www.facebookid-com.duckdns.org Open in urlscan Pro
84.32.230.51  Malicious Activity! Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.facebookid-com.duckdns.org/	26 KB 26 KB	1236ms 306ms	Document text/html	84.32.230.51 HIZHOSTING
General Check archive.org Show headers Download Go to Full URL https://www.facebookid-com.duckdns.org/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 84.32.230.51 Istanbul, Turkey, ASN207709 (HIZHOSTING, TR), Reverse DNS Software Apache / Resource Hash c03ae43613bbd6e99b5ae95c904cd74d4e84da2f3be2e654245bbfaa55076bbb Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 04 Apr 2023 06:03:47 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H2	200	20230402_jsH_bjsgb_snwoi.css api.gifan.id/files/	62 KB 17 KB	393ms 8ms	Stylesheet text/css	2606:4700:3038::6815:ea23 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.gifan.id/files/20230402_jsH_bjsgb_snwoi.css Requested by Host: www.facebookid-com.duckdns.org URL: https://www.facebookid-com.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:ea23 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4bf43981ba136471e611caf5ac7102272600bcfbc7f48e52964695bfb85de29a Request headers accept-language jp-JP,jp;q=0.9 Referer https://www.facebookid-com.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 04 Apr 2023 06:03:48 GMT content-encoding br dn-request-id 6ada7f50bb15ca6c0b8329d1fcae518e cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 16190 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Sun, 02 Apr 2023 13:48:31 GMT server cloudflare etag W/"642987af-f9ef" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=54%2Fx2AdDxeT54yWdnhOkGf7X5MdTWgzSe4ckeJvfDZYK97mH1ZM1oCLQRT%2Bn1vdwx31jQDqQQjGT0F8655Dsiq0Sj8aNPtDwhzOqbI6NPQE0%2BfwvvCmtFJzFXDY45kVpsY5sD7r37F736Cg%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=604800 cf-ray 7b2759a92c348a69-NRT expires Tue, 11 Apr 2023 01:33:57 GMT
GET		20230402_1QMgyaPXSxJ.css api.gifan.id/files/	0 0
GET H2	200	-R5K-7w5Tcl.js Show response static.xx.fbcdn.net/rsrc.php/v3/ye/r/	245 KB 64 KB	15ms 4ms	Script application/x-javascript	2a03:2880:f00f:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://static.xx.fbcdn.net/rsrc.php/v3/ye/r/-R5K-7w5Tcl.js?_nc_x=Ij3Wp8lg5Kz Requested by Host: www.facebookid-com.duckdns.org URL: https://www.facebookid-com.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f9f2d952b897cfc7c862c374bfb3a76bd5bbd07ecc6f8c70e42f4745941fea07 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.facebookid-com.duckdns.org/ Origin https://www.facebookid-com.duckdns.org accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 04 Apr 2023 06:03:47 GMT content-encoding br x-content-type-options nosniff content-md5 59qgwGsy5IKY7CVslvDm6w== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 65492 x-fb-rlafr 0 x-fb-debug ou0DOd1V522a1j+CNr1SZzCIbBsdd4PBhMeR7mDBqXA3jLT/QjmMPicY43QYNLNxhCSwv8Z/lt3EdtaSmImJ1g== x-fb-trip-id 382461245 last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Sun, 31 Mar 2024 00:49:49 GMT
GET H3	200	dF5SId3UHWd.svg static.xx.fbcdn.net/rsrc.php/y8/r/	2 KB 1 KB	7ms 3ms	Image image/svg+xml	2a03:2880:f00f:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg Requested by Host: www.facebookid-com.duckdns.org URL: https://www.facebookid-com.duckdns.org/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer https://www.facebookid-com.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 04 Apr 2023 06:03:48 GMT content-encoding br x-content-type-options nosniff content-md5 NiMA5zHIsmaYxSYEaw9fHg== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1027 x-fb-rlafr 0 x-fb-debug DmrKdpOTX/IVMWKxhdhpHCAdzu520aMMKtDTg8zh2SIXg8Tz2QEBL4oYekTop4q7IjuwgioZTVsyjGXeEGznyw== last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * priority u=3,i expires Wed, 27 Mar 2024 00:50:27 GMT
GET H2	200	hsts-pixel.gif facebook.com/security/	43 B 2 KB	152ms 140ms	Image image/gif	2a03:2880:f10f:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://facebook.com/security/hsts-pixel.gif Requested by Host: www.facebookid-com.duckdns.org URL: https://www.facebookid-com.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://www.facebookid-com.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; content-encoding br x-content-type-options nosniff strict-transport-security max-age=15552000; includeSubDomains date Tue, 04 Apr 2023 06:03:48 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma no-cache x-fb-debug lqwcSR6Nrq8CfEln2l75QOv/MUopj8uVA+bfxcnQ/fVvFLTmTN89T1scjheUBunBckP1L3BRmj61kAEXRkCULg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type image/gif x-frame-options DENY access-control-allow-origin * origin-agent-cluster ?0 cache-control private, no-cache, no-store, must-revalidate expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	debug.js Show response file.gifan.id/	2 KB 1 KB	418ms 8ms	Script application/javascript	2606:4700:3038::6815:ea23 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://file.gifan.id/debug.js Requested by Host: www.facebookid-com.duckdns.org URL: https://www.facebookid-com.duckdns.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:ea23 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 12cef77ec29f920b0459c3f1b384e3db69b481b3bf677ed8597e1da614138c62 Request headers accept-language jp-JP,jp;q=0.9 Referer https://www.facebookid-com.duckdns.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 04 Apr 2023 06:03:48 GMT content-encoding br cf-cache-status HIT last-modified Sun, 07 Nov 2021 09:20:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 177275 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m1lmMk4ukPKC9%2FXB1N1VgFKMF9ZvL%2FnGHooWPPOZB9fBUbogvC3loNO4aBDQ9KdfQANtnNGkfdVojxNgXbzCnKY%2BqP8BU0l6mEbkxVvbzbcC%2B7ieUCb%2FzmlraY2ssTsS3vqeco%2FLmrV%2Fo%2FS0"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7b2759abcdf78a69-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Sun, 09 Apr 2023 04:49:12 GMT
GET H2	404	K804LXnHlWj.png api.gifan.id/rsrc.php/v3/yZ/r/	0 0	255ms 254ms	Image text/html	2606:4700:3038::6815:ea23 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://api.gifan.id/rsrc.php/v3/yZ/r/K804LXnHlWj.png Requested by Host: api.gifan.id URL: https://api.gifan.id/files/20230402_jsH_bjsgb_snwoi.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:ea23 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language jp-JP,jp;q=0.9 Referer https://api.gifan.id/files/20230402_jsH_bjsgb_snwoi.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

api.gifan.id

URL

https://api.gifan.id/files/20230402_1QMgyaPXSxJ.css?_nc_x=Ij3Wp8lg5Kz

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| envFlush object| Env number| __DEV__ undefined| MAX_CALLS_TO_EXEC function| __annotator function| __bodyWrapper function| __t function| __w function| emptyFunction function| FB_enumerate function| __m object| babelHelpers function| define function| require function| requireInterop function| importDefault function| importNamespace function| requireDynamic function| requireLazy object| __onBeforeModuleFactory object| __onAfterModuleFactory function| __d function| $RefreshReg$ function| $RefreshSig$ function| getErrorSafe object| ErrorGuard object| ErrorSerializer object| ErrorUtils function| __updateOrientation object| _0x3d88 function| _0x306c function| don

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.facebookid-com.duckdns.org/ Message: Access to CSS stylesheet at 'https://api.gifan.id/files/20230402_1QMgyaPXSxJ.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.facebookid-com.duckdns.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.gifan.id/files/20230402_1QMgyaPXSxJ.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://api.gifan.id/rsrc.php/v3/yZ/r/K804LXnHlWj.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.gifan.id
facebook.com
file.gifan.id
static.xx.fbcdn.net
www.facebookid-com.duckdns.org
api.gifan.id
2606:4700:3038::6815:ea23
2a03:2880:f00f:8:face:b00c:0:1
2a03:2880:f10f:83:face:b00c:0:25de
84.32.230.51
12cef77ec29f920b0459c3f1b384e3db69b481b3bf677ed8597e1da614138c62
4bf43981ba136471e611caf5ac7102272600bcfbc7f48e52964695bfb85de29a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
c03ae43613bbd6e99b5ae95c904cd74d4e84da2f3be2e654245bbfaa55076bbb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9f2d952b897cfc7c862c374bfb3a76bd5bbd07ecc6f8c70e42f4745941fea07