pbs.twimg.com - urlscan.io

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 5 HTTP transactions. The main IP is 2606:2800:134:fa2:1627:1fe:edb:1665, located in United States and belongs to EDGECAST, US. The main domain is pbs.twimg.com. The Cisco Umbrella rank of the primary domain is 829.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on October 6th 2022. Valid for: a year.

This is the only time pbs.twimg.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	173.239.8.164 173.239.8.164	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1	74.206.228.78 74.206.228.78	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1 2	23.19.76.168 23.19.76.168	395954 (LEASEWEB-...) (LEASEWEB-USA-LAX)
1 2	192.99.158.241 192.99.158.241	16276 (OVH) (OVH)
1 1	104.206.252.90 104.206.252.90	62904 (AS62904) (AS62904)
1 1	192.186.135.128 192.186.135.128	55286 (SERVER-MANIA) (SERVER-MANIA)
1	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST)
5	5

1 173.239.8.164 (New York, United States)

ASN27257 (WEBAIR-INTERNET, US)
PTR: icsvm3.webair.com

cs.ffbtas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.206.228.78 (Garden City, United States)

ASN27257 (WEBAIR-INTERNET, US)

ffbtas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.19.76.168 (Los Angeles, United States) 1 redirects

ASN395954 (LEASEWEB-USA-LAX, US)

q2.quotes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.99.158.241 (Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: ip241.ip-192-99-158.net

btxxxnav.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.206.252.90 (New York, United States) 1 redirects

ASN62904 (AS62904, US)
PTR: 90-252-206-104.staticrdns.eonix.net

7671.qorvey.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.186.135.128 (Buffalo, United States) 1 redirects

ASN55286 (SERVER-MANIA, CA)
PTR: mta128.quick-buzzer.eu

juk.linkapplied.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	btxxxnav.com 1 redirects btxxxnav.com — Cisco Umbrella Rank: 977578	6 KB
2	quotes.com 1 redirects q2.quotes.com	824 B
2	ffbtas.com cs.ffbtas.com — Cisco Umbrella Rank: 13300 ffbtas.com — Cisco Umbrella Rank: 13299	1 KB
1	twimg.com pbs.twimg.com — Cisco Umbrella Rank: 829	316 KB
1	linkapplied.com 1 redirects juk.linkapplied.com	195 B
1	qorvey.com 1 redirects 7671.qorvey.com	258 B
5	6

	Domain	Requested by
2	btxxxnav.com	1 redirects
2	q2.quotes.com	1 redirects ffbtas.com
1	pbs.twimg.com
1	juk.linkapplied.com	1 redirects
1	7671.qorvey.com	1 redirects
1	ffbtas.com
1	cs.ffbtas.com
5	7

This site contains no links.

Subject Issuer	Validity	Valid
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-06` - `2023-11-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096
Frame ID: 2DEAB0F9D4D3A432B9FDC1ACE5E080BF
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FyNYsy8WAAA57Ku (3542×1754)

Page URL History Show full URLs

http://cs.ffbtas.com/ Page URL
http://ffbtas.com/ Page URL
http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3 Page URL
http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3?hr=1 HTTP 302
http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb... Page URL
http://btxxxnav.com/Redirect/ HTTP 302
http://7671.qorvey.com/match-7671/82167/85056281/1688665117/mf_74888007-c969-4de0-9196-8c3fb3f17514... HTTP 302
https://juk.linkapplied.com/?kw=apix01-ffbtas.com&s1=apix01-ffbtas.com&s2=1688665119.554997-85056281-0-&... HTTP 301
https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096 Page URL

Page Statistics

5
Requests

20 %
HTTPS

14 %
IPv6

6
Domains

7
Subdomains

5
IPs

2
Countries

323 kB
Transfer

322 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cs.ffbtas.com/ Page URL
http://ffbtas.com/ Page URL
http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3 Page URL
http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3?hr=1 HTTP 302
http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb0o4WE91Umg2NWVWRjVVNVNJRGY4SnRtTUtxclhOTlhnUXFvV1JESmdaM0wta19sLVlfMGJGOWh3aXlJS3dTaWRneWM2Y0VtS08wbmJpTHkzdDdGdHVYLWhqUGUwdXFsXy1kRFJRMg2&id=b2a8d85c-ed0e-421d-8f61-97a4a35b2872 Page URL
http://btxxxnav.com/Redirect/ HTTP 302
http://7671.qorvey.com/match-7671/82167/85056281/1688665117/mf_74888007-c969-4de0-9196-8c3fb3f17514/YXBpeDAxLWZmYnRhcy5jb218MTY4ODY2NTExNy45NTU5NjEtODUwNTYyODEtODIxNjc=/feed HTTP 302
https://juk.linkapplied.com/?kw=apix01-ffbtas.com&s1=apix01-ffbtas.com&s2=1688665119.554997-85056281-0-&s3=&fallback=1 HTTP 301
https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3?hr=1 HTTP 302
http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb0o4WE91Umg2NWVWRjVVNVNJRGY4SnRtTUtxclhOTlhnUXFvV1JESmdaM0wta19sLVlfMGJGOWh3aXlJS3dTaWRneWM2Y0VtS08wbmJpTHkzdDdGdHVYLWhqUGUwdXFsXy1kRFJRMg2&id=b2a8d85c-ed0e-421d-8f61-97a4a35b2872

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
cs.ffbtas.com/ 348 B
449 B 190ms
90ms Document
text/html 173.239.8.164
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://cs.ffbtas.com/
Protocol: HTTP/1.1
Server: 173.239.8.164 New York, United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS: icsvm3.webair.com
Software: nginx/1.20.1 /
Resource Hash: 1fc275bc9eacbef050e209ef05ff3d8e916ffaa01ef53aebdb912b7c5ee86ce7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Thu, 06 Jul 2023 17:38:36 GMT
Server: nginx/1.20.1
Transfer-Encoding: chunked

POST
H/1.1 200
OK /
ffbtas.com/ 212 B
614 B 1397ms
823ms Document
text/html 74.206.228.78
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: http://ffbtas.com/
Protocol: HTTP/1.1
Server: 74.206.228.78 Garden City, United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: http://cs.ffbtas.com
Referer: http://cs.ffbtas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Thu, 06 Jul 2023 17:38:38 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Server: nginx/1.18.0
Transfer-Encoding: chunked
X-IFID: 1

GET
H/1.1 200
OK f0411cbe-1c23-11ee-9521-658648c6acb3
q2.quotes.com/ 170 B
373 B 322ms
150ms Document
text/html 23.19.76.168
LEASEWEB-USA-LAX

General

Check archive.org

Show headers Download Go to

Full URL: http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3
Requested by: Host: ffbtas.com
URL: http://ffbtas.com/
Protocol: HTTP/1.1
Server: 23.19.76.168 Los Angeles, United States, ASN395954 (LEASEWEB-USA-LAX, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: http://ffbtas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 170
content-type: text/html; charset=utf-8
date: Thu, 06 Jul 2023 17:38:37 GMT
server: nginx

GET
H/1.1

200
OK

click
btxxxnav.com/
Redirect Chain

http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3?hr=1
http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb0o4WE91Umg2NWVWRjVVNVNJRGY4SnRtTUtxclhOTlhnUXFvV1JESmdaM0wta19sLVlfMGJGOWh3aXlJS3dTaWRneWM2Y0VtS08wbm...

5 KB
6 KB

211ms
94ms

Document
text/html

192.99.158.241
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb0o4WE91Umg2NWVWRjVVNVNJRGY4SnRtTUtxclhOTlhnUXFvV1JESmdaM0wta19sLVlfMGJGOWh3aXlJS3dTaWRneWM2Y0VtS08wbmJpTHkzdDdGdHVYLWhqUGUwdXFsXy1kRFJRMg2&id=b2a8d85c-ed0e-421d-8f61-97a4a35b2872
Protocol: HTTP/1.1
Server: 192.99.158.241 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip241.ip-192-99-158.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: http://q2.quotes.com/f0411cbe-1c23-11ee-9521-658648c6acb3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Length: 5412
Content-Type: text/html; charset=utf-8
Date: Thu, 06 Jul 2023 17:37:45 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

Redirect headers

cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Thu, 06 Jul 2023 17:38:38 GMT
location: http://btxxxnav.com/click?data=eGhyMUFpLTg2aEtfaVBmSXlXWW1iQmRvQmVScm5WbVdPS3poWHpaSG1uWEVxeExHb0o4WE91Umg2NWVWRjVVNVNJRGY4SnRtTUtxclhOTlhnUXFvV1JESmdaM0wta19sLVlfMGJGOWh3aXlJS3dTaWRneWM2Y0VtS08wbmJpTHkzdDdGdHVYLWhqUGUwdXFsXy1kRFJRMg2&id=b2a8d85c-ed0e-421d-8f61-97a4a35b2872
server: nginx

GET
H2

200

Primary Request FyNYsy8WAAA57Ku Show response
pbs.twimg.com/media/
Redirect Chain

http://btxxxnav.com/Redirect/
http://7671.qorvey.com/match-7671/82167/85056281/1688665117/mf_74888007-c969-4de0-9196-8c3fb3f17514/YXBpeDAxLWZmYnRhcy5jb218MTY4ODY2NTExNy45NTU5NjEtODUwNTYyODEtODIxNjc=/feed
https://juk.linkapplied.com/?kw=apix01-ffbtas.com&s1=apix01-ffbtas.com&s2=1688665119.554997-85056281-0-&s3=&fallback=1
https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096

316 KB
316 KB

32ms
8ms

Document
image/jpeg

2606:2800:134:fa2:1627:1fe:edb:1665
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/673A) /

Resource Hash

4debef1efea78ed105bfaf25a7c249afac3543594436abfb16238242315d9ea8

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: http://btxxxnav.com
Referer: http://btxxxnav.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: Content-Length
age: 506050
cache-control: max-age=604800, must-revalidate
content-length: 323252
content-type: image/jpeg
date: Thu, 06 Jul 2023 17:38:41 GMT
last-modified: Fri, 09 Jun 2023 20:51:48 GMT
perf: 7626143928
server: ECS (frb/673A)
server-timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
strict-transport-security: max-age=631138519
surrogate-key: media media/bucket/4 media/1667273813669576704
timing-allow-origin: https://twitter.com, https://mobile.twitter.com
x-cache: HIT
x-connection-hash: dce1ebc1ea5c96acb1f6ef3e1c893ec1a4a6216a4a2154f037aa35a6811eec54
x-content-type-options: nosniff
x-response-time: 106
x-transaction-id: 9ce3a4ab1c782bd7
x-tw-cdn: VZ VZ VZ

Redirect headers

content-type: text/html; charset=UTF-8
date: Thu, 06 Jul 2023 17:38:41 GMT
location: https://pbs.twimg.com/media/FyNYsy8WAAA57Ku?format=jpg&name=4096x4096
server: swoole-http-server
strict-transport-security: max-age=15768000
x-redir: true

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ffbtas.com/	1970-01-20 13:04:28	Name: ipc Value: eyJ2ZXJzaW9uIjoxLCJzdWJJZCI6MywiZm9sZGVySWQiOjEsImZlZWRJZCI6MSwidHMiOjE2ODg2NjUxMTgsImhhc2giOiJkZGY5NjIzMyJ9
			btxxxnav.com/	1969-12-31 23:59:59	Name: QyydwqyWVDGEOja Value: QyydwqyWVDGEOja

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7671.qorvey.com
btxxxnav.com
cs.ffbtas.com
ffbtas.com
juk.linkapplied.com
pbs.twimg.com
q2.quotes.com
104.206.252.90
173.239.8.164
192.186.135.128
192.99.158.241
23.19.76.168
2606:2800:134:fa2:1627:1fe:edb:1665
74.206.228.78
1fc275bc9eacbef050e209ef05ff3d8e916ffaa01ef53aebdb912b7c5ee86ce7
4debef1efea78ed105bfaf25a7c249afac3543594436abfb16238242315d9ea8

pbs.twimg.com Open in urlscan Pro 2606:2800:134:fa2:1627:1fe:edb:1665 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

20 %HTTPS

14 %IPv6

6 Domains

7 Subdomains

5 IPs

2 Countries

323 kBTransfer

322 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

2 Cookies

Indicators

pbs.twimg.com Open in urlscan Pro
2606:2800:134:fa2:1627:1fe:edb:1665 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

14 %
IPv6

6
Domains

7
Subdomains

5
IPs

2
Countries

323 kB
Transfer

322 kB
Size

2
Cookies

5 HTTP transactions
0 data transactions