threadls.net Open in urlscan Pro
2606:4700:3032::ac43:de81 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://threadls.net/
Effective URL:
https://threadls.net/
Submission: On August 24 via manual (August 24th 2024, 8:34:16 am UTC) from ES — Scanned from ES

Summary HTTP 12 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3032::ac43:de81, located in United States and belongs to CLOUDFLARENET, US. The main domain is threadls.net.
TLS certificate: Issued by WE1 on August 22nd 2024. Valid for: 3 months.

This is the only time threadls.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	2606:4700:303... 2606:4700:3032::ac43:de81	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.67.222.129 172.67.222.129	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	157.240.0.63 157.240.0.63	32934 (FACEBOOK) (FACEBOOK)
12	4

6 2606:4700:3032::ac43:de81 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

threadls.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.67.222.129 (United States)

ASN13335 (CLOUDFLARENET, US)

threadls.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.240.0.63 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: instagram-p3-shv-02-fra3.fbcdn.net

static.cdninstagram.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	threadls.net 1 redirects threadls.net	70 KB
3	cdninstagram.com static.cdninstagram.com — Cisco Umbrella Rank: 3897	385 KB
12	2

	Domain	Requested by
10	threadls.net	1 redirects threadls.net
3	static.cdninstagram.com	threadls.net
12	2

This site contains links to these domains. Also see Links.

Domain
l.threads.net

Subject Issuer	Validity	Valid
threadls.net WE1	`2024-08-22` - `2024-11-20`	3 months	crt.sh
*.instagram.com DigiCert SHA2 High Assurance Server CA	`2024-06-02` - `2024-08-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://threadls.net/
Frame ID: 6170558C9EAE9EBC88B587D5921FE4A1
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threads

Page URL History Show full URLs

http://threadls.net/ HTTP 307
https://threadls.net/ Page URL
https://threadls.net/cdn-cgi/phish-bypass?atok=Fqs0a7sPqZzUk9ymnJAu5_Y9L7hIddzA0KB8QZyJdwk-172448... HTTP 301
https://threadls.net/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

454 kB
Transfer

1266 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://l.threads.net/?u=https%3A%2F%2Fwww.instagram.com%2Faccounts%2Fpassword%2Freset%2F&e=AT0ZJtk9Tq0EDz3dYS5puVsDkN1Lf-ikoODBhXmuIxiP_NabhnYuR_URICxyZaJvGR4-8Qw1FtaLW9d9DGj0OpXq5BVq1Kxn9Icg46z8VcMaW5Iwjw6_1lvOXWk
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://l.threads.net/?u=https%3A%2F%2Fhelp.instagram.com%2F769983657850450&e=AT0ZJtk9Tq0EDz3dYS5puVsDkN1Lf-ikoODBhXmuIxiP_NabhnYuR_URICxyZaJvGR4-8Qw1FtaLW9d9DGj0OpXq5BVq1Kxn9Icg46z8VcMaW5Iwjw6_1lvOXWk
Title: Threads Terms

Search URL Search Domain Scan URL

URL: https://l.threads.net/?u=https%3A%2F%2Fhelp.instagram.com%2F515230437301944&e=AT0ZJtk9Tq0EDz3dYS5puVsDkN1Lf-ikoODBhXmuIxiP_NabhnYuR_URICxyZaJvGR4-8Qw1FtaLW9d9DGj0OpXq5BVq1Kxn9Icg46z8VcMaW5Iwjw6_1lvOXWk
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://l.threads.net/?u=https%3A%2F%2Fhelp.instagram.com%2F1896641480634370%2F&e=AT0ZJtk9Tq0EDz3dYS5puVsDkN1Lf-ikoODBhXmuIxiP_NabhnYuR_URICxyZaJvGR4-8Qw1FtaLW9d9DGj0OpXq5BVq1Kxn9Icg46z8VcMaW5Iwjw6_1lvOXWk
Title: Cookies Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://threadls.net/ HTTP 307
https://threadls.net/ Page URL
https://threadls.net/cdn-cgi/phish-bypass?atok=Fqs0a7sPqZzUk9ymnJAu5_Y9L7hIddzA0KB8QZyJdwk-1724488447-0.0.1.1-%2F HTTP 301
https://threadls.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://threadls.net/ HTTP 307
https://threadls.net/

12 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
threadls.net/
Redirect Chain

http://threadls.net/
https://threadls.net/

4 KB
2 KB

139ms
41ms

Document
text/html

2606:4700:3032::ac43:de81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://threadls.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:de81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce70de496c5616addb4254e81ab26330881fac5676a7521c39eeffda29a44ebb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cf-ray: 8b820059ea62cc57-MAD
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 24 Aug 2024 08:34:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WnzU1cK%2BVquSjExFjZMX60f9ovBmA6hHpRmFDhogT25R85w1GTazMUhWO2WcEFQLtACz9L5aA7c0OkPOP9c9RJ2PP2Ab2ldHTKRrzi8bY0eIBtxOmUpNshqi7iYHQ%2F2vex2PMEWTADOZs0o%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Location: https://threadls.net/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 cf.errors.css
threadls.net/cdn-cgi/styles/ 23 KB
5 KB 37ms
37ms Stylesheet
text/css 2606:4700:3032::ac43:de81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://threadls.net/cdn-cgi/styles/cf.errors.css

Requested by

Host: threadls.net
URL: https://threadls.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:de81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 21 Aug 2024 12:07:35 GMT
server: cloudflare
etag: W/"66c5d887-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8b82005a3abdcc57-MAD
expires: Sat, 24 Aug 2024 10:34:07 GMT

GET
H2 200 icon-exclamation.png
threadls.net/cdn-cgi/images/ 452 B
541 B 37ms
37ms Image
image/png 2606:4700:3032::ac43:de81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threadls.net/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: threadls.net
URL: https://threadls.net/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:de81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://threadls.net/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:07 GMT
x-content-type-options: nosniff
last-modified: Wed, 21 Aug 2024 12:07:35 GMT
server: cloudflare
etag: "66c5d887-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8b82005a7b03cc57-MAD
content-length: 452
expires: Sat, 24 Aug 2024 10:34:07 GMT

GET
H2 404 favicon.ico
threadls.net/ 431 B
627 B 402ms
402ms Other
text/html 2606:4700:3032::ac43:de81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:de81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 270d2fb55aa801662897590a27ec1c152407fa36be1d6678c27fd8c1859239e4

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:07 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b2lbFdOc%2F24uUuLoVS%2FObmx%2F%2FswzCPjKHrZgA7iUgPm%2FYkzDIQSYHrLRa%2FOjJf98vIA0wNDvsu8YHKTHdsyf2rKMM0SYTmP34hzGAvdsDzRh0Hk9eVJs9l3we%2FLsEN0wwVKrILcFoT2snIY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html;charset=utf-8
content-language: en
cache-control: max-age=14400
cf-ray: 8b82005abb3fcc57-MAD
alt-svc: h3=":443"; ma=86400

GET
H2

200

Primary Request / Show response
threadls.net/
Redirect Chain

https://threadls.net/cdn-cgi/phish-bypass?atok=Fqs0a7sPqZzUk9ymnJAu5_Y9L7hIddzA0KB8QZyJdwk-1724488447-0.0.1.1-%2F
https://threadls.net/

221 KB
23 KB

500ms
500ms

Document
text/html

2606:4700:3032::ac43:de81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:de81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d62d63f845846ae91f79d89fa079e5cea71ed9e441861014099b76ac0e30d3ad

Request headers

Referer: https://threadls.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b820070ebc2cc57-MAD
content-encoding: br
content-language: es-ES
content-type: text/html
date: Sat, 24 Aug 2024 08:34:11 GMT
last-modified: Fri, 09 Aug 2024 19:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20tbhBAAWGiBweFEPbrzHYbuZV3s4iZ2gpCZEJwr1vlzdANKQ2npIpZ2kA9nENtXCgIEZcU%2FmzmbrYUSj8eXsya41lvMXO7LfRcj%2BIecMNlXzp0LkyIT2PJIKYbOT%2FTwBLeni%2BVS9AzblNQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

Redirect headers

cache-control: private, no-cache
cf-ray: 8b820070ab85cc57-MAD
content-length: 167
content-type: text/html
date: Sat, 24 Aug 2024 08:34:10 GMT
location: https://threadls.net/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 toastr.min.css
threadls.net/ 7 KB
3 KB 406ms
405ms Stylesheet
text/css 172.67.222.129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/toastr.min.css
Requested by: Host: threadls.net
URL: https://threadls.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d159adb573ca535b8275f1d27dc8d60fffd9678ee3b5f1a0f7b4be4a77342f

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 09 Aug 2024 19:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dzt12KikB4IoIF81eL2qlGtq5tHSLH7a%2FrGePEs%2FJYemiezGLbF2e%2FWowDaYnrmjL7kqUFkDDtRsUWanNvmWKQx6ahC6NcbAaLY4NbJ1HEn8b2LoZhIsmberzTc1ikg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 8b8200741ec765fb-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery-3.6.0.min.js Show response
threadls.net/ 87 KB
32 KB 394ms
393ms Script
application/javascript 172.67.222.129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/jquery-3.6.0.min.js
Requested by: Host: threadls.net
URL: https://threadls.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 09 Aug 2024 19:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NxfoSJdV1EQNObNXchTcYpSPkKAe9pjrkbllJiAGoz0OGfwShEc7MgGD%2Fx8QK3ucDz%2B3Oj%2BBajE195wPV97UBNG2Px%2ByWNtPZ9w7ndHuX%2B%2BV%2F0FqAbrALbf1WnMlKM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8b8200741ecb65fb-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 toastr.min.js Show response
threadls.net/ 5 KB
3 KB 374ms
373ms Script
application/javascript 172.67.222.129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/toastr.min.js
Requested by: Host: threadls.net
URL: https://threadls.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2bb0e8511764611ff0081b549ff188c326c7376bf86e28513782b0a48f9c7aa

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Fri, 09 Aug 2024 19:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJQQXpDNMfhmgIO6jp0saE1KoWPWYi2yK14FI%2Bho5SbeYcZE6FqUK6PnQ%2FtsGNTbFVPb8ptxEMNAjmyI7FeQqLEfIueJU8AT2i%2FKHlxbjUXq4zer5Pedt80yyhG20Bs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8b8200741ecc65fb-MAD
alt-svc: h3=":443"; ma=86400

GET
H3 200 0uMDhPjnWHc.css
static.cdninstagram.com/rsrc.php/v3/y-/l/0,cross/ 679 KB
152 KB 137ms
68ms Stylesheet
text/css 157.240.0.63
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.cdninstagram.com/rsrc.php/v3/y-/l/0,cross/0uMDhPjnWHc.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: threadls.net
URL: https://threadls.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.63 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

instagram-p3-shv-02-fra3.fbcdn.net

Software

Resource Hash

b2463d5770c7a7db14bd2845b5407c80486c55c67853cb4a513b061fafe02d08

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threadls.net/
Origin: https://threadls.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
content-encoding: zstd
x-content-type-options: nosniff
content-md5: 9Ox7C9HIwi4YqhPL3NTMkw==
document-policy: force-load-at-top
x-fb-server-load: 23
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 155833
reporting-endpoints: permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=33, mss=1232, tbw=4286, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: hIAM8MT7KRRWeXJq5dVCXSqtkxslM/6cDA7kcXmp9+u4wEG44lfTg8/ykVuYTFBypWBpd3CTHHYcq5UTpQ2fZg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=0
expires: Mon, 18 Aug 2025 07:13:04 GMT

GET
H3 200 JesX5Buw5jT.webp
static.cdninstagram.com/rsrc.php/yH/r/ 218 KB
218 KB 123ms
59ms Image
image/webp 157.240.0.63
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.cdninstagram.com/rsrc.php/yH/r/JesX5Buw5jT.webp

Requested by

Host: threadls.net
URL: https://threadls.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.63 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

instagram-p3-shv-02-fra3.fbcdn.net

Software

Resource Hash

550aac7c83b701ccf082cf62c76552da5e96db176816ee9c6ecec021155a2609

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
x-content-type-options: nosniff
content-md5: H/oj/LRUOAel/7+i6h6LcQ==
document-policy: force-load-at-top
x-fb-server-load: 40
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 222988
reporting-endpoints: permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=33, mss=1232, tbw=4320, tp=9, tpl=0, uplat=1, ullat=-1
x-fb-debug: HvkKLuuna0/XKo03OdW6Fzf0+YOeRLZUYcoKwcSMG6fXve0T2z1sYmxQQbnHqN7haaBcioPFkvzHgNqO/iAb/w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/webp
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=2,i
expires: Sun, 17 Aug 2025 02:14:58 GMT

GET
H3 200 ycDU0hw6KM.js Show response
threadls.net/ 2 KB
1 KB 402ms
402ms Script
application/javascript 172.67.222.129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://threadls.net/ycDU0hw6KM.js
Requested by: Host: threadls.net
URL: https://threadls.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cfdbe36c5c29beecac359178566b9e793b0d6fb18b9c97e4f38a58a6ba74107

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 09 Aug 2024 19:11:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=75BV1rVR7HQbOTPECpkhP1MOYalJkBIvPNL29kir1dN3i%2B%2FGqLPb%2FCjSE44hV2BEfHJc69JN75lny%2BKIR3KTKdEHToeoR%2FRqUHrdD6ppV%2FAMOQyXhKhYlY8Reecttw4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8b82007618f365fb-MAD
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated Show response
/ 422 B
0 Script
application/x-javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 79690b8ff5d31df844787e36d4048705a13bfd07f307e42e5087e235e3b16504

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ 273 B
0 Script
application/x-javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb444f64f35ab77c79e9b6a663814ca0e24b169ba92a2a3228bf7ec8aa801e58

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ 126 B
0 Script
application/x-javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41bf28018cbba9df7f9cd3c09452d8b3fa2a8690a381f787113e23fe19c83d2e

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ 961 B
0 Script
application/x-javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 548ba844583be9db2a87dfdfa9a3cc30f52aff0eb6d164c2eb280b5470ed44ad

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ 1 KB
0 Script
application/x-javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a83a319c6e7bf8171265e277fe99f6be0443ce609df2d76316d1f2de1bcdfaa2

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/x-javascript;charset=utf-8

GET
H3 200 lEu8iVizmNW.ico
static.cdninstagram.com/rsrc.php/ye/r/ 15 KB
15 KB 59ms
59ms Other
image/x-icon 157.240.0.63
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.cdninstagram.com/rsrc.php/ye/r/lEu8iVizmNW.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.63 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

instagram-p3-shv-02-fra3.fbcdn.net

Software

Resource Hash

d13a843fbafb014cb0b118e24ae2d4a2217fe7aab411086da147020423458340

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threadls.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 24 Aug 2024 08:34:11 GMT
x-content-type-options: nosniff
content-md5: BCv7o/+94tmqOSUcziRRMw==
document-policy: force-load-at-top
x-fb-server-load: 30
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 15086
reporting-endpoints: permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=60, rtx=0, c=219, mss=1232, tbw=233536, tp=199, tpl=0, uplat=0, ullat=-1
x-fb-debug: 3qxLWBudsJYMDYoO5By9a1OopxNV9eFKWnfRqExpbQ2Mgk0Ff5c0FlchaNHSttOyA8j56T35bvaIZc+XcMpt9g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/x-icon
access-control-allow-origin: *
origin-agent-cluster: ?1
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=1,i
expires: Sat, 16 Aug 2025 02:01:37 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.threadls.net/	1970-01-20 23:02:54	Name: __cf_mw_byp Value: Fqs0a7sPqZzUk9ymnJAu5_Y9L7hIddzA0KB8QZyJdwk-1724488447-0.0.1.1-/

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://threadls.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.cdninstagram.com
threadls.net
157.240.0.63
172.67.222.129
2606:4700:3032::ac43:de81
10d159adb573ca535b8275f1d27dc8d60fffd9678ee3b5f1a0f7b4be4a77342f
270d2fb55aa801662897590a27ec1c152407fa36be1d6678c27fd8c1859239e4
3cfdbe36c5c29beecac359178566b9e793b0d6fb18b9c97e4f38a58a6ba74107
41bf28018cbba9df7f9cd3c09452d8b3fa2a8690a381f787113e23fe19c83d2e
548ba844583be9db2a87dfdfa9a3cc30f52aff0eb6d164c2eb280b5470ed44ad
550aac7c83b701ccf082cf62c76552da5e96db176816ee9c6ecec021155a2609
79690b8ff5d31df844787e36d4048705a13bfd07f307e42e5087e235e3b16504
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
a83a319c6e7bf8171265e277fe99f6be0443ce609df2d76316d1f2de1bcdfaa2
b2463d5770c7a7db14bd2845b5407c80486c55c67853cb4a513b061fafe02d08
ce70de496c5616addb4254e81ab26330881fac5676a7521c39eeffda29a44ebb
d13a843fbafb014cb0b118e24ae2d4a2217fe7aab411086da147020423458340
d62d63f845846ae91f79d89fa079e5cea71ed9e441861014099b76ac0e30d3ad
eb444f64f35ab77c79e9b6a663814ca0e24b169ba92a2a3228bf7ec8aa801e58
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f2bb0e8511764611ff0081b549ff188c326c7376bf86e28513782b0a48f9c7aa
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

threadls.net Open in urlscan Pro 2606:4700:3032::ac43:de81 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

4 IPs

2 Countries

454 kBTransfer

1266 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

threadls.net Open in urlscan Pro
2606:4700:3032::ac43:de81 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

454 kB
Transfer

1266 kB
Size

1
Cookies

12 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!