xafafw3rhc78.automating-platform-solution-provisioning.cfd Open in urlscan Pro
2606:4700:3037::6815:59af Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g/////////
Effective URL:
https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g/////////
Submission: On April 22 via api (April 22nd 2024, 10:55:19 pm UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3037::6815:59af, located in United States and belongs to CLOUDFLARENET, US. The main domain is xafafw3rhc78.automating-platform-solution-provisioning.cfd.
TLS certificate: Issued by E1 on April 21st 2024. Valid for: 3 months.

This is the only time xafafw3rhc78.automating-platform-solution-provisioning.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3037::6815:59af	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	143.204.98.112 143.204.98.112	16509 (AMAZON-02) (AMAZON-02)
11	2

10 2606:4700:3037::6815:59af (United States)

ASN13335 (CLOUDFLARENET, US)

xafafw3rhc78.automating-platform-solution-provisioning.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-112.fra50.r.cloudfront.net

sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	automating-platform-solution-provisioning.cfd xafafw3rhc78.automating-platform-solution-provisioning.cfd	177 KB
1	amazonaws.com sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com	778 B
11	2

	Domain	Requested by
10	xafafw3rhc78.automating-platform-solution-provisioning.cfd	xafafw3rhc78.automating-platform-solution-provisioning.cfd
1	sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com	xafafw3rhc78.automating-platform-solution-provisioning.cfd
11	2

This site contains no links.

Subject Issuer	Validity	Valid
automating-platform-solution-provisioning.cfd E1	`2024-04-21` - `2024-07-20`	3 months	crt.sh
*.execute-api.ap-southeast-1.amazonaws.com Amazon RSA 2048 M02	`2024-01-23` - `2025-02-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g/////////
Frame ID: 30E89742AE19A561F42F2A864DC41562
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Meta | Facebook

Page URL History Show full URLs

http://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// HTTP 307
https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

178 kB
Transfer

345 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// HTTP 307
https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/ Redirect Chain http://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g/////////	21 KB 4 KB	898ms 872ms	Document text/html	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.30 Resource Hash `e91d3d8c40f52a89c83e4572b053e9dbc18053a12ec779121253fc2f9cd921e1` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 87893342df6318db-FRA content-encoding br content-type text/html; charset=UTF-8 date Mon, 22 Apr 2024 22:55:15 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VW68qKFHNfGqImEDbzdQLxzAGMPD9W6cjA3CgDpYKBML16CcNTLTQVhHiD1Xiyh03XsDk0iBygT1%2B6tXAyIVGJFVfqOf%2FWn%2BWbEYlcp5UfD%2FKoVtP0F0xOzs%2BNTU%2BfNW7aba76WNJk1vWF%2BLLEDZs8613LA7HKgGh0z7QWOtJbiolSb6XpK%2FNMpl88gdYMcseBRLnsyfpTJt"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent x-powered-by PHP/7.4.30 Redirect headers Location https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Non-Authoritative-Reason HttpsUpgrades
GET H3	200	index.css xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/	12 KB 4 KB	16ms 16ms	Stylesheet text/css	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/index.css Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4790a6b8eaa14592d25939c439a0de01f0b82689808f907c2a1ad7885149f7db` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT content-encoding br cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag W/"2f72-61670edbd0540-gzip" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6MwZOtMH5%2B3EFKp5eRs33oOPA12ZGvCoNTcqtin1WMsZOuSFNMnzRoHVzrhynmbylDI8GegkeGB9IDPtX0Ckhr1TYGnakVE8FcUwbLHlPEIBCY2V2My7YUBHC0kXisY64gIjWX2pGliIyKRzXfZ3wGK%2F37d0F4udwUbawcmSZspyJFaWOByG0BCh9VyqHaIEdF7tpZ9xarlP"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 878933484b1a18db-FRA alt-svc h3=":443"; ma=86400
GET H3	200	jquery.js Show response xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/	87 KB 32 KB	22ms 22ms	Script application/javascript	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/jquery.js Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT content-encoding br cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag W/"15d83-61670edbd0540-gzip" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2FHtICu13ynMEW%2FkTj2e9S6FdZghg%2B2%2BLr69wVTxm8JCWleDQAiPltBizBSyc8oxKjB6dkCwvLAG9ywbVAzE96N5eNbwuzRF9QfjIn6830IMzsGfnhivcBQTMxK4r5muM16EPtA5SKUBhPWhRhmsGC0HiWxuf3nlFjK%2BHQ3ZOkzdnKcytXZCnKyRUPHo%2FCXPwcssRzNScaDa"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 878933484b1b18db-FRA alt-svc h3=":443"; ma=86400
GET H3	200	index.js Show response xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/	119 KB 30 KB	29ms 29ms	Script application/javascript	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/index.js Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d86e74ffd70ff0ba8dc7d3bbca86317e415fba42fd810e2d4e693494a3b55fc3` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT content-encoding br cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag W/"1dd5f-61670edbd0540-gzip" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WADbLuQ1s4Shg4%2FANekALs3GtdZ8rY4Po9KLu2Xsg7H58nwLBnxqaOFInrvmmy5FohvzucypJ1IE2WRf9V4BOZnuCrhKCkTbfDo5fa%2FNRPS%2Fnu1PmV791%2FAMzTILk8z7DZLmxLtfMYedhDgeqooud2gj4tEUUk%2BVW%2B8h4UuCDqyD5LbhTNRUW9plVbQMGh%2F3qSn6OhoEXOZX"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 878933484b1d18db-FRA alt-svc h3=":443"; ma=86400
GET H3	200	brand.png xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	7 KB 7 KB	31ms 30ms	Image image/png	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/brand.png Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `60817845b8570782f6d19667bc12b5e2c0f59ce59f00a1fd18d049969c074bd4` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag "1a7e-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W05tZZRKCapkRNSiTNyEJR1YzThOf0yVCLA9VNqp9jJFQT2C3mv7jjlKgpJOue3Iyi%2F3I%2BMKqDHBBsyI1D%2B%2BjQVbRW89gTUL1FUGyDz%2FFtmnyeN64oVnSVgXEIOYJ3%2FBoJqtzV3DqCBsn9nvikZTkOSWBYFSuzi%2Fbgw789I2Jvzh6J7s9%2FtfLrmkNfOJ2JF7KxprjjNCrJMY"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 878933484b1f18db-FRA alt-svc h3=":443"; ma=86400 content-length 6782
GET H3	200	block.png xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	18 KB 19 KB	18ms 17ms	Image image/png	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/block.png Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9b7c1670777cc38a18fc6b98443b40036fde8de97cdba6087e2a31a1de9e748b` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag "4963-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hNZd9Y4RJgOIkaM8E6QTgtQMeT4Q8c4kpAIKZGDGAHV%2Fn0iQH4JA6LTRzzRQ5q2Y8w6LXMb857m18kHV9350Vfq7JDB7C6MBw1yAKdEh1a9k2Hh47SfPIM0Wth2XxYgwE12qELFd%2B9WICAhRFMoSRPUl5Vd3xHCmLIt7OzutZ5QIv3M%2FvCG6cZ%2BZYSYL3V96T3ySZRbeNWGI"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 878933484b2218db-FRA alt-svc h3=":443"; ma=86400 content-length 18787
GET H3	200	shield.jpg xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	32 KB 32 KB	18ms 18ms	Image image/jpeg	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/shield.jpg Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8956b37adc46f5a131257c12cf598bc6ac255c33a489fb02262d81f6d6d141df` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag "7f60-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ftNlarm%2B2bGO%2FR1P3tNwjLQx0EeXx7pzZwn3ad2AN%2F2tJNX4ZWYUI2Gf4hpp8bzeOJbUbpkvap4FVUNCvLcy462tSRgTTWV%2BUQnKmfY1ceertkf37o2vESeFtqigX3AGlR20ALsUyuk2GOzlA7%2BzmRxnjM47ABh7LGaiWr4PQyL0hFJKG3wE4cvp%2BUUea%2BwL3psZ3cuUdER"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 878933488b4418db-FRA alt-svc h3=":443"; ma=86400 content-length 32608
GET H3	200	shield_user.png xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	7 KB 8 KB	16ms 16ms	Image image/png	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/shield_user.png Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8fc3f44a189200b47c93a90ad8dffe40fcdeda8a718e62bb4baf98f00d536e97` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1018 etag "1d7e-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hi4ET3QJAeynIvoe3QCtL3IDi0EoEl9crNoPz%2FF4PEUIiovmnACxc79QPVOcvHVI4Sc7BIYscWu5Cr8Kz7dTZ%2FLccUc1Dr7fDCk7HCGMVPmKZZgfhbv4V9VVfLvssVLWbhKiafuEeVnjmbOsBaysRDS%2BqfrFpnL9KBTfIlFtNsiMhc77Y2eCvveC75%2FvsMRYAmw9vMS9YDxy"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 878933488b4618db-FRA alt-svc h3=":443"; ma=86400 content-length 7550
GET H3	200	doc.png xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	6 KB 6 KB	17ms 17ms	Image image/png	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/doc.png Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e341d9055288dfcd7dd5facab6c915f6b7bcffbf80f8b48468c7275b8cada069` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1017 etag "165b-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kk49CLSPR6cEoNgCtq9F6%2FhPlYy8SdU%2Blpd1fRwX112QHO78AkmT2GF5VXcROhqbc9Vt3M6f8%2BP0l3WA1tZR7YVYGhuhTUutwYG0RdUMJIfZKLYBVtLzkHstVCEmEXlsFqGjsBmmZRx%2BdEChD6NWSyu4XvVKTXcILxFki7jaPICvuE0b0Qg9fw1IptFifU1Ha%2FE4nVMpO4Qf"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 878933489b4c18db-FRA alt-svc h3=":443"; ma=86400 content-length 5723
GET H2	200	v1 Show response sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com/	378 B 778 B	855ms 823ms	XHR application/json	143.204.98.112 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com/v1?%22%22 Requested by Host: xafafw3rhc78.automating-platform-solution-provisioning.cfd URL: https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/assets/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.112 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-112.fra50.r.cloudfront.net Software / Resource Hash `35b6d1c1ee413e9e6ae9a934fb9a6a2ea1ea500a29d2678d681f8aa61b71517c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Accept / Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:16 GMT via 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amzn-trace-id Root=1-6626ead3-3ead763309d08ab4715da60c;Parent=75553b2229e54014;Sampled=0;lineage=d3962f68:0 x-amzn-requestid 0ec10541-b596-4bd7-bc7f-f7e2c91c63ed x-cache Miss from cloudfront content-type application/json access-control-allow-origin * x-amz-apigw-id WpmhJE3BSQ0EcPQ= content-length 378 x-amz-cf-id G-PNyTSdPAO1vbDFJ-D4DVltOZ7i8JpZZAc8moSfvliDe1rJZ8ZQSQ==
GET H3	200	logo.png xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/	35 KB 35 KB	15ms 15ms	Other image/png	2606:4700:3037::6815:59af CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/images/logo.png Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:59af , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `62ebfab29cdf3c417eb48e9c429133d6c4d1b8ddb27fc14820a57b9d5a617ae8` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://xafafw3rhc78.automating-platform-solution-provisioning.cfd/review-case/?id=2204vhnb5g///////// Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 22 Apr 2024 22:55:15 GMT cf-cache-status HIT last-modified Fri, 19 Apr 2024 10:55:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1017 etag "8b20-61670edbd0540" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zg5GDQNGpg2fbcSf%2BuT1hB5w5hMl96WfTplMIq%2B5nEKLAqzf3hBs55WpbzNtoraqoodbtir59S1hqgEPt5hTqZ8WE%2BaYCaVgNmHYelA3e9xWKobPcsRbGpPhUtybDVg4Ahdj33iQtphkUTodP23waomUwZNmko1tNINR%2BQSISJuCjtouwptv%2BBOkbPeyW6kCXWe80qQ3OPFH"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 87893348bb6618db-FRA alt-svc h3=":443"; ma=86400 content-length 35616

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _0x48e9 function| _0x178f

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sjyhylfyp8.execute-api.ap-southeast-1.amazonaws.com
xafafw3rhc78.automating-platform-solution-provisioning.cfd
143.204.98.112
2606:4700:3037::6815:59af
35b6d1c1ee413e9e6ae9a934fb9a6a2ea1ea500a29d2678d681f8aa61b71517c
4790a6b8eaa14592d25939c439a0de01f0b82689808f907c2a1ad7885149f7db
60817845b8570782f6d19667bc12b5e2c0f59ce59f00a1fd18d049969c074bd4
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
62ebfab29cdf3c417eb48e9c429133d6c4d1b8ddb27fc14820a57b9d5a617ae8
8956b37adc46f5a131257c12cf598bc6ac255c33a489fb02262d81f6d6d141df
8fc3f44a189200b47c93a90ad8dffe40fcdeda8a718e62bb4baf98f00d536e97
9b7c1670777cc38a18fc6b98443b40036fde8de97cdba6087e2a31a1de9e748b
d86e74ffd70ff0ba8dc7d3bbca86317e415fba42fd810e2d4e693494a3b55fc3
e341d9055288dfcd7dd5facab6c915f6b7bcffbf80f8b48468c7275b8cada069
e91d3d8c40f52a89c83e4572b053e9dbc18053a12ec779121253fc2f9cd921e1

xafafw3rhc78.automating-platform-solution-provisioning.cfd Open in urlscan Pro 2606:4700:3037::6815:59af Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

178 kBTransfer

345 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

xafafw3rhc78.automating-platform-solution-provisioning.cfd Open in urlscan Pro
2606:4700:3037::6815:59af Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

178 kB
Transfer

345 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!