00024598745679.my.id Open in urlscan Pro
2606:4700:3034::ac43:94d6 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd...
Submission Tags: @phish_report
Submission: On October 05 via api (October 5th 2024, 1:20:49 am UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3034::ac43:94d6, located in United States and belongs to CLOUDFLARENET, US. The main domain is 00024598745679.my.id.
TLS certificate: Issued by WE1 on October 4th 2024. Valid for: 3 months.

This is the only time 00024598745679.my.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3034::ac43:94d6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.70.233 172.67.70.233	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.148.214 172.67.148.214	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	4

4 2606:4700:3034::ac43:94d6 (United States)

ASN13335 (CLOUDFLARENET, US)

00024598745679.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.70.233 (United States)

ASN13335 (CLOUDFLARENET, US)

get.geojs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.148.214 (United States)

ASN13335 (CLOUDFLARENET, US)

00024598745679.my.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	00024598745679.my.id 00024598745679.my.id	206 KB
2	geojs.io get.geojs.io — Cisco Umbrella Rank: 18160	2 KB
8	2

	Domain	Requested by
5	00024598745679.my.id	00024598745679.my.id
2	get.geojs.io	00024598745679.my.id
8	2

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
00024598745679.my.id WE1	`2024-10-04` - `2025-01-02`	3 months	crt.sh
geojs.io WE1	`2024-09-04` - `2024-12-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw
Frame ID: 62998E3CB2AC7AB992D1BC4902AA3C3A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Business Help Center

Page Statistics

8
Requests

88 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

1
Countries

207 kB
Transfer

655 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/help/582999911881572
Title: More information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request live Show response
00024598745679.my.id/ 68 KB
4 KB 1954ms
1800ms Document
text/html 2606:4700:3034::ac43:94d6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:94d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d619e2ab105f603128da473ebaceda7378e3c642bf9c33ffcc7283713c4cc0f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8cd9972a69a5b50f-OSL
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 05 Oct 2024 01:20:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iViE7%2BGYqx3NvMDES1i0g5YrFuVoIr0%2Bi0PvQP%2FeO320dH2mE%2Br1d0C17Us56wqd30rIV6eMuvpxpKABZdKgCnYag%2BuFwsWLnBwYsUWR%2Blm14YxMPnqAj5KWDws%2B0cQYPiQRKwUTnLHSLm%2F4L72Y6%2FpyEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: accept-encoding

GET
H2 200 speculation
00024598745679.my.id/cdn-cgi/ 128 B
484 B 70ms
69ms Other
application/speculationrules+json 2606:4700:3034::ac43:94d6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://00024598745679.my.id/cdn-cgi/speculation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:94d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://00024598745679.my.id
Referer: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y4PEJYMjjspmVl%2BAjRELkRQE7pETb%2BhvSJa93h5DtBoZSBubHIfjphPBb9Hsim%2FaFvG2IJFMG5fwRwNwaJYO0TrN%2Fv3C8wREFFr6uSYnEeaVm5LY1DI1ngrrjq54IVRoYmDbudXH8XohT47sVtcxZ6B5Tw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd99735bee7b50f-OSL
access-control-allow-origin: https://00024598745679.my.id
content-length: 128
date: Sat, 05 Oct 2024 01:20:41 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 index-CrLzl8BS.js Show response
00024598745679.my.id/assets/ 512 KB
172 KB 2817ms
2816ms Script
application/javascript 2606:4700:3034::ac43:94d6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://00024598745679.my.id/assets/index-CrLzl8BS.js
Requested by: Host: 00024598745679.my.id
URL: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:94d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60d158601ec00b2ea05d134f6c6ca6fd665646c310ae4627cf0c624f13fefd0f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://00024598745679.my.id
Referer: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw

Response headers

server: cloudflare
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
etag: W/"1727977159.8838763-524506-3945467084"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cryONa3JBTtdjoG1gmhTfCEgmuAE2oRP2hqAOJaGqPoKDGJfH35Ews6T2XLN6eJV%2FTVEAECV3Y6FkNw%2Flfzc8QY1%2BMgf1IyjJA2X4Ps5XMG3j86AKLlFQOCf%2FgDeHO5ISe9cEZj5SAnCeeIk1hoUFtO61Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd99735ff18b50f-OSL
access-control-allow-origin: https://00024598745679.my.id
date: Sat, 05 Oct 2024 01:20:44 GMT
content-type: application/javascript; charset=utf-8
content-disposition: inline; filename=index-CrLzl8BS.js
vary: Origin, Accept-Encoding
last-modified: Thu, 03 Oct 2024 17:39:19 GMT

GET
H2 200 index-UBvRx3nR.css
00024598745679.my.id/assets/ 69 KB
29 KB 2333ms
2333ms Stylesheet
text/css 2606:4700:3034::ac43:94d6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://00024598745679.my.id/assets/index-UBvRx3nR.css
Requested by: Host: 00024598745679.my.id
URL: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:94d6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2c86442cba8691c12c9ec621aab93be2c814ffe14d54c1a77e9212c69da4a8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://00024598745679.my.id
Referer: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw

Response headers

server: cloudflare
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
etag: W/"1727977159.8838763-70736-4170779982"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6HEWPRDOJ3mvj4FFC8ltJ5FQM9eLm%2FrZnYOcy1k8%2F%2BF2Cc4NrqLSZUS3ZbBz0LFpv73MJuNyEHA9XB%2Fehqu80rbpFVnNVTJM4GDaalBwyImRrjB%2BPK8kzZ82r77WTX7LADDDbJRNuq%2BZojXzg1Umfubj6w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd99735ff1ab50f-OSL
access-control-allow-origin: https://00024598745679.my.id
date: Sat, 05 Oct 2024 01:20:44 GMT
content-type: text/css; charset=utf-8
content-disposition: inline; filename=index-UBvRx3nR.css
vary: Origin, Accept-Encoding
last-modified: Thu, 03 Oct 2024 17:39:19 GMT

GET
H3 200 geo.json Show response
get.geojs.io/v1/ip/ 342 B
770 B 211ms
153ms XHR
application/json 172.67.70.233
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/geo.json

Requested by

Host: 00024598745679.my.id
URL: https://00024598745679.my.id/assets/index-CrLzl8BS.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.233 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d07ae5f45b0e47de83b1fe94cf8b6d13fa37a3a835b8ff9b4d3dc83fc7499bcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://00024598745679.my.id/

Response headers

x-request-id: cbb20dddba8f3b4ca85752950bdfa308-ASH
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=olB0Yj42bddRhswN1C0HpJo7D5on1JMDFz8KOBy0Ha%2B2id9w07KHEDL%2Bvo1tIs7Zve3geH8o7f2BGJoPLVVJyKuB99MG4%2BbG72ER5iaxYGsSsQVoE46jHsqLouL1aw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 01:20:44 GMT
content-type: application/json
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8cd997487c844c8b-HEL
access-control-allow-origin: *
geojs-backend: ash-01
server: cloudflare

GET
H3 200 aGT3gskzWBf.ico
00024598745679.my.id/ 5 KB
1 KB 1556ms
1555ms Other
image/vnd.microsoft.icon 172.67.148.214
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://00024598745679.my.id/aGT3gskzWBf.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.148.214 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://00024598745679.my.id/live?fbclid=IwY2xjawFtc51leHRuA2FlbQIxMAABHVyL9Ezaj7W9mLlMW5iMQr2-WwMshV1-vT15sfDnB84Zp-mVrgezPd48hw_aem_JZ8eyOxXEXBzprj106Tmcw

Response headers

server: cloudflare
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: MISS
etag: W/"1727977159.8358765-5430-2119502172"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mXTAK%2BpL4OFzHAWDQHSBcBj8k53GauuVX7d9A%2B%2BmLEeWKOjZHCXcdOfhnsdqaZB%2B%2BegdSHa2a6phcU8wlzwkYeD%2FeWSDGc4n1vNx36yoWwW8QVGgnHULFaLsTDI04TrMfNEhNTS2xg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd997483da1b4eb-OSL
access-control-allow-origin: *
date: Sat, 05 Oct 2024 01:20:46 GMT
content-type: image/vnd.microsoft.icon
content-disposition: inline; filename=aGT3gskzWBf.ico
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 17:39:19 GMT

GET
H3 200 193.138.7.225.json Show response
get.geojs.io/v1/ip/geo/ 342 B
773 B 162ms
162ms Fetch
application/json 172.67.70.233
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/geo/193.138.7.225.json

Requested by

Host: 00024598745679.my.id
URL: https://00024598745679.my.id/assets/index-CrLzl8BS.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.233 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40bb74ad5d585e41c5ae4432b2bfcbee708812374391008bb00288efd83c44e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://00024598745679.my.id/

Response headers

x-request-id: 26a242a1e4f605c714cf4d16ecd5a2a3-ASH
content-encoding: br
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mMVDPh%2F7ouqK82xUmmJHF6niK8d%2BnpScKYlzx6oyzSUr11VVXzwDFnKc9mnXHRvd2NyhMzuL7ybDuUkthuMpK%2BZMtFRfMPLNU2B7%2BBSA2XUKvZJS9Wllnt0V%2Bk5fVA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET
x-content-type-options: nosniff
date: Sat, 05 Oct 2024 01:20:45 GMT
content-type: application/json
last-modified: Sat, 05 Oct 2024 01:20:45 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8cd997497ceb4c8b-HEL
access-control-allow-origin: *
geojs-backend: ash-01
server: cloudflare

GET hero-image-2-CMe_D_F7.png
00024598745679.my.id/assets/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 00024598745679.my.id
URL: https://00024598745679.my.id/assets/hero-image-2-CMe_D_F7.png

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on October 5th 2024, 1:27:34 am UTC — From United States

Threats: Phishing
Brands: Facebook US
Comment: Facebook phishing site, requests passwords usernames and even passport photos

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion object| FontAwesomeConfig object| ___FONT_AWESOME___

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

00024598745679.my.id
get.geojs.io
00024598745679.my.id
172.67.148.214
172.67.70.233
2606:4700:3034::ac43:94d6
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
40bb74ad5d585e41c5ae4432b2bfcbee708812374391008bb00288efd83c44e9
60d158601ec00b2ea05d134f6c6ca6fd665646c310ae4627cf0c624f13fefd0f
7d619e2ab105f603128da473ebaceda7378e3c642bf9c33ffcc7283713c4cc0f
88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7
c2c86442cba8691c12c9ec621aab93be2c814ffe14d54c1a77e9212c69da4a8d
d07ae5f45b0e47de83b1fe94cf8b6d13fa37a3a835b8ff9b4d3dc83fc7499bcb

00024598745679.my.id Open in urlscan Pro 2606:4700:3034::ac43:94d6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

88 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

4 IPs

1 Countries

207 kBTransfer

655 kBSize

0 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Malicious page.url Submitted on October 5th 2024, 1:27:34 am UTC — From United States

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

3 JavaScript Global Variables

0 Cookies

Indicators

00024598745679.my.id Open in urlscan Pro
2606:4700:3034::ac43:94d6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

1
Countries

207 kB
Transfer

655 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Malicious page.url
Submitted on October 5th 2024, 1:27:34 am UTC — From United States

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!