urlscan.io logo urlscan.io
SecurityTrails logo

red-ducks.static.domains Open in urlscan Pro
2606:4700:20::ac43:4935  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://red-ducks.static.domains/
Submission: On May 31 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2606:4700:20::ac43:4935, located in United States and belongs to CLOUDFLARENET, US. The main domain is red-ducks.static.domains.
TLS certificate: Issued by GTS CA 1P5 on April 14th 2024. Valid for: 3 months.
This is the only time red-ducks.static.domains was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:50c0:800... 54113 (FASTLY)
2 199.232.196.193 54113 (FASTLY)
1 2a05:d014:58f... 16509 (AMAZON-02)
8 4
Apex Domain
Subdomains		 Transfer
4 static.domains
red-ducks.static.domains
5 KB
2 imgur.com
i.imgur.com — Cisco Umbrella Rank: 7840
49 KB
1 netlify.app
help-pages-verificatio-meta.netlify.app
21 KB
1 github.io
meta-submit.github.io
2 KB
8 4
Domain Requested by
4 red-ducks.static.domains red-ducks.static.domains
2 i.imgur.com red-ducks.static.domains
1 help-pages-verificatio-meta.netlify.app red-ducks.static.domains
1 meta-submit.github.io red-ducks.static.domains
8 4

This site contains links to these domains. Also see Links.

Domain
detailed-video-29b30.web.app
Subject Issuer Validity Valid
static.domains
GTS CA 1P5		 2024-04-14 -
2024-07-13		 3 months crt.sh
*.github.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-03-15 -
2025-03-14		 a year crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA		 2024-02-15 -
2025-02-14		 a year crt.sh
*.netlify.app
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-01-15 -
2025-02-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://red-ducks.static.domains/
Frame ID: 13ADAA2080FE678FCF6E279DD5D6388B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Action Required | Facebook

Page Statistics

8
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

77 kB
Transfer

89 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
red-ducks.static.domains/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4935 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a7d917bbf27d504d3d7417a2253327124f8e7f14df778f231d6b3e717d937f2

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cf-cache-status
DYNAMIC
cf-ray
88c6a783bad071bf-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 31 May 2024 11:34:22 GMT
last-modified
Wed, 29 May 2024 12:14:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uJUlmAc9XWtX8rN5yFk%2FOzkW8rE2ux%2BTp%2FP23voi4eBDf%2FJCQAGU75BlQjy7UOWvcdFxwHh0%2BGqQdWIBEQvXSTLkKluzuNDTrTtOulYT86hwGsmipLkb19S9paTQzxkC8Yx3t8Dh6rIw5HhivbMBLmy86j99Dw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
style.css
red-ducks.static.domains/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://red-ducks.static.domains/style.css
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4935 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 11:34:22 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOcTJMMdtdBxRyISX37LzCfmIEJi9GfDj5U%2BOj7qsK4SDJmdQ6zZ%2F2umcfdtPqI3PNipoQDFpSR1mep2HkFhvLwyLnw30NHyYU88tGikKCi0PJh1oqHE%2B0qX%2BZX9e0S1Ku0N9crqb6IhQsL%2B7AmsK3JuTeeouQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
cf-ray
88c6a7851c8d71bf-FRA
style.css
meta-submit.github.io/report-isuess-fb-request-now/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://meta-submit.github.io/report-isuess-fb-request-now/style.css
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:50c0:8002::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
602f90916d6306c71bc8179316361289a2d60929d370003e59c8f21e815a7fef
Security Headers
Name Value
Strict-Transport-Security max-age=31556952

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-fastly-request-id
18abcd30951534dbe0a6ce5aef678a901aa0168d
strict-transport-security
max-age=31556952
content-encoding
gzip
via
1.1 varnish
date
Fri, 31 May 2024 11:34:22 GMT
age
56
x-cache
HIT
x-cache-hits
1
x-proxy-cache
MISS
content-length
2059
x-served-by
cache-fra-etou8220070-FRA
last-modified
Tue, 27 Feb 2024 12:45:26 GMT
server
GitHub.com
x-github-request-id
4D4A:23EDA5:9B42FE:9FC4AC:66599875
x-timer
S1717155262.315637,VS0,VE2
etag
W/"65ddd966-242b"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=600
permissions-policy
interest-cohort=()
accept-ranges
bytes
expires
Fri, 31 May 2024 09:39:25 GMT
ZcUp73J.png
i.imgur.com/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/ZcUp73J.png
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.196.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
de4a9c8b6104b3f4c05a7c7a8a8d3fb5e3dccd0e5cb803194c43dc4cce88e58b
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 11:34:22 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD55-P2
age
1536209
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
2559
x-served-by
cache-iad-kiad7000146-IAD, cache-fra-etou8220021-FRA
last-modified
Thu, 11 Apr 2024 02:14:28 GMT
server
cat factory 1.0
x-timer
S1717155262.307806,VS0,VE1
etag
"526470e3443645b0c0a1a2287235a6bf"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
WVkix4bl4gWv6KFL1ija9ECT5vSgELxsBm3fMPiFzlT-7Ut6ZmcnkA==
x-cache-hits
3, 1
downloadssss.png
help-pages-verificatio-meta.netlify.app/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://help-pages-verificatio-meta.netlify.app/downloadssss.png
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:58f:6201::64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Netlify /
Resource Hash
425d00ccdefa339edc7e1ac93fce90d8ad66290839b7034dbf7456252e6902f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-nf-request-id
01HZ76VVVADB4F0NV9E0NP0CAG
date
Fri, 31 May 2024 11:34:22 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
Netlify
age
1179
cache-status
"Netlify Edge"; hit
etag
"27180a38d6a1047c1a43842c4c1a2ce6-ssl"
content-type
image/png
cache-control
public,max-age=0,must-revalidate
accept-ranges
bytes
content-length
21262
gE3Re3K.jpeg
i.imgur.com/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/gE3Re3K.jpeg
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.196.193 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
089fa2290c158565fb8333c1370e3a1f90ad82de767c9ec172e0d4e0e1eb67b8
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 11:34:22 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
2046584
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
46793
x-served-by
cache-iad-kiad7000161-IAD, cache-fra-etou8220021-FRA
last-modified
Fri, 19 Apr 2024 08:14:25 GMT
server
cat factory 1.0
x-timer
S1717155262.307712,VS0,VE2
etag
"1d8b907d73a6a1f5f7a67cfecd1fe5af"
access-control-allow-methods
GET, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
EPcU2kjlYNweYIR50863C6nBiIZ-iN49KzQCGRVj39f__rUsJiXJkw==
x-cache-hits
18, 1
index.1ca789be.js
red-ducks.static.domains/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://red-ducks.static.domains/index.1ca789be.js
Requested by
Host: red-ducks.static.domains
URL: https://red-ducks.static.domains/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4935 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 11:34:22 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HChxiPqyXQ4AgkdJPjJLOw38S1TApTfr%2BeeLMX44a5zFREDFercdiL5f%2Fb1N9IMnjEEB0BGmIVPsIipIe3UDwn618sVcGZxxwaHp7nY3KS6O4hOtNJ%2B6H7YkJwOcQ3vJgSRVm6mnJBmrvp3bvg%2Fwl8IGW0NLsA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
cf-ray
88c6a7857d2871bf-FRA
favicon.ico
red-ducks.static.domains/ 		7 KB
3 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://red-ducks.static.domains/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4935 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb7fe84c46a14cd9fae22f12ef6892ff0954d01006bf4cc18887827dc1f69477

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://red-ducks.static.domains/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 11:34:22 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2BobhOLaiqANOKS%2FdxUdnq15UyOvlSa0CIvmQ87JuitcNDNFRhmA%2FhgJtUxB%2BliFHNhETeVXJHAVFz%2FmtsxmTvfrpoJklyIBTwR7teWhRGxd%2BLSfB0s3Rx0k19idrwUEcjeluzxReMSlxln1v0li2lwWWwYUAA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
cf-ray
88c6a7872f8f71bf-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://red-ducks.static.domains/style.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://red-ducks.static.domains/index.1ca789be.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://red-ducks.static.domains/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()