facebookcovidsupport.tk
Open in
urlscan Pro
2606:4700:3036::ac43:d8d9
Malicious Activity!
Public Scan
Effective URL: https://facebookcovidsupport.tk/
Submission: On April 26 via manual from GB
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 26th 2021. Valid for: a year.
This is the only time facebookcovidsupport.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2606:4700:303... 2606:4700:3036::ac43:d8d9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 144.76.90.121 144.76.90.121 | 24940 (HETZNER-AS) (HETZNER-AS) | |
4 | 2 |
ASN24940 (HETZNER-AS, DE)
PTR: static.121.90.76.144.clients.your-server.de
s4.gifyu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
gifyu.com
s4.gifyu.com |
1 MB |
2 |
facebookcovidsupport.tk
1 redirects
facebookcovidsupport.tk |
3 KB |
4 | 2 |
Domain | Requested by | |
---|---|---|
3 | s4.gifyu.com |
facebookcovidsupport.tk
|
2 | facebookcovidsupport.tk | 1 redirects |
4 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-04-26 - 2022-04-25 |
a year | crt.sh |
s4.gifyu.com R3 |
2021-04-19 - 2021-07-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://facebookcovidsupport.tk/
Frame ID: 40570FB0593C632917DD0B230FB63610
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://facebookcovidsupport.tk/
HTTP 301
https://facebookcovidsupport.tk/ Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://facebookcovidsupport.tk/
HTTP 301
https://facebookcovidsupport.tk/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
facebookcovidsupport.tk/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PicsArt_03-14-07.28.03.png
s4.gifyu.com/images/ |
222 KB 223 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PicsArt_03-14-09.35.36.png
s4.gifyu.com/images/ |
399 KB 399 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PicsArt_03-14-07.13.52.png
s4.gifyu.com/images/ |
415 KB 416 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.facebookcovidsupport.tk/ | Name: ARRAffinity Value: d61f024805f40cb35582d6dec4c50737546e03858cb05de2ce595b7e89683db2 |
|
.facebookcovidsupport.tk/ | Name: __cfduid Value: d60b599fb44ca487498a4b0b7e218ba551619429441 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebookcovidsupport.tk
s4.gifyu.com
144.76.90.121
2606:4700:3036::ac43:d8d9
2e48777503f5e59240e260b8417f8e92fcf19b2bc583ef6fb839d387caa96ec9
43f7c4c7f586f8e9adc20449f164449fb798765ef283f8658b7999897b492686
970d882edfdcfb86798f2c0f8729d9387662fa4eba6f64e1f2467ca6121ce58a
acc9b2f67f97c1980ad62903e279dcf3fcd8a08ccb9893aa71a46181a985b886