musikman135-838a2.firebaseapp.com Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response musikman135-838a2.firebaseapp.com/	24 KB 13 KB	88ms 73ms	Document text/html	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2a456803c8d3142e4a985d3867b80979aa82e24f2ca39e54ad48c0bc26cd0d72 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 cache-control max-age=3600 content-encoding br content-length 12990 content-type text/html; charset=utf-8 date Sat, 03 Sep 2022 12:52:02 GMT etag "75b4a996dfc0e5b37f9d77571677498766731afc0758deed944e519a549fcb22-br" last-modified Thu, 30 Sep 2021 07:55:17 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding x-cache MISS x-cache-hits 0 x-served-by cache-tyo11977-TYO x-timer S1662209522.046883,VS0,VE68
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.0.3/	82 KB 29 KB	47ms 4ms	Script text/javascript	2404:6800:4004:80a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:80a::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers date Mon, 29 Aug 2022 13:13:50 GMT content-encoding gzip x-content-type-options nosniff age 430692 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29440 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Aug 2023 13:13:50 GMT
GET H2	403	loginAdvanced.css ia801406.us.archive.org/2/items/bottom_202004/	0 0	378ms 156ms	Stylesheet text/html	207.241.228.146 INTERNET-ARCHIVE
General Check archive.org Show headers Download Go to Full URL https://ia801406.us.archive.org/2/items/bottom_202004/loginAdvanced.css Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 207.241.228.146 , United States, ASN7941 (INTERNET-ARCHIVE, US), Reverse DNS ia801406.us.archive.org Software / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers
GET H2	403	top.png ia801406.us.archive.org/2/items/bottom_202004/	0 0	291ms 157ms	Image text/html	207.241.228.146 INTERNET-ARCHIVE
General Check archive.org Show headers Download Go to Show image Full URL https://ia801406.us.archive.org/2/items/bottom_202004/top.png Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 207.241.228.146 , United States, ASN7941 (INTERNET-ARCHIVE, US), Reverse DNS ia801406.us.archive.org Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers
GET H2	403	bottom.png ia801406.us.archive.org/2/items/bottom_202004/	0 0	146ms 146ms	Image text/html	207.241.228.146 INTERNET-ARCHIVE
General Check archive.org Show headers Download Go to Show image Full URL https://ia801406.us.archive.org/2/items/bottom_202004/bottom.png Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 207.241.228.146 , United States, ASN7941 (INTERNET-ARCHIVE, US), Reverse DNS ia801406.us.archive.org Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	2ms 2ms	Script text/javascript	2404:6800:4004:80a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:80a::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers date Sun, 28 Aug 2022 05:40:32 GMT content-encoding gzip x-content-type-options nosniff age 544290 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 28 Aug 2023 05:40:32 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	23ms 15ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: musikman135-838a2.firebaseapp.com URL: https://musikman135-838a2.firebaseapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://musikman135-838a2.firebaseapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers date Sat, 03 Sep 2022 12:52:02 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 753, 617, 617 age 5567998 cdn-cachedat 2021-06-19 03:25:59 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 091569a016b5cc61e090d5815e862673 cf-ray 744e9ec9ac1eaf91-NRT cdn-requestcountrycode AU cdn-requestpullsuccess True
GET DATA	200 OK	truncated /	10 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 99b5561cd177e23d6a81072c2e739d11e0e2f2c591a4a1483c6f15292cdec1ab Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36 Response headers Content-Type image/jpeg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| _0x8302 function| _0x4cdc string| hash function| kiol object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ia801406.us.archive.org/2/items/bottom_202004/loginAdvanced.css Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://ia801406.us.archive.org/2/items/bottom_202004/top.png Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://ia801406.us.archive.org/2/items/bottom_202004/bottom.png Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
ia801406.us.archive.org
musikman135-838a2.firebaseapp.com
stackpath.bootstrapcdn.com
207.241.228.146
2404:6800:4004:80a::200a
2606:4700::6812:bcf
2620:0:890::100
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2a456803c8d3142e4a985d3867b80979aa82e24f2ca39e54ad48c0bc26cd0d72
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
99b5561cd177e23d6a81072c2e739d11e0e2f2c591a4a1483c6f15292cdec1ab
a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855