one-song.us Open in urlscan Pro
2606:4700:3035::6815:4652 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://one-song.us/
Submission Tags: @phish_report
Submission: On January 14 via api (January 14th 2024, 8:38:00 am UTC) from FI — Scanned from NZ

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::6815:4652, located in United States and belongs to CLOUDFLARENET, US. The main domain is one-song.us.

This is the only time one-song.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3035::6815:4652	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1415:200... 2600:1415:2000::17ca:e660	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2606:4700:e4:... 2606:4700:e4::ac40:a507	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	5

3 2606:4700:3035::6815:4652 (United States)

ASN13335 (CLOUDFLARENET, US)

one-song.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1415:2000::17ca:e660 (Sydney, Australia)

ASN20940 (AKAMAI-ASN1, NL)

i.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:e4::ac40:a507 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1448 ka-f.fontawesome.com — Cisco Umbrella Rank: 3140	303 KB
3	one-song.us one-song.us	4 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 324	54 KB
1	pinimg.com i.pinimg.com — Cisco Umbrella Rank: 2039	64 KB
13	4

	Domain	Requested by
6	ka-f.fontawesome.com	kit.fontawesome.com one-song.us
3	one-song.us	one-song.us
2	cdn.jsdelivr.net	one-song.us
1	i.pinimg.com	one-song.us
1	kit.fontawesome.com	one-song.us
13	5

This site contains no links.

Subject Issuer	Validity	Valid
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
i2.pinimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-03` - `2024-05-15`	a year	crt.sh
ka-f.fontawesome.com GTS CA 1P5	`2024-01-06` - `2024-04-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://one-song.us/
Frame ID: 0C74961EE95DC0EEC84EC510A7C57B75
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

prise en charge de la vérification

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

13
Requests

77 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

426 kB
Transfer

750 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
one-song.us/ 4 KB
2 KB 746ms
639ms Document
text/html 2606:4700:3035::6815:4652
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://one-song.us/
Protocol: HTTP/1.1
Server: 2606:4700:3035::6815:4652 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.12 ASP.NET
Resource Hash: a890e5d6884a5c1f95cadf601357c51336409152e7d5ebdb72a9196f4bc41e1a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1
accept-language: en-NZ,en;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 84548f431c0350a4-AKL
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 14 Jan 2024 08:37:54 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DlgDuccjLzXL6N6ooZpqcAgXHY71j%2F96YG6jEg6g5CQiLH0SL2G%2F1lMlgUym%2F4v6f24oo%2BhCxvJUuMF5tr40UQo8pVyWBp%2BiDMte6uWaCaPrr8q8n6Bn602gS%2BV4VJJHEGyfK679kP4AKw%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.12 ASP.NET
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK main.css
one-song.us/ 4 KB
2 KB 712ms
711ms Stylesheet
text/css 2606:4700:3035::6815:4652
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://one-song.us/main.css
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: HTTP/1.1
Server: 2606:4700:3035::6815:4652 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 62fd6a073d4f776ee1dc64d7495a7782aab4d79686546fef9ae4c53b7879dcf2

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 14 Jan 2024 08:37:55 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Powered-By: ASP.NET
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 1425
Last-Modified: Sun, 30 Oct 2022 11:49:38 GMT
Server: cloudflare
ETag: "0f533b055ecd81:0"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q4Et5gX5tsN8BLCSi9aJ18soPFl%2FwzOLBv%2BuNXE6qn5Y31PkxDgshIq6lycaPqJK6JqIWVOX3KyR6mcIdFtPDodkxmuRWdQCelWgOLfbPKEzqKjL61eWYMcx0iH%2FBcLIvEBC2c5eYTApTw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=31536000
Accept-Ranges: bytes
CF-RAY: 84548f471a2650a4-AKL

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/ 190 KB
30 KB 110ms
36ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/css/bootstrap.min.css

Requested by

Host: one-song.us
URL: http://one-song.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ed959b654022f7bae48ab9380dc129e065833e45a944c70d684c971ac3578cb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://one-song.us/
Origin: http://one-song.us
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 14 Jan 2024 08:37:54 GMT
x-content-type-options: nosniff
content-encoding: br
age: 26336289
x-jsd-version: 5.2.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 30275
x-served-by: cache-fra-eddf8230090-FRA, cache-akl10332-AKL
x-jsd-version-type: version
etag: W/"2f88b-Yz6bIW1g1A6raHMXUTTpNbVU+JE"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/ 78 KB
24 KB 110ms
35ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/bootstrap.bundle.min.js

Requested by

Host: one-song.us
URL: http://one-song.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c0c09020adb6f602b16d48374166b9e38ca92383a81650b6a9097c43cc43f31f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://one-song.us/
Origin: http://one-song.us
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 14 Jan 2024 08:37:54 GMT
x-content-type-options: nosniff
content-encoding: br
age: 26336289
x-jsd-version: 5.2.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 24474
x-served-by: cache-fra-eddf8230139-FRA, cache-akl10332-AKL
x-jsd-version-type: version
etag: W/"137ae-xmO6oFGFa2TXRmKalh4ju/D7r4w"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 5956274f26.js Show response
kit.fontawesome.com/ 12 KB
5 KB 375ms
301ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/5956274f26.js
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2446965032b4345266ed9f9a72ecd4f0a2580dd6137728e86261c7fd3bb85de3

Request headers

Referer: http://one-song.us/
Origin: http://one-song.us
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:54 GMT
content-encoding: gzip
cf-cache-status: MISS
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 84548f478a4a1c4e-AKL
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F6op5YKVjiy7d0KtVEwB

GET
H2 200 1fdeb298a142622757c65fbf7f351f35.png
i.pinimg.com/originals/1f/de/b2/ 64 KB
64 KB 1077ms
366ms Image
image/png 2600:1415:2000::17ca:e660
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.pinimg.com/originals/1f/de/b2/1fdeb298a142622757c65fbf7f351f35.png
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1415:2000::17ca:e660 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2f37c0e69ae96be64b37667de491c1459fd47a218861cb44b7b806fe7015e9c5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

x-cdn: akamai
akamai-grn: 0.5ce6ca17.1705221475.15a99c1b
etag: "5ce352b3ba24505577d6adb832151097"
x-amz-server-side-encryption: AES256
vary: Origin
content-type: image/png
cache-control: immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 65637

GET
H/1.1 404
Not Found app.js
one-song.us/js/ 0
0 731ms
697ms Script
text/html 2606:4700:3035::6815:4652
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://one-song.us/js/app.js
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: HTTP/1.1
Server: 2606:4700:3035::6815:4652 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

Date: Sun, 14 Jan 2024 08:37:55 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8osPxgWYAHkHQ%2Fmd6i4c5Yn16tU4pFEaYXyhz7UpLdbUKSwFHIQqmRcw79W%2FeaNsTj38GEK%2BGjAbcN8rzMchM9MBNM7V7jJXUkMcWjf%2FphO6Stz8nVbs0wc9saNaZptihuOwd5rNx5eeow%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/html
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 84548f47493c1c4c-AKL
alt-svc: h3=":443"; ma=86400

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 101 KB
24 KB 513ms
177ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free.min.css?token=5956274f26
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/5956274f26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2bfe99e2e78f71c88eb00c49e1392a15531fb6486d0d0c2ea71937dda34deab

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 fe1f71a38555d37376d318601a210ec4.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:52 GMT
server: cloudflare
etag: W/"edc53d8d44037708e54122b9e30bb2a1"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IFDFS3oFJJjEHfIDC8w%2F%2F6ZM3rd5KwLUaQh1zq1ZVZw%2FmysjGwIuxMMnGFv0u1zitl%2FGNQBgB%2BROIRaW6Ca5IUD5NXsQ6eN1DnzfOVpbnmmv6kIGqjVBedobGpSC9mZH3jx8sWMXEbXgvFS8URNC2b6QOA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84548f4e0d785ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 1mpKo9WAHfLfSEI8yaeq87YrJRUGZr3NsOettGHnnH6J99Eq8ghChA==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 27 KB
5 KB 547ms
210ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v4-shims.min.css?token=5956274f26
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/5956274f26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5031c11dd77875afefe4eeddfaa320af07fdccea327f7416a5ee8980674c9c76

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 386a6404e8fa2e50e2a13baba0abed68.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"604d6da359831b0dc67e0f522f1ff94d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1pqr4tr0J8NKF4BuiTzKxTkWZk4ZodgRh1DjTJ%2FamElwqhWcHwtMEyuLodMfGljWAOZSs2mJVElNo1tRLBaI0SVGaIjKf1oRPJgxGMiGD11flkrRqsQuOFZA625DFPmMog680H5jn6a5nUa5cvPxAk7oWA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84548f4e0d7d5ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: K-d8JqLCSDOIoeX4CegkV4ZA5Nap_cLDaOidsWI035n3vLpQux53cQ==

GET
H2 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 823 B
723 B 546ms
210ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v5-font-face.min.css?token=5956274f26
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/5956274f26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f581083ac72ae169a698cd0cb7f02d8bb2e079844bfad68cc98df5b3c4692408

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 c32320ec66084fc36ce5afbb4359a2c4.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"496965a55b1faa4d5c41073ef276afc0"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W56EH0Qb8h3Fs0ksFTp0x3eZomL%2FlybMdz6y1VYSDuBxg7qZOgItflpnBeL%2BMd0n8%2FN02TikC7bn5QpXTQPy3q94BiEK1YFVV%2FILpXAh%2BaM4Zu1pfRWayECMNpqvTt0oCydxyo8599LHQ3dWIZCkCZLXnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84548f4e0d7e5ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: NZH47ThClXzAFUP2XAVT6vi0-OwGgPddFWT_91ktenYFiNkzo6w_oQ==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.5.1/css/ 2 KB
1 KB 543ms
207ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/css/free-v4-font-face.min.css?token=5956274f26
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/5956274f26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6530f32fa70a330cd76547497f20048ae081dcc897af26befc84600357ba06be

Request headers

accept-language: en-NZ,en;q=0.9
Referer: http://one-song.us/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 e0a25dd43c42c3d534f35d394e12b204.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 30 Nov 2023 17:25:51 GMT
server: cloudflare
etag: W/"cc84affe95dbdd9726525f57d20b4ea6"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1UN12P4yQ73%2F4r%2Fkf9z1hGsiImsYWvi4%2BhT%2BZ0Ji4kzHVUSE%2BCL7ampBSNb2YPfOEZxvGTwKLw96llfLHDPwGM8P0LZ%2FOWV3er3qHRRalQIVy5%2FZqH3iuK%2B5t6xDVRLYDR541c1v1k%2BxqCi1MiXQ7Gz%2F6g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 84548f4e0d7a5ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: reC67uUoawh8fuOP52yLtWLmIwOqbogda1tqSooS8v5tO-RFzlDIYg==

GET
H2 200 free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.5.1/webfonts/ 153 KB
153 KB 171ms
170ms Font
font/woff2 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/webfonts/free-fa-solid-900.woff2
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368

Request headers

Referer: http://one-song.us/
Origin: http://one-song.us
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 574188a928e9091a61842b1bf8314b56.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 156504
last-modified: Thu, 30 Nov 2023 17:53:29 GMT
server: cloudflare
etag: "98ff5c340b38803d09d3f22fd9a00501"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0uRULBYXlr0SJdZdEnysFkTcq7VK1CAegs%2FVWJRvaKiBdzV%2BGQIWLzs8PSOgIH2g5u7ooKclUbECNJyLPnAZP0ivo1pGg1yyV%2BUyxmqsJscb8DJqvRTBTBQvi%2FkUFzLaa4%2FNLyQXGUryKVGxMTl7pbGlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 84548f4f7fbd5ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 4NdcQDWaBJhyMAOEqGzAcD8TkBHcaqDKpUwHbF-2awGQ7HcmBKyoCQ==

GET
H2 200 free-fa-brands-400.woff2
ka-f.fontawesome.com/releases/v6.5.1/webfonts/ 115 KB
115 KB 242ms
242ms Font
font/woff2 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.5.1/webfonts/free-fa-brands-400.woff2
Requested by: Host: one-song.us
URL: http://one-song.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58522c58cbb9b2231026ce7d65096807a3f97fffaf22cea6fb180590286fa53d

Request headers

Referer: http://one-song.us/
Origin: http://one-song.us
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jan 2024 08:37:55 GMT
via: 1.1 d5f29441dead372cd342d7cb881976ce.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: SIN52-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 117376
last-modified: Thu, 30 Nov 2023 17:53:29 GMT
server: cloudflare
etag: "7d46df6bf5bc9cd2a8992bb4f275ad45"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sqp%2FW9awSFzh7ttYM3K8ngkdUVVaIKqtNVSmrk42K5BrmdkZqsyc9Zv7jCmgc8rxbAEP5AV9HLEZ2Hz2pFKD%2Ff1IuK9gbDA86N6RwyLPNYlOnwdSVNAlC44CI6bmNn8suoHbrRsX9O8zizEGw%2F%2FQ2z9c1g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 84548f4f7fc15ff7-SIN
access-control-allow-headers: fa-kit-token
x-amz-cf-id: BgbT_byr9QVCHFDnWon0U5sn88WsRLK9Qu20jXDB_2cBRdfGdoZpoA==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap object| FontAwesomeKitConfig

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://one-song.us/js/app.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
i.pinimg.com
ka-f.fontawesome.com
kit.fontawesome.com
one-song.us
2600:1415:2000::17ca:e660
2606:4700:3035::6815:4652
2606:4700:4400::ac40:93bc
2606:4700:e4::ac40:a507
2a04:4e42::485
2446965032b4345266ed9f9a72ecd4f0a2580dd6137728e86261c7fd3bb85de3
2f37c0e69ae96be64b37667de491c1459fd47a218861cb44b7b806fe7015e9c5
5031c11dd77875afefe4eeddfaa320af07fdccea327f7416a5ee8980674c9c76
58522c58cbb9b2231026ce7d65096807a3f97fffaf22cea6fb180590286fa53d
62fd6a073d4f776ee1dc64d7495a7782aab4d79686546fef9ae4c53b7879dcf2
6530f32fa70a330cd76547497f20048ae081dcc897af26befc84600357ba06be
a890e5d6884a5c1f95cadf601357c51336409152e7d5ebdb72a9196f4bc41e1a
a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368
b2bfe99e2e78f71c88eb00c49e1392a15531fb6486d0d0c2ea71937dda34deab
c0c09020adb6f602b16d48374166b9e38ca92383a81650b6a9097c43cc43f31f
ed959b654022f7bae48ab9380dc129e065833e45a944c70d684c971ac3578cb8
f581083ac72ae169a698cd0cb7f02d8bb2e079844bfad68cc98df5b3c4692408

one-song.us Open in urlscan Pro 2606:4700:3035::6815:4652 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

77 %HTTPS

100 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

426 kBTransfer

750 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

one-song.us Open in urlscan Pro
2606:4700:3035::6815:4652 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

77 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

426 kB
Transfer

750 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!