urlscan.io logo urlscan.io
SecurityTrails logo

slow-zebra-many.on-fleek.app Open in urlscan Pro
104.26.13.141  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://slow-zebra-many.on-fleek.app/
Submission: On September 25 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 104.26.13.141, located in and belongs to CLOUDFLARENET, US. The main domain is slow-zebra-many.on-fleek.app.
TLS certificate: Issued by E6 on August 30th 2024. Valid for: 3 months.
This is the only time slow-zebra-many.on-fleek.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
4 104.26.13.141 13335 (CLOUDFLAR...)
1 101.50.113.147 23674 (NAYATEL-P...)
5 2
Apex Domain
Subdomains		 Transfer
4 on-fleek.app
slow-zebra-many.on-fleek.app
213 KB
1 fbcdn.net
scontent.fisb17-1.fna.fbcdn.net — Cisco Umbrella Rank: 704952
7 KB
5 2
Domain Requested by
4 slow-zebra-many.on-fleek.app slow-zebra-many.on-fleek.app
1 scontent.fisb17-1.fna.fbcdn.net
5 2

This site contains no links.

Subject Issuer Validity Valid
*.on-fleek.app
E6		 2024-08-30 -
2024-11-28		 3 months crt.sh
*.fisb17-1.fna.fbcdn.net
DigiCert SHA2 High Assurance Server CA		 2024-08-29 -
2024-11-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://slow-zebra-many.on-fleek.app/
Frame ID: 30B3EE5D0ABD9C368FCD06881C629CB8
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Blue check dropbox | Get a blue tick lifetime

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

220 kB
Transfer

542 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
slow-zebra-many.on-fleek.app/ 		703 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://slow-zebra-many.on-fleek.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad0eec98447e918f3f82678407edeb6fdc71c6526b2ce9c284348edc834471d4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
access-control-allow-methods
GET,HEAD,OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
access-control-max-age
86400
cache-control
max-age=60, stale-while-revalidate=3600
cf-cache-status
DYNAMIC
cf-ray
8c88b0bcaf27abbe-YYZ
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Wed, 25 Sep 2024 05:42:21 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F5l3z6PqDC1C%2Fo4AMzRrruiOWlpsawawVyG52HoPl93SEfa4pcyTwxyE6r29LmjlCi3c5zzRRndGrrjnc60Wap7vgmvk1G9eDhRG7TcPNv0sFP9PWIn9k90Wt%2BTV0Snw2WSWOjTdJR4Hf3x120A%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-cache-status
HIT
x-content-type-options
nosniff
x-ipfs-path
/ipfs/bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y/
x-ipfs-roots
bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y
x-request-id
4a75ae9a76ecd5d15df0130ac23decc3
x-xss-protection
0
main.42770e2e.js
slow-zebra-many.on-fleek.app/static/js/ 		192 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://slow-zebra-many.on-fleek.app/static/js/main.42770e2e.js
Requested by
Host: slow-zebra-many.on-fleek.app
URL: https://slow-zebra-many.on-fleek.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3615086890cda2b0c2ed166937c4fd4aab3b0f0388df69c4158542e18e141abf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://slow-zebra-many.on-fleek.app/

Response headers

access-control-max-age
86400
x-request-id
efce3697f1261ddb8ee88db6f173982b
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding
br
cf-cache-status
DYNAMIC
etag
W/"bafkreibwcuegregnukymf3iwne34j7kkvm5q6a4i35u4ifmfilqy4fa2x4"
x-ipfs-path
/ipfs/bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y/static/js/main.42770e2e.js/
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Km8SPdkW5zJhxRzdtGfo0mNMdRDdZ%2FJ09XNF6FGZ%2B6527xWb1cseaWE7tE9I0UxEAEaYo9gyGTKFY6Wj60F%2FklCB5VRM89BOf7nrBHKLKWPTZ2gpNfSk5CZYVmEk8HKqRqb26FOKnzd1ZsY8cZo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
date
Wed, 25 Sep 2024 05:42:21 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
x-ipfs-roots
bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y,bafybeib35gq2zygnyc2htg2vi2gceghoncnanpm35vlqlukm7k3phuhz34,bafybeiejensy5pkyxgyo7tbfqyrxojkgkhaftgdzf5shq5u6do2jopwxna,bafkreibwcuegregnukymf3iwne34j7kkvm5q6a4i35u4ifmfilqy4fa2x4
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
x-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
upgrade-insecure-requests
cache-control
max-age=60, stale-while-revalidate=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8c88b0bef842abbe-YYZ
access-control-allow-origin
*
x-xss-protection
0
server
cloudflare
main.162a7bf8.css
slow-zebra-many.on-fleek.app/static/css/ 		231 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://slow-zebra-many.on-fleek.app/static/css/main.162a7bf8.css
Requested by
Host: slow-zebra-many.on-fleek.app
URL: https://slow-zebra-many.on-fleek.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35f268dfd462e87bc7579b17908d0b8434c646ed45e023d7879d108bb0cc4ee4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://slow-zebra-many.on-fleek.app/

Response headers

access-control-max-age
86400
x-request-id
ce43ba558ec211f5b4df11f49a660e06
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding
br
cf-cache-status
DYNAMIC
etag
W/"bafkreibv6jun7vdc5b54ov43c6ii2c4egtden3kf4ar5pb45ccf3btco4q"
x-ipfs-path
/ipfs/bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y/static/css/main.162a7bf8.css/
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FSulMeZIe1nki66lyTMflSmme66bHn09NPjy343uvSQd8Loznr0Am%2B7ezjJ0u%2BUrmp3vEO%2BXVJkLA%2BXCrs0ALCPDVG5qpjcr1Avfh4BkYoumE1cAqdtG3wanOMnmVilVlLR%2BPZQ%2BWpIq5rlgzrk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
date
Wed, 25 Sep 2024 05:42:21 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
x-ipfs-roots
bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y,bafybeib35gq2zygnyc2htg2vi2gceghoncnanpm35vlqlukm7k3phuhz34,bafybeigcb32v23vpbvyhpkbnhwrutfqxrioeji4afmboyxdz6r3rd3sb6u,bafkreibv6jun7vdc5b54ov43c6ii2c4egtden3kf4ar5pb45ccf3btco4q
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
x-cache-status
MISS
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
upgrade-insecure-requests
cache-control
max-age=60, stale-while-revalidate=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8c88b0bef840abbe-YYZ
access-control-allow-origin
*
x-xss-protection
0
server
cloudflare
375593064_778731280602001_6601361369208148137_n.png
scontent.fisb17-1.fna.fbcdn.net/v/t39.8562-6/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://scontent.fisb17-1.fna.fbcdn.net/v/t39.8562-6/375593064_778731280602001_6601361369208148137_n.png?_nc_cat=106&ccb=1-7&_nc_sid=f537c7&_nc_ohc=lrvl310cH2QQ7kNvgF9N-8R&_nc_ht=scontent.fisb17-1.fna&_nc_gid=A8_TebTCrC10RN9ceDQMdrh&oh=00_AYBZyykYjrX-dCJc3GZm6bAclpAlkoOm9r074HZaC2j8jg&oe=66F3CA0B
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
101.50.113.147 Islamabad, Pakistan, ASN23674 (NAYATEL-PK Nayatel Pvt Ltd, PK),
Reverse DNS
Software
/
Resource Hash
6afa71ffe1c81cf6fc9580312d8543be200b24a6dbae24784617cb595117e092

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://slow-zebra-many.on-fleek.app/

Response headers

alt-svc
h3=":443"; ma=86400
date
Wed, 25 Sep 2024 05:42:22 GMT
last-modified
Thu, 07 Sep 2023 21:33:33 GMT
content-type
image/png
x-fb-ptm-uuid
3B49DD88AC5D4260034276785D8A9CA5
priority
u=1,i
cache-control
max-age=1209600, no-transform
timing-allow-origin
*
x-fb-connection-quality
MODERATE; q=0.3, rtt=253, rtx=0, c=24, mss=1232, tbw=8116, tp=12, tpl=0, uplat=0, ullat=-1
x-fb-congestion-signal
congestion-signal-v2:0;congestion-delay:154;congestion-delay-med:82;congestion-delay-mean:176;congestion-delay-stddev:369;total-samples:2019;dispersion-samples:320;num-congested-samples:0;num-single-packet-samples:0;
cross-origin-resource-policy
cross-origin
content-digest
adler32=2543240437
access-control-allow-origin
*
x-needle-checksum
2543240437
accept-ranges
bytes
content-length
6899
x-additional-error-detail
logo%20512.png
slow-zebra-many.on-fleek.app/ 		111 KB
113 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://slow-zebra-many.on-fleek.app/logo%20512.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5341e7bc11af3185c192ff627ea006dcc56dcdd7582fa71984f99b500ae0cd07
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://slow-zebra-many.on-fleek.app/

Response headers

access-control-max-age
86400
x-request-id
00dc9151f9c2e0ae4e832a0a5c39c70f
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cf-cache-status
DYNAMIC
etag
"bafkreictiht3yenpggc4dex7mj7kabw4yvw43v2yf6trtbhztniavygna4"
x-ipfs-path
/ipfs/bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y/logo 512.png/
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gSj56xelCGjXwR7icMrmKTdQJU0y1O9YZJcrnjTqi2H4T0yDV%2BNqOztMLkkOqjhKq%2F8Dg4l5pvPAkXpPHEfNO0R3bK74yfb3K0aHXp3MTZkKqT4PIVWf8PI2zdbc7N4ysdW9rNTVFxifj9hdVO8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
date
Wed, 25 Sep 2024 05:42:21 GMT
content-type
image/png
x-ipfs-roots
bafybeid56gyprwinyztb6hfh5nucra6ojs62f4hirebzbt4iu7yqkmdw6y,bafkreictiht3yenpggc4dex7mj7kabw4yvw43v2yf6trtbhztniavygna4
vary
Accept-Encoding
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
x-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
upgrade-insecure-requests
cache-control
max-age=60, stale-while-revalidate=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8c88b0c21a2dabbe-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
114114
x-xss-protection
0
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0