pemulihanakunfacebook.duckdns.org Open in urlscan Pro
40.88.36.128  Malicious Activity! Public Scan

URL: http://pemulihanakunfacebook.duckdns.org/
Submission: On January 25 via api from JP — Scanned from JP

Summary

This website contacted 10 IPs in 4 countries across 9 domains to perform 22 HTTP transactions. The main IP is 40.88.36.128, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is pemulihanakunfacebook.duckdns.org.
This is the only time pemulihanakunfacebook.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 40.88.36.128 8075 (MICROSOFT...)
9 18.65.219.96 16509 (AMAZON-02)
4 2600:140b:2::... 20940 (AKAMAI-ASN1)
1 2600:140b:400... 20940 (AKAMAI-ASN1)
2 2404:6800:400... 15169 (GOOGLE)
1 172.96.140.18 23470 (RELIABLESITE)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
22 10
Apex Domain
Subdomains
Transfer
9 cloudfront.net
d1di2lzuh97fh2.cloudfront.net
119 KB
5 typekit.net
use.typekit.net — Cisco Umbrella Rank: 509
p.typekit.net — Cisco Umbrella Rank: 656
239 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 42
20 KB
1 google.co.jp
www.google.co.jp — Cisco Umbrella Rank: 16544
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 13
501 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 96
457 B
1 gstatic.com
fonts.gstatic.com
13 KB
1 ibb.co
i.ibb.co — Cisco Umbrella Rank: 13610
126 KB
1 duckdns.org
pemulihanakunfacebook.duckdns.org
14 KB
22 9
Domain Requested by
9 d1di2lzuh97fh2.cloudfront.net pemulihanakunfacebook.duckdns.org
4 use.typekit.net pemulihanakunfacebook.duckdns.org
use.typekit.net
2 www.google-analytics.com pemulihanakunfacebook.duckdns.org
www.google-analytics.com
1 www.google.co.jp pemulihanakunfacebook.duckdns.org
1 www.google.com pemulihanakunfacebook.duckdns.org
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.gstatic.com d1di2lzuh97fh2.cloudfront.net
1 i.ibb.co pemulihanakunfacebook.duckdns.org
1 p.typekit.net use.typekit.net
1 pemulihanakunfacebook.duckdns.org
22 10

This site contains links to these domains. Also see Links.

Domain
us.webnode.com
Subject Issuer Validity Valid
*.cloudfront.net
Amazon
2021-03-19 -
2022-03-17
a year crt.sh
use.typekit.net
DigiCert TLS RSA SHA256 2020 CA1
2021-08-16 -
2022-08-16
a year crt.sh
*.typekit.net
DigiCert TLS RSA SHA256 2020 CA1
2021-12-05 -
2022-12-06
a year crt.sh
ibb.co
R3
2021-12-05 -
2022-03-05
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh
www.google.com
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh
*.google.co.jp
GTS CA 1C3
2021-12-27 -
2022-03-21
3 months crt.sh

This page contains 1 frames:

Primary Page: http://pemulihanakunfacebook.duckdns.org/
Frame ID: 52CA06C981032815E9D5DBB648A1684F
Requests: 22 HTTP requests in this frame

Screenshot

Page Title

Confirm Your Account

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

22
Requests

91 %
HTTPS

70 %
IPv6

9
Domains

10
Subdomains

10
IPs

4
Countries

533 kB
Transfer

1858 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://www.google-analytics.com/analytics.js HTTP 307
  • https://www.google-analytics.com/analytics.js

22 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
pemulihanakunfacebook.duckdns.org/
14 KB
14 KB
Document
General
Full URL
http://pemulihanakunfacebook.duckdns.org/
Protocol
HTTP/1.1
Server
40.88.36.128 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Apache /
Resource Hash
53dd233e0d027cda6e575fd09d76c21cfa2995ca9d47f0005099cebfa5a51585

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

Date
Tue, 25 Jan 2022 20:05:23 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
1ca3k0.css
d1di2lzuh97fh2.cloudfront.net/files/1c/1ca/
292 KB
41 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/1c/1ca/1ca3k0.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f67ab6516bdefc5fed533d855e4e52b3bf9c7ee3517274fa3e20b28cfde089eb

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 10 Jan 2022 00:30:54 GMT
content-encoding
br
last-modified
Wed, 13 Oct 2021 10:28:32 GMT
server
AmazonS3
age
1366470
etag
W/"4d560803861194efe9ebbb6bb41b1484"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
vomlQqW4OjmD-oLVEZpd2u2S1Ue3GmxNp19H9q5L5yxOMyVyaOoqIw==
05t3z1.css
d1di2lzuh97fh2.cloudfront.net/files/05/05t/
219 KB
24 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/05/05t/05t3z1.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
82e766d66f4d4bab9ec2d6d9a1642b79c373d38ad4197f03bdf5aee33e7eb23b

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 11 Jan 2022 15:45:45 GMT
content-encoding
br
last-modified
Wed, 13 Oct 2021 10:28:07 GMT
server
AmazonS3
age
1225178
etag
W/"094de5dbfd32d8503ae7fad89a4237b4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
y_cd8sAX9Z_ukVfkIBS8GH9URNDPL4nFU8IyLXNJvJ78aPgZj1Dlzw==
1w0qqc.css
d1di2lzuh97fh2.cloudfront.net/files/1w/1w0/
341 KB
23 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/1w/1w0/1w0qqc.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d799989df3fde078643aa1282b62735cd02c37cc0a8f3f9922aafcf5a6483792

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 11 Jan 2022 15:45:45 GMT
content-encoding
br
last-modified
Sun, 10 Oct 2021 12:40:37 GMT
server
AmazonS3
age
1225178
etag
W/"6cf4b5498744557e0c7112491ec15c4d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
eRfGtFtjvI-dPNEP4LbVuFUpoKBN_JUG2iIEX5B47Zti2ZZY4hFVcA==
0pinaw.css
d1di2lzuh97fh2.cloudfront.net/files/0p/0pi/
227 KB
12 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/0p/0pi/0pinaw.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a85c51779bce09c1cb280730861a71aa8882580697b0b6bb4ff6e02d48843d97

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 17 Dec 2021 15:48:21 GMT
content-encoding
br
last-modified
Tue, 05 Oct 2021 07:21:32 GMT
server
AmazonS3
age
3385023
etag
W/"28dff785d85e158b070a6a4ecc1d464b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
Hej-2mLjuVEQZ3lJeAZqrm945GkRh8IAt_3MDIeYQ6bnDdJXKSQfjQ==
3qwf53.css
d1di2lzuh97fh2.cloudfront.net/files/3q/3qw/
924 B
694 B
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/3q/3qw/3qwf53.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d54a6842b090600ecc0fb9ac3574c8466240565156c8203228a9b8e9d3f5eaa5

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 11 Jan 2022 15:45:45 GMT
content-encoding
gzip
last-modified
Mon, 27 Sep 2021 08:06:06 GMT
server
AmazonS3
age
1225179
etag
"58212ae28eae0e5a725405ba147f48c7"
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
accept-ranges
bytes
content-length
314
x-amz-cf-id
m_vakJ5vwLiHjAD2xCIoCLeUYjaD0ouV8GzfNlGRcE6Jw8dC-3jsow==
2mylv7.css
d1di2lzuh97fh2.cloudfront.net/files/2m/2my/
45 KB
5 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/2m/2my/2mylv7.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4435b5a2cf70d9413e1da031a50e5c6869c164ed347ae8f01a6b3916fdc0b267

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 10 Jan 2022 00:30:53 GMT
content-encoding
br
last-modified
Thu, 30 Sep 2021 12:09:23 GMT
server
AmazonS3
age
1366470
etag
W/"981c133727174326e10e0711073533cd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
d-J4zmmoNyEAmBMpRsJfMdGmhiDEM50AotAiTQeWgpgUmtAZUXKwZQ==
0ld5qz.css
d1di2lzuh97fh2.cloudfront.net/files/0l/0ld/
7 KB
2 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/0l/0ld/0ld5qz.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cc4bf7ef49fdc6595bdacca83e617ea391b02dd72fdf9f72c32276989870a809

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 11 Jan 2022 15:45:45 GMT
content-encoding
br
last-modified
Thu, 30 Sep 2021 12:08:35 GMT
server
AmazonS3
age
1225178
etag
W/"223935bec71393436483b257d666e2a0"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
yQ32btwrOF0dWdhiqF4g96DKAWH744W6s_g_F1lszvnfKF2tVZV3mQ==
049m4z.css
d1di2lzuh97fh2.cloudfront.net/files/04/049/
254 KB
9 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/04/049/049m4z.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d549dea24c7d3fd124e18bd74e50aa40f7308bf45b88fbad08c3b58c8159320c

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 10 Jan 2022 00:30:53 GMT
content-encoding
br
last-modified
Tue, 05 Oct 2021 19:38:16 GMT
server
AmazonS3
age
1366470
etag
W/"06d5c533ccd10e3dd95377437afabe92"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
x-amz-cf-id
BkmvXofVM1NNy1SfNMp82kfkiwjAjV3WAImjyEbBIKMEs4LvhJRuKg==
njp4uhl.css
use.typekit.net/
29 KB
2 KB
Stylesheet
General
Full URL
https://use.typekit.net/njp4uhl.css
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:2::7d38:c95a Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
ae5bbba666a45803e40e6022a3d2ba2e79d4dbe3f92c15b8b73732ef92806e70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
date
Tue, 25 Jan 2022 20:05:23 GMT
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
2302
0oq7ka.css
d1di2lzuh97fh2.cloudfront.net/files/0o/0oq/
7 KB
2 KB
Stylesheet
General
Full URL
https://d1di2lzuh97fh2.cloudfront.net/files/0o/0oq/0oq7ka.css?ph=3e371d15e7
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.65.219.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-65-219-96.nrt57.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0bc1c5d9117cf6d1b9a8820bd8e6258a7ee0db5b294bd7d2d761b687c8989087

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 11 Jan 2022 15:45:48 GMT
content-encoding
gzip
last-modified
Mon, 27 Sep 2021 07:49:21 GMT
server
AmazonS3
age
1225176
etag
"d110eb8d84a0b89969d3ad0573c3854e"
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 8f0959a9fded34ee3fe0c16a51c94a4a.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000, immutable
x-amz-cf-pop
NRT57-P4
accept-ranges
bytes
content-length
1668
x-amz-cf-id
JB_1X3uWjZWVdWY-3J2HGRt5tBY0S7s8O0cXWpaoV-_XtAcoeQ13ww==
p.css
p.typekit.net/
5 B
181 B
Stylesheet
General
Full URL
https://p.typekit.net/p.css?s=1&k=njp4uhl&ht=tk&f=137.138.139.140.169.170.171.172.173.174.175.176.5474.5475.25136.25137.9674.9675.9676.9677.10294.10295.10296.10297.10298.10299.10300.10301.10302.10303.10304.10305.10312.10314.22489.22490.22491.22492.22493.22494.22495.22496&a=3787040&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/njp4uhl.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:1b8::19fd Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://use.typekit.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 25 Jan 2022 20:05:23 GMT
last-modified
Wed, 02 Sep 2020 03:56:44 GMT
server
nginx
etag
"5f4f17fc-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
analytics.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Server
2404:6800:4004:81e::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
677
date
Tue, 25 Jan 2022 19:54:06 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 25 Jan 2022 21:54:06 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
20211019-181934.png
i.ibb.co/LRSkPHq/
126 KB
126 KB
Image
General
Full URL
https://i.ibb.co/LRSkPHq/20211019-181934.png
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.96.140.18 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software
nginx /
Resource Hash
c4c47026e9047d7a8465cb929595a6dca5942aebd8341d5fea6423e797c418d8

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 25 Jan 2022 20:05:23 GMT
last-modified
Tue, 19 Oct 2021 11:20:58 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
129138
expires
Thu, 31 Dec 2037 23:55:55 GMT
l
use.typekit.net/af/98e3f6/000000000000000077359562/30/
79 KB
79 KB
Font
General
Full URL
https://use.typekit.net/af/98e3f6/000000000000000077359562/30/l?primer=f592e0a4b9356877842506ce344308576437e4f677d7c9b78ca2162e6cad991a&fvd=n7&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/njp4uhl.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:2::7d38:c95a Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
fd26a8e30ebfc1cd0cc067a9890a9cc7835cf4d3a743d6ca32f214a9f831d788

Request headers

Referer
https://use.typekit.net/njp4uhl.css
Origin
http://pemulihanakunfacebook.duckdns.org
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 25 Jan 2022 20:05:23 GMT
server
nginx
etag
"7421af1d8fe159388f23298404157c5a5e0b2e82"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
80912
l
use.typekit.net/af/56b0cd/00000000000000007735957d/30/
79 KB
80 KB
Font
General
Full URL
https://use.typekit.net/af/56b0cd/00000000000000007735957d/30/l?primer=f592e0a4b9356877842506ce344308576437e4f677d7c9b78ca2162e6cad991a&fvd=n3&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/njp4uhl.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:2::7d38:c95a Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
cac4b1158e069c8eaf003a9b401a175f724f3f34f5afce2ca867719fd1a4743f

Request headers

Referer
https://use.typekit.net/njp4uhl.css
Origin
http://pemulihanakunfacebook.duckdns.org
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 25 Jan 2022 20:05:23 GMT
server
nginx
etag
"8fd4efd4383eea397977410c7d14c7fd5c118fb4"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
81156
l
use.typekit.net/af/d45b9a/000000000000000077359577/30/
77 KB
77 KB
Font
General
Full URL
https://use.typekit.net/af/d45b9a/000000000000000077359577/30/l?primer=f592e0a4b9356877842506ce344308576437e4f677d7c9b78ca2162e6cad991a&fvd=n4&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/njp4uhl.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:2::7d38:c95a Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
2e792bbbcd998173da1d4c2b890c9598f121d68d2e016be488d4b217192d7949

Request headers

Referer
https://use.typekit.net/njp4uhl.css
Origin
http://pemulihanakunfacebook.duckdns.org
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Tue, 25 Jan 2022 20:05:23 GMT
server
nginx
etag
"a63da5d960e169c6b1c105217b2559b912d72881"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
78832
zOL64pLDlL1D99S8g8PtiKchq-dmjQ.woff2
fonts.gstatic.com/s/abrilfatface/v12/
13 KB
13 KB
Font
General
Full URL
https://fonts.gstatic.com/s/abrilfatface/v12/zOL64pLDlL1D99S8g8PtiKchq-dmjQ.woff2
Requested by
Host: d1di2lzuh97fh2.cloudfront.net
URL: https://d1di2lzuh97fh2.cloudfront.net/files/04/049/049m4z.css?ph=3e371d15e7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:821::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6c5a6cf8b85ac2b8c7e9e08242ac765e320456f4ad4349f852259e365b525a2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d1di2lzuh97fh2.cloudfront.net/
Origin
http://pemulihanakunfacebook.duckdns.org
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 00:10:32 GMT
x-content-type-options
nosniff
age
417291
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13120
x-xss-protection
0
last-modified
Tue, 01 Sep 2020 03:49:05 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 21 Jan 2023 00:10:32 GMT
collect
www.google-analytics.com/j/
4 B
221 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=236331825&t=pageview&_s=1&dl=http%3A%2F%2Fpemulihanakunfacebook.duckdns.org%2F&ul=en-us&de=UTF-8&dt=Confirm%20Your%20Account&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1596619071&gjid=2009865549&cid=1382452923.1643141124&tid=UA-797705-6&_gid=1141131954.1643141124&_r=1&_slc=1&cd1=W2&z=1131591729
Requested by
Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:81e::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://pemulihanakunfacebook.duckdns.org/
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 25 Jan 2022 20:05:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
http://pemulihanakunfacebook.duckdns.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
7 B
457 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-797705-6&cid=1382452923.1643141124&jid=1596619071&gjid=2009865549&_gid=1141131954.1643141124&_u=YEBAAEAAAAAAAC~&z=712463877
Requested by
Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4008:c07::9a Taipei, Taiwan, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2bd7a2c113455cb6a015b33188207c2f7f5b5e7c584ce1ea4f8b0a1e990da133
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://pemulihanakunfacebook.duckdns.org/
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 25 Jan 2022 20:05:23 GMT
content-type
text/plain
access-control-allow-origin
http://pemulihanakunfacebook.duckdns.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
501 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-797705-6&cid=1382452923.1643141124&jid=1596619071&_u=YEBAAEAAAAAAAC~&z=1725366646
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:808::2004 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jan 2022 20:05:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.co.jp/ads/
42 B
501 B
Image
General
Full URL
https://www.google.co.jp/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-797705-6&cid=1382452923.1643141124&jid=1596619071&_u=YEBAAEAAAAAAAC~&z=1725366646
Requested by
Host: pemulihanakunfacebook.duckdns.org
URL: http://pemulihanakunfacebook.duckdns.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
http://pemulihanakunfacebook.duckdns.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 25 Jan 2022 20:05:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.pemulihanakunfacebook.duckdns.org/ Name: _ga
Value: GA1.3.1382452923.1643141124
.pemulihanakunfacebook.duckdns.org/ Name: _gid
Value: GA1.3.1141131954.1643141124
.pemulihanakunfacebook.duckdns.org/ Name: _gat_wnd_header
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1di2lzuh97fh2.cloudfront.net
fonts.gstatic.com
i.ibb.co
p.typekit.net
pemulihanakunfacebook.duckdns.org
stats.g.doubleclick.net
use.typekit.net
www.google-analytics.com
www.google.co.jp
www.google.com
172.96.140.18
18.65.219.96
2404:6800:4004:801::2003
2404:6800:4004:808::2004
2404:6800:4004:81e::200e
2404:6800:4004:821::2003
2404:6800:4008:c07::9a
2600:140b:2::7d38:c95a
2600:140b:400:1b8::19fd
40.88.36.128
0bc1c5d9117cf6d1b9a8820bd8e6258a7ee0db5b294bd7d2d761b687c8989087
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
2bd7a2c113455cb6a015b33188207c2f7f5b5e7c584ce1ea4f8b0a1e990da133
2e792bbbcd998173da1d4c2b890c9598f121d68d2e016be488d4b217192d7949
4435b5a2cf70d9413e1da031a50e5c6869c164ed347ae8f01a6b3916fdc0b267
53dd233e0d027cda6e575fd09d76c21cfa2995ca9d47f0005099cebfa5a51585
6c5a6cf8b85ac2b8c7e9e08242ac765e320456f4ad4349f852259e365b525a2b
82e766d66f4d4bab9ec2d6d9a1642b79c373d38ad4197f03bdf5aee33e7eb23b
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a85c51779bce09c1cb280730861a71aa8882580697b0b6bb4ff6e02d48843d97
ae5bbba666a45803e40e6022a3d2ba2e79d4dbe3f92c15b8b73732ef92806e70
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
c4c47026e9047d7a8465cb929595a6dca5942aebd8341d5fea6423e797c418d8
cac4b1158e069c8eaf003a9b401a175f724f3f34f5afce2ca867719fd1a4743f
cc4bf7ef49fdc6595bdacca83e617ea391b02dd72fdf9f72c32276989870a809
d549dea24c7d3fd124e18bd74e50aa40f7308bf45b88fbad08c3b58c8159320c
d54a6842b090600ecc0fb9ac3574c8466240565156c8203228a9b8e9d3f5eaa5
d799989df3fde078643aa1282b62735cd02c37cc0a8f3f9922aafcf5a6483792
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f67ab6516bdefc5fed533d855e4e52b3bf9c7ee3517274fa3e20b28cfde089eb
fd26a8e30ebfc1cd0cc067a9890a9cc7835cf4d3a743d6ca32f214a9f831d788