0 0
GET H2	200	Meta-Logo-1024x576.png.webp www.victoryxr.com/wp-content/uploads/2023/04/	40 KB 40 KB	396ms 110ms	Image image/webp	159.223.156.142 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.victoryxr.com/wp-content/uploads/2023/04/Meta-Logo-1024x576.png.webp Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 159.223.156.142 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS 701225.cloudwaysapps.com Software nginx / Resource Hash 19912bb93f0673dab6fa66a70ac82f385b9d82f767aabefd7fc7438a11943db2 Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:01 GMT last-modified Fri, 07 Apr 2023 18:50:37 GMT server nginx etag "643065fd-a0d2" content-type image/webp cache-control public, max-age=31536000 accept-ranges bytes content-length 41170
GET H2	200	979569a2dedd37573974ceebc05b4a4e.png i.pinimg.com/originals/97/95/69/	38 KB 38 KB	94ms 29ms	Image image/png	2a04:4e42:8e::84 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.pinimg.com/originals/97/95/69/979569a2dedd37573974ceebc05b4a4e.png Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:8e::84 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0141abddefa3eb01f495b0a24b07b3ce612a343ad28570f9c6d36509677363db Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:01 GMT x-cdn fastly etag "60ebd61593507e23f969e083ad2894fa" x-amz-server-side-encryption AES256 vary Origin content-type image/png cache-control max-age=31536000, immutable x-amz-replication-status COMPLETED accept-ranges bytes alt-svc h3=":443";ma=600 content-length 38965
GET H3	200	preview-protocol.js Show response codesandbox.io/p/	176 KB 56 KB	91ms 52ms	Script application/javascript	2606:4700:4400::ac40:9a6b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/p/preview-protocol.js Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:4400::ac40:9a6b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e5816a040f78bd21a0a149637977c04c952c491111c5dcbec993fa91b4cb566c Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:01 GMT via 1.1 google content-encoding br cf-cache-status HIT last-modified Wed, 24 Jul 2024 10:54:47 GMT server cloudflare age 430472 x-powered-by Express vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800, immutable cf-ray 8aaf63b47fc7bbf7-FRA alt-svc h3=":443"; ma=86400
GET H2	206	WhatsApp%20Video%202024-06-25%20at%2018.53.47_3093dc69.mp4 cdn.glitch.global/125da627-08ba-4e22-acf3-c75d7cbdc325/	129 KB 0	115ms 28ms	Media video/mp4	151.101.2.132 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.glitch.global/125da627-08ba-4e22-acf3-c75d7cbdc325/WhatsApp%20Video%202024-06-25%20at%2018.53.47_3093dc69.mp4?v=1719948585883 Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.132 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none' Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Range bytes=0- Response headers content-security-policy script-src 'none' via 1.1 varnish, 1.1 varnish date Mon, 29 Jul 2024 19:07:01 GMT x-amz-request-id 4FTECZ259QX4W93G age 1309127 x-amz-server-side-encryption AES256 x-cache HIT, HIT Content-Range bytes 0-5931423/5931424 Content-Length 5931424 x-amz-id-2 orPpegMkkEfuHXHcHWi7uJAjSz7Rw7bOD1shXAtlx2ggk0TBxJy/ZpAqIroMCVecAXYtH7PpHA0= x-served-by cache-iad-kiad7000163-IAD, cache-fra-etou8220108-FRA last-modified Tue, 02 Jul 2024 19:29:19 GMT server AmazonS3 x-timer S1722280021.248186,VS0,VE2 etag "08fbe52747d70f6c17cc0b2cc5a71f5f" access-control-allow-methods GET, HEAD, POST content-type video/mp4 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-cache-hits 3, 0
GET H2	404	script.js zn5prp-5000.fc-eu-0.pitcher.csb.app/	0 0	32ms 32ms	Script text/html	167.235.8.253 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://zn5prp-5000.fc-eu-0.pitcher.csb.app/script.js Requested by Host: zn5prp-5000.fc-eu-0.pitcher.csb.app URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.235.8.253 Bühl, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.253.8.235.167.clients.your-server.de Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:01 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding content-type text/html; charset=utf-8
GET DATA	200 OK	truncated /	547 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	552 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	380 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	177 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	351 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	242 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	zn5prp-5000 codesandbox.io/p/devtool/inline-preview/ Frame D84D	0 0	100ms 71ms	Document text/html	2606:4700:4400::6812:2195 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://codesandbox.io/p/devtool/inline-preview/zn5prp-5000 Requested by Host: codesandbox.io URL: https://codesandbox.io/p/preview-protocol.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:4400::6812:2195 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate cf-cache-status DYNAMIC cf-ray 8aaf63b56c1c1e5e-FRA content-encoding br content-type text/html; charset=utf-8 date Mon, 29 Jul 2024 19:07:01 GMT frame-ancestors 'self' https://zn5prp-5000.csb.app server cloudflare via 1.1 google x-powered-by Express
GET H2	404	Facebook_Logo_2023.png zn5prp-5000.fc-eu-0.pitcher.csb.app/	2 KB 934 B	28ms 27ms	Other text/html	167.235.8.253 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://zn5prp-5000.fc-eu-0.pitcher.csb.app/Facebook_Logo_2023.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 167.235.8.253 Bühl, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.253.8.235.167.clients.your-server.de Software / Resource Hash 8c45c679f40c3f81c111fbf2398d568189c3ab34d8a9704ad225cd8efe1b819f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://zn5prp-5000.fc-eu-0.pitcher.csb.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 29 Jul 2024 19:07:02 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding content-type text/html; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cdn.glitch.global

URL

https://cdn.glitch.global/d08141de-e7af-45a5-916b-2f09d06ac286/search-icon-lob.png?v=1712422050841

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __REACT_DEVTOOLS_GLOBAL_HOOK__ object| CODESANDBOX_PREVIEW object| __CSB_PREVIEW_PROTOCOL function| enableLocalhostProxy

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.codesandbox.io/	1969-12-31 23:59:59	Name: _cfuvid Value: YqjOMs3399yZEJwddcGd9nHAJuCPLAlBvMlpT35ZMWM-1722280021511-0.0.1.1-604800000
			.codesandbox.io/	1970-01-21 07:10:16	Name: cf_clearance Value: kCPp6V46ZM3a3aDYzMjUOMXXSXQ8nos25f3Z.TeUbwo-1722280022-1.0.1.1-RfADjbVGb.KqaqLMXbbNpQse79MG8Pb9e1bkPRyJ2boSUV97C24MLT_asTCcMmOqQwAXlz0RjZ56e60RuR4fxw

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/script.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/style.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://zn5prp-5000.fc-eu-0.pitcher.csb.app/Facebook_Logo_2023.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.glitch.global
codesandbox.io
i.pinimg.com
www.victoryxr.com
zn5prp-5000.fc-eu-0.pitcher.csb.app
cdn.glitch.global
151.101.2.132
159.223.156.142
167.235.8.253
2606:4700:4400::6812:2195
2606:4700:4400::ac40:9a6b
2a04:4e42:8e::84
0141abddefa3eb01f495b0a24b07b3ce612a343ad28570f9c6d36509677363db
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
19912bb93f0673dab6fa66a70ac82f385b9d82f767aabefd7fc7438a11943db2
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
631ad0e6f5fc193c16882f98c32ccc0a0ff188c29a9bbe86e2a226f7d3d23212
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
8c45c679f40c3f81c111fbf2398d568189c3ab34d8a9704ad225cd8efe1b819f
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
e5816a040f78bd21a0a149637977c04c952c491111c5dcbec993fa91b4cb566c
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366