m.fbmessenger.workers.dev Open in urlscan Pro
2606:4700:3030::ac43:94f1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response m.fbmessenger.workers.dev/	5 KB 3 KB	16012ms 15927ms	Document text/html	2606:4700:3030::ac43:94f1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://m.fbmessenger.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:94f1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 153d8302a8e94c50aa12dbc3a8c9effa0ad60787539a7164301230f9c6dfbdac Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 71cc144e3e388fd4-FRA content-encoding br content-type text/html; charset=UTF-8 date Fri, 17 Jun 2022 13:20:07 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hY5rCoMRx81tkH10WVSVyCp2n8NRYBOgNcQj%2FaYvLdhEBKk7wwkJ2AjWZzPcEKq5nUONHqboZrVTeTd626NUqk%2FzVsvKgQE9ynBCYnfOIeKy1D21t7WZxlwqq%2BWIfNW8QrjuJVuRQBibMv2lvI3iZil7mANoBkQO"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff x-request-id 578803ef8c4cc05b65242c0f3c3b2c2f x-xss-protection 1; mode=block
GET H2	200	css fonts.googleapis.com/	5 KB 1 KB	137ms 49ms	Stylesheet text/css	2a00:1450:400e:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Nunito+Sans:300i,400,700&display=swap Requested by Host: m.fbmessenger.workers.dev URL: https://m.fbmessenger.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400e:811::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash eb8b3f6f66843e9850feeddd40311ecd9db283c6c6b0942493f789c88472cf25 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://m.fbmessenger.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 17 Jun 2022 13:20:08 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Fri, 17 Jun 2022 13:20:08 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 17 Jun 2022 13:20:08 GMT
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/5.0.0-alpha1/css/	142 KB 23 KB	126ms 47ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/5.0.0-alpha1/css/bootstrap.min.css Requested by Host: m.fbmessenger.workers.dev URL: https://m.fbmessenger.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 21d7c871495a30136d9381e3b7463a58c319c8c5343fd3cdfe91fe0c5ccac5b2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://m.fbmessenger.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers date Fri, 17 Jun 2022 13:20:08 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617, 617 age 12374626 cdn-cachedat 2021-06-08 14:13:20 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 35bb7e3b47be977443ae2275645fcdf1 cf-ray 71cc14b24f7e904e-FRA cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	logo.svg ali-abdullah-1.000webhostapp.com/HIDDEN-TESTS/FB/	2 KB 1 KB	462ms 139ms	Image image/svg+xml	2a02:4780:dead:7479::1 AWEX
General Check archive.org Show headers Download Go to Show image Full URL https://ali-abdullah-1.000webhostapp.com/HIDDEN-TESTS/FB/logo.svg Requested by Host: m.fbmessenger.workers.dev URL: https://m.fbmessenger.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:7479::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://m.fbmessenger.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers date Fri, 17 Jun 2022 13:20:08 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 08 Mar 2022 12:47:20 GMT server awex content-type image/svg+xml x-xss-protection 1; mode=block x-request-id 73b6bba6ae9ec541fabe24c573004bef
GET H2	200	pe0qMImSLYBIv1o4X1M8cce9I9s.woff2 fonts.gstatic.com/s/nunitosans/v12/	17 KB 17 KB	122ms 39ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9s.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300i,400,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://m.fbmessenger.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers date Mon, 13 Jun 2022 11:07:43 GMT x-content-type-options nosniff age 353545 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16980 x-xss-protection 0 last-modified Mon, 09 May 2022 18:33:54 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 Jun 2023 11:07:43 GMT
GET H2	200	pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2 fonts.gstatic.com/s/nunitosans/v12/	17 KB 17 KB	133ms 50ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300i,400,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 280aaa8929329764ac3213ca093c63505cfcc665347939c79905c426d33867c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://m.fbmessenger.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers date Mon, 13 Jun 2022 20:55:52 GMT x-content-type-options nosniff age 318256 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17116 x-xss-protection 0 last-modified Mon, 09 May 2022 18:31:19 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 Jun 2023 20:55:52 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| myFunction object| x

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ali-abdullah-1.000webhostapp.com
fonts.googleapis.com
fonts.gstatic.com
m.fbmessenger.workers.dev
stackpath.bootstrapcdn.com
2606:4700:3030::ac43:94f1
2606:4700::6812:acf
2a00:1450:4001:80b::2003
2a00:1450:400e:811::200a
2a02:4780:dead:7479::1
153d8302a8e94c50aa12dbc3a8c9effa0ad60787539a7164301230f9c6dfbdac
21d7c871495a30136d9381e3b7463a58c319c8c5343fd3cdfe91fe0c5ccac5b2
280aaa8929329764ac3213ca093c63505cfcc665347939c79905c426d33867c5
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787
eb8b3f6f66843e9850feeddd40311ecd9db283c6c6b0942493f789c88472cf25