cad.supportffb.click Open in urlscan Pro
203.205.10.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://s.umj.ac.id/spfb10ca
Effective URL:
https://cad.supportffb.click/
Submission: On July 20 via automatic, source openphish (July 20th 2023, 8:29:23 am UTC) — Scanned from DE

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 203.205.10.134, located in Ho Chi Minh City, Viet Nam and belongs to CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN. The main domain is cad.supportffb.click.
TLS certificate: Issued by R3 on July 19th 2023. Valid for: 3 months.

This is the only time cad.supportffb.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.206.245.71 103.206.245.71	131111 (CEPATNET-...) (CEPATNET-AS-ID PT Mora Telematika Indonesia)
5	203.205.10.134 203.205.10.134	45903 (CMCTELECO...) (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company)
3	203.205.10.152 203.205.10.152	45903 (CMCTELECO...) (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
4	113.20.119.13 113.20.119.13	45903 (CMCTELECO...) (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
15	6

1 103.206.245.71 (Pegangsaan Dua, Indonesia) 1 redirects

ASN131111 (CEPATNET-AS-ID PT Mora Telematika Indonesia, ID)
PTR: ip-245-71.moratelindo.co.id

s.umj.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 203.205.10.134 (Ho Chi Minh City, Viet Nam)

ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN)
PTR: static.cmcti.vn

cad.supportffb.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 203.205.10.152 (Ho Chi Minh City, Viet Nam)

ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN)
PTR: static.cmcti.vn

content.pancake.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 113.20.119.13 (Hanoi, Viet Nam)

ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN)
PTR: static.cmcti.vn

api.webcake.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.pancake.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	pancake.vn content.pancake.vn — Cisco Umbrella Rank: 200146 a.pancake.vn — Cisco Umbrella Rank: 321584	35 KB
5	supportffb.click cad.supportffb.click	205 KB
2	gstatic.com fonts.gstatic.com	31 KB
2	webcake.io api.webcake.io — Cisco Umbrella Rank: 365284	7 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 74	1 KB
1	umj.ac.id 1 redirects s.umj.ac.id	114 B
15	6

	Domain	Requested by
5	cad.supportffb.click	cad.supportffb.click
3	content.pancake.vn	cad.supportffb.click
2	a.pancake.vn	cad.supportffb.click
2	fonts.gstatic.com	fonts.googleapis.com
2	api.webcake.io	cad.supportffb.click
1	fonts.googleapis.com	cad.supportffb.click
1	s.umj.ac.id	1 redirects
15	7

This site contains links to these domains. Also see Links.

Domain
transparency.fb.com

Subject Issuer	Validity	Valid
cad.supportffb.click R3	`2023-07-19` - `2023-10-17`	3 months	crt.sh
*.pancake.vn Sectigo RSA Domain Validation Secure Server CA	`2023-07-10` - `2024-07-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-03` - `2023-09-25`	3 months	crt.sh
*.webcake.io Sectigo RSA Domain Validation Secure Server CA	`2022-09-29` - `2023-10-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-03` - `2023-09-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cad.supportffb.click/
Frame ID: BCA931A049B718489DF013C0E08E1C36
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook

Page URL History Show full URLs

https://s.umj.ac.id/spfb10ca HTTP 301
https://cad.supportffb.click/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

280 kB
Transfer

1068 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://transparency.fb.com/enforcement/
Title: Next

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s.umj.ac.id/spfb10ca HTTP 301
https://cad.supportffb.click/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
cad.supportffb.click/
Redirect Chain

https://s.umj.ac.id/spfb10ca
https://cad.supportffb.click/

108 KB
17 KB

1370ms
331ms

Document
text/html

203.205.10.134
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.205.10.134 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.19.3.2 /
Resource Hash: 2fe3ea65b785fd9e782192fc9e02e8c7c4c323d235e4ddb504b2a3c069aacefb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 17198
content-type: text/html; charset=utf-8
date: Thu, 20 Jul 2023 08:29:17 GMT
server: openresty/1.19.3.2
vary: accept-encoding
x-request-id: F3OGIAmL_v47PrsAocKj

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 20 Jul 2023 08:29:16 GMT
location: https://cad.supportffb.click/
server: openresty
x-served-by: s.umj.ac.id

GET
H2 200 address.84.min.js Show response
cad.supportffb.click/address_wc/ 438 KB
87 KB 308ms
307ms Script
application/javascript 203.205.10.134
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://cad.supportffb.click/address_wc/address.84.min.js?v=1
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.205.10.134 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.19.3.2 /
Resource Hash: 51db54033d2f98c945a67136399e49881d40d5462e320af521c0542a4507053e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:17 GMT
content-encoding: gzip
server: openresty/1.19.3.2
etag: "7E72636"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 89259
service-worker-allowed: /

GET
H2 200 838453201b6e459e07bfb1cca5f976083f0d46836fb6f43696787518.png
content.pancake.vn/1/s650x450/fwebp/e6/9f/8d/0e/ 26 KB
26 KB 1458ms
582ms Image
image/webp 203.205.10.152
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.pancake.vn/1/s650x450/fwebp/e6/9f/8d/0e/838453201b6e459e07bfb1cca5f976083f0d46836fb6f43696787518.png
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.205.10.152 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: nginx/1.10.3 /
Resource Hash: 92fcdd7ccbf27b47513cb23b13cd7988d2ffd4c0816056bafeca1fc9b346c91c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
server: nginx/1.10.3
etag: 838453201b6e459e07bfb1cca5f976083f0d46836fb6f43696787518.png
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=2505600
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 26826

GET
H2 200 f5dd4eb0be2dc829239b969028882fcc441fa1434faf1aa9d48cc137.jpg
content.pancake.vn/1/s350x350/fwebp/57/b8/cc/bd/ 1 KB
2 KB 1167ms
291ms Image
image/webp 203.205.10.152
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.pancake.vn/1/s350x350/fwebp/57/b8/cc/bd/f5dd4eb0be2dc829239b969028882fcc441fa1434faf1aa9d48cc137.jpg
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.205.10.152 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: nginx/1.10.3 /
Resource Hash: 98ebce6714f6345923265ec0d6163f33c6c0281259237acf628f2161166b3c18

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
server: nginx/1.10.3
etag: f5dd4eb0be2dc829239b969028882fcc441fa1434faf1aa9d48cc137.jpg
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=2505600
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 1422

GET
H2 200 5ca135c88d178ecf90ee5c10288d9b58c1b9531fa2c10f74c8a28838.jpg
content.pancake.vn/1/s350x350/fwebp/76/1d/72/de/ 2 KB
2 KB 1170ms
294ms Image
image/webp 203.205.10.152
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.pancake.vn/1/s350x350/fwebp/76/1d/72/de/5ca135c88d178ecf90ee5c10288d9b58c1b9531fa2c10f74c8a28838.jpg
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.205.10.152 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: nginx/1.10.3 /
Resource Hash: 437ed7d6079f78a749759df7fc2a1d51fd6a67ed2483f22a846cf7af53c3d7f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
server: nginx/1.10.3
etag: 5ca135c88d178ecf90ee5c10288d9b58c1b9531fa2c10f74c8a28838.jpg
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=2505600
access-control-allow-credentials: true
accept-ranges: bytes
content-length: 1724

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 85ms
31ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,300,400,700,900&display=swap

Requested by

Host: cad.supportffb.click
URL: https://cad.supportffb.click/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

752488de19c80d48eda7a53c592a7d413831c454df346c2c2250c4095ca47561

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 20 Jul 2023 08:29:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 08:29:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Jul 2023 08:29:17 GMT

GET
H2 200 animatev4.css
api.webcake.io/animate/ 96 KB
6 KB 891ms
294ms Stylesheet
text/css 113.20.119.13
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webcake.io/animate/animatev4.css?v=1
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 113.20.119.13 Hanoi, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.15.8.2 /
Resource Hash: 8a6d503f07658c24078e1dff62800d6ccbccba8b9607bec8a23c80ac6b0a13a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
content-encoding: gzip
server: openresty/1.15.8.2
etag: "35CA636"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6108
service-worker-allowed: /

GET
H2 200 iconfont.css
api.webcake.io/render_iconfont/ 654 B
488 B 892ms
295ms Stylesheet
text/css 113.20.119.13
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webcake.io/render_iconfont/iconfont.css?v=1
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 113.20.119.13 Hanoi, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.15.8.2 /
Resource Hash: a7f565be47dcd36f197bdb273b3cdd06ac2ac12e7b7d44ac089f6461f9fe2394

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
content-encoding: gzip
server: openresty/1.15.8.2
etag: "5E77A93"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 302
service-worker-allowed: /

GET
H2 200 bc602444-a411-4282-8688-c0bae0db5986 Show response
cad.supportffb.click/webcake/v4/ 349 KB
100 KB 589ms
588ms Script
text/plain 203.205.10.134
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://cad.supportffb.click/webcake/v4/bc602444-a411-4282-8688-c0bae0db5986
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.205.10.134 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.19.3.2 /
Resource Hash: c8881a0ea666a134b5800977d3b05e0f77ea893ab698a257ee9544ed57fe4af3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:18 GMT
content-encoding: gzip
server: openresty/1.19.3.2
vary: accept-encoding
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
content-length: 102372
x-request-id: F3OGIC8CXUh7KmBHrWch

GET
H2 200 page_view.gif
cad.supportffb.click/ 35 B
196 B 588ms
588ms Image
image/gif 203.205.10.134
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cad.supportffb.click/page_view.gif?pid=b6ca27fa-17bc-4c59-8f41-b5be88f59adb
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.205.10.134 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.19.3.2 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 20 Jul 2023 08:29:17 GMT
cache-control: max-age=0, private, must-revalidate
server: openresty/1.19.3.2
content-length: 35
x-request-id: F3OGIC-QHyL69y0Ao8UC
content-type: image/gif

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 67ms
20ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cad.supportffb.click
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 13 Jul 2023 22:16:07 GMT
x-content-type-options: nosniff
age: 555190
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Jul 2024 22:16:07 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 70ms
26ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cad.supportffb.click
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Mon, 17 Jul 2023 22:23:32 GMT
x-content-type-options: nosniff
age: 209145
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Jul 2024 22:23:32 GMT

GET
H2 200 b6ca27fa-17bc-4c59-8f41-b5be88f59adb Show response
cad.supportffb.click/sync/ 65 B
241 B 347ms
347ms XHR
application/json 203.205.10.134
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://cad.supportffb.click/sync/b6ca27fa-17bc-4c59-8f41-b5be88f59adb
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/webcake/v4/bc602444-a411-4282-8688-c0bae0db5986
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 203.205.10.134 Ho Chi Minh City, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.19.3.2 /
Resource Hash: 3f2075ae1e3ca7261c17558ee154020f661b4a3aa4422a2ced569d52df3cd141

Request headers

Accept: application/json, text/plain, */*
Referer: https://cad.supportffb.click/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 20 Jul 2023 08:29:18 GMT
cache-control: max-age=0, private, must-revalidate
server: openresty/1.19.3.2
content-length: 65
x-request-id: F3OGIGZ-O1vBdPAAoP_k
content-type: application/json; charset=utf-8

GET
H2 200 app.js Show response
a.pancake.vn/js/ 5 KB
5 KB 1177ms
317ms Script
text/javascript 113.20.119.13
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pancake.vn/js/app.js?vsn=d
Requested by: Host: cad.supportffb.click
URL: https://cad.supportffb.click/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 113.20.119.13 Hanoi, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),
Reverse DNS: static.cmcti.vn
Software: openresty/1.15.8.2 /
Resource Hash: 74b62bbff4866e7a99770a845517c37ae2f1315f850b48028c1697038cb58c7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:19 GMT
cache-control: public, max-age=31536000
server: openresty/1.15.8.2
accept-ranges: bytes
content-length: 4869
content-type: text/javascript

GET
H2 200 collect
a.pancake.vn/ 35 B
320 B 357ms
357ms Image
image/gif 113.20.119.13
CMCTELECOM-AS-VN ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.pancake.vn/collect?dl=https%3A%2F%2Fcad.supportffb.click%2F&hn=cad.supportffb.click&sc=https%3A&sr=1600x1200&vp=1600x1526&dt=Facebook&tid=ab-lp-b6ca27fa-17bc-4c59-8f41-b5be88f59adb&ts=1689841759927&_v=2.0&fr=&_aba=CPA2.1689841759926.3.4e032ffc-8b77-415d-b10c-a7b6e0b1cb59&_abd=CPD2.1689841759927.3.1261cf40-4848-4347-a294-5016e52b7046&_abt=CPT2.1689841759927.3.7363ccb9-20e5-4440-becc-7d3a7858fe61&campaign_id=null&campaign_variant_id=null

Requested by

Host: cad.supportffb.click
URL: https://cad.supportffb.click/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

113.20.119.13 Hanoi, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN),

Reverse DNS

static.cmcti.vn

Software

openresty/1.15.8.2 /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cad.supportffb.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Thu, 20 Jul 2023 08:29:20 GMT
x-content-type-options: nosniff
server: openresty/1.15.8.2
x-permitted-cross-domain-policies: none
cross-origin-window-policy: deny
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=0, private, must-revalidate
content-length: 35
x-xss-protection: 1; mode=block
x-request-id: F3OGIK2IqtDmdO5sDKrj

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
cad.supportffb.click/	1969-12-31 23:59:59	Name: _p_session_id Value: 92bc546b-7f02-478d-a0f9-61e118209afa
cad.supportffb.click/	1970-01-20 22:09:37	Name: _aba Value: CPA2.1689841759926.3.4e032ffc-8b77-415d-b10c-a7b6e0b1cb59
cad.supportffb.click/	1970-01-20 13:25:28	Name: _abd Value: CPD2.1689841759927.3.1261cf40-4848-4347-a294-5016e52b7046
cad.supportffb.click/	1970-01-20 13:24:01	Name: _abt Value: CPT2.1689841759927.3.7363ccb9-20e5-4440-becc-7d3a7858fe61

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.pancake.vn
api.webcake.io
cad.supportffb.click
content.pancake.vn
fonts.googleapis.com
fonts.gstatic.com
s.umj.ac.id
103.206.245.71
113.20.119.13
203.205.10.134
203.205.10.152
2a00:1450:4001:827::200a
2a00:1450:4001:831::2003
2fe3ea65b785fd9e782192fc9e02e8c7c4c323d235e4ddb504b2a3c069aacefb
3f2075ae1e3ca7261c17558ee154020f661b4a3aa4422a2ced569d52df3cd141
437ed7d6079f78a749759df7fc2a1d51fd6a67ed2483f22a846cf7af53c3d7f0
51db54033d2f98c945a67136399e49881d40d5462e320af521c0542a4507053e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
74b62bbff4866e7a99770a845517c37ae2f1315f850b48028c1697038cb58c7f
752488de19c80d48eda7a53c592a7d413831c454df346c2c2250c4095ca47561
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
8a6d503f07658c24078e1dff62800d6ccbccba8b9607bec8a23c80ac6b0a13a1
92fcdd7ccbf27b47513cb23b13cd7988d2ffd4c0816056bafeca1fc9b346c91c
98ebce6714f6345923265ec0d6163f33c6c0281259237acf628f2161166b3c18
a7f565be47dcd36f197bdb273b3cdd06ac2ac12e7b7d44ac089f6461f9fe2394
c8881a0ea666a134b5800977d3b05e0f77ea893ab698a257ee9544ed57fe4af3
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

cad.supportffb.click Open in urlscan Pro 203.205.10.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

280 kBTransfer

1068 kBSize

4 Cookies

1 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

28 JavaScript Global Variables

4 Cookies

Indicators

cad.supportffb.click Open in urlscan Pro
203.205.10.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

280 kB
Transfer

1068 kB
Size

4
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!