live-news-63922671214.azureedge.net
Open in
urlscan Pro
2620:1ec:bdf::45
Malicious Activity!
Public Scan
Submission: On July 16 via manual from PL — Scanned from DE
Summary
This is the only time live-news-63922671214.azureedge.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2620:1ec:bdf::45 2620:1ec:bdf::45 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5714 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2603:1020:c01... 2603:1020:c01:4::40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2001:4860:480... 2001:4860:4802:32::36 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
14 | 7 |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
live-news-63922671214.azureedge.net |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
danielhar.containers.piwik.pro | |
danielhar.piwik.pro |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
piwik.pro
danielhar.containers.piwik.pro danielhar.piwik.pro |
88 KB |
4 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2603 www.google-analytics.com — Cisco Umbrella Rank: 69 |
20 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 101 |
110 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 459 |
25 KB |
1 |
azureedge.net
live-news-63922671214.azureedge.net |
59 KB |
14 | 5 |
Domain | Requested by | |
---|---|---|
4 | danielhar.piwik.pro |
danielhar.containers.piwik.pro
|
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | danielhar.containers.piwik.pro |
live-news-63922671214.azureedge.net
|
2 | www.googletagmanager.com |
live-news-63922671214.azureedge.net
www.googletagmanager.com |
1 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | cdn.jsdelivr.net |
live-news-63922671214.azureedge.net
|
1 | live-news-63922671214.azureedge.net | |
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1C3 |
2022-06-27 - 2022-09-19 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
*.containers.piwik.pro GlobeSSL DV CA |
2021-08-17 - 2022-09-08 |
a year | crt.sh |
*.piwik.pro GlobeSSL DV CA |
2022-01-10 - 2023-01-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://live-news-63922671214.azureedge.net/gb/facebook/login/index.html
Frame ID: BAC56503C64780926358312A9DB7C40C
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
live-news-63922671214.azureedge.net/gb/facebook/login/ |
59 KB 59 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
196 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.js
danielhar.containers.piwik.pro/ |
228 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
103 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 360 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppms.js
danielhar.containers.piwik.pro/ |
78 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
1 B 21 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
collect
www.google-analytics.com/ |
35 B 55 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| dataLayer object| ppms function| gtag function| getCookie string| ssid object| _0x38d5 function| _0x5b6c function| _0x5d242a object| _0xdb4b function| _0x588151 function| _0x29e7 function| setCookie function| setValues object| google_tag_manager function| onYouTubeIframeAPIReady object| google_tag_data object| gaGlobal string| GoogleAnalyticsObject function| ga string| SYNC_EVENT string| ONCE_PER_PAGE_VIEW_ACTION string| ONCE_PER_SESSION_ACTION string| VARIABLE_NAME string| COOKIE_PREFIX string| GLOBAL_CONFIG_NAME function| ppmsWebStorage object| sevenTag object| _paq object| Piwik object| AnalyticsTracker function| piwik_log object| gaplugins object| gaData11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
live-news-63922671214.azureedge.net/ | Name: host Value: aHR0cDovL2xpdmUtbmV3cy02MzkyMjY3MTIxNC5henVyZWVkZ2UubmV0L2diL2ZhY2Vib29rL2xvZ2luL2luZGV4Lmh0bWw%3D |
|
.azureedge.net/ | Name: _ga_9Z3VZZZJ2S Value: GS1.1.1657965021.1.1.1657965021.0 |
|
live-news-63922671214.azureedge.net/ | Name: stg_returning_visitor Value: Sat%2C%2016%20Jul%202022%2009:50:21%20GMT |
|
live-news-63922671214.azureedge.net/ | Name: stg_traffic_source_priority Value: 1 |
|
live-news-63922671214.azureedge.net/ | Name: stg_externalReferrer Value: |
|
live-news-63922671214.azureedge.net/ | Name: stg_last_interaction Value: Sat%2C%2016%20Jul%202022%2009:50:21%20GMT |
|
live-news-63922671214.azureedge.net/ | Name: _pk_id.9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.52eb Value: 0a77bfc668962a8f.1657965022.1.1657965022.1657965022. |
|
live-news-63922671214.azureedge.net/ | Name: _pk_ses.9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.52eb Value: * |
|
.azureedge.net/ | Name: _ga Value: GA1.2.1976637492.1657965021 |
|
.azureedge.net/ | Name: _gid Value: GA1.2.1713529952.1657965022 |
|
.azureedge.net/ | Name: _gat_gtag_UA_219740429_1 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
danielhar.containers.piwik.pro
danielhar.piwik.pro
live-news-63922671214.azureedge.net
region1.google-analytics.com
www.google-analytics.com
www.googletagmanager.com
2001:4860:4802:32::36
2603:1020:c01:4::40
2606:4700::6810:5714
2620:1ec:bdf::45
2a00:1450:4001:812::200e
2a00:1450:4001:828::2008
0a0d44b2cca6a7a241e4efcd42ea3557927c327576765e6e4f519aae59e65c8f
407150686717e7d25a1fc2dbee046b05e2f820b8e4719dfc9b7d4efc24f6a664
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a36f4879a86ad9ba668a4df9efb8fb50d256bbd7310abc51f92617c014b7e75a
a819bdfc9068eadadc3d3e2039284344b68faebfd6b7e7f464326437353698c6
aa627141fc46c1659bad26a2c2c5e203bc3400115b2245f4e4191b6eabbcfc4a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1fe8e8946b667e9900d7f97b777836dfc78e08b968f49cf16bb5368b7bf92b2
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194