2ig2d.csb.app Open in urlscan Pro
2606:4700::6812:1a72  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://hail-foregoing-basement.glitch.me/ Page URL
2. https://2ig2d.csb.app/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response hail-foregoing-basement.glitch.me/	110 B 443 B	486ms 207ms	Document text/html	3.231.39.129 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.231.39.129 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-231-39-129.compute-1.amazonaws.com Software AmazonS3 / Resource Hash bf8aa8eebce3a68bd1932f9e2ec4df458c9bdb7a9a08024c2cca96cf1efd99c4 Request headers :method GET :authority hail-foregoing-basement.glitch.me :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 19 Jan 2021 17:55:13 GMT content-type text/html; charset=utf-8 content-length 110 x-amz-id-2 nbrj0IksIE4nkz85AsB+nsn+pCps/tARTlzRk5tweWCRha02kMmZb1yB7lb/DQk+gD9BSLVAm00= x-amz-request-id 623D99644D2EE4CB last-modified Tue, 19 Jan 2021 15:15:32 GMT etag "598a2fd262334f8c5afb622502601172" cache-control no-cache x-amz-version-id TjWxAdH0XyrBSO96sLjk14kOkl4isJlT accept-ranges bytes server AmazonS3
GET H2	200	Primary Request / Show response 2ig2d.csb.app/	193 KB 16 KB	296ms 269ms	Document text/html	2606:4700::6812:1a72 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://2ig2d.csb.app/ Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1a72 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 20a273e1ff0d5f02674f7bc573fc381a3b08557bd3e3a1f5d546fedc25d96a5a Request headers :method GET :authority 2ig2d.csb.app :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://hail-foregoing-basement.glitch.me/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://hail-foregoing-basement.glitch.me/ Response headers date Tue, 19 Jan 2021 17:55:13 GMT content-type text/html set-cookie __cfduid=d49cc3c62e647973b9a5319bbbb7c42891611078913; expires=Thu, 18-Feb-21 17:55:13 GMT; path=/; domain=.csb.app; HttpOnly; SameSite=Lax signedIn=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; max-age=0; HttpOnly vary Accept-Encoding cache-control private, max-age=0, no-cache, no-store x-request-id FluzvIJo4oYR1egZvKvo via 1.1 google cf-cache-status DYNAMIC cf-request-id 07bd6266c900004ac8369c7000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 61426ceadd874ac8-FRA content-encoding br
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	79ms 3ms	Script text/javascript	2a00:1450:4001:818::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 18 Jan 2021 23:33:22 GMT content-encoding gzip x-content-type-options nosniff age 66112 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 18 Jan 2022 23:33:22 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	136ms 14ms	Script application/javascript	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip last-modified Thu, 22 Sep 2016 22:32:34 GMT server nginx etag W/"57e45c02-152b5" vary Accept-Encoding x-hw 1611078914.dop227.fr8.t,1611078914.cds272.fr8.hc,1611078914.cds012.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H2	200	jquery-3.3.1.js Show response code.jquery.com/	265 KB 79 KB	132ms 10ms	Script application/javascript	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Request headers Referer https://2ig2d.csb.app/ Origin https://2ig2d.csb.app User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx etag W/"5a637bd4-42587" vary Accept-Encoding x-hw 1611078914.dop227.fr8.t,1611078914.cds272.fr8.hc,1611078914.cds165.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 80268
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 20 KB	91ms 17ms	Stylesheet text/css	2001:4de0:ac19::1:b:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value X-Content-Type-Options nosniff Request headers Origin https://2ig2d.csb.app Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:34:10 GMT etag "1544639650" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 20563
GET H2	200	css fonts.googleapis.com/	1 KB 545 B	95ms 24ms	Stylesheet text/css	2a00:1450:4001:821::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2641774a75edf22f36ae246a5ae426c1497e0827018f458323b34d9260d35994 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 19 Jan 2021 17:46:05 GMT server ESF date Tue, 19 Jan 2021 17:55:14 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 19 Jan 2021 17:55:14 GMT
GET H2	200	585b051251.js Show response kit.fontawesome.com/	11 KB 4 KB	149ms 39ms	Script text/javascript	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/585b051251.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7943d6d067db8587e9fb675f0d2cc78d6c90c91b187cf8642a3f52ff91381685 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer https://2ig2d.csb.app/ Origin https://2ig2d.csb.app User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip vary origin, accept-encoding, access-control-request-headers, access-control-request-method cf-cache-status REVALIDATED strict-transport-security max-age=31536000; preload cf-request-id 07bd6268ad0000e00342383000000001 x-request-id FluyWJDLxk9haRYen95B server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control max-age=60, public, must-revalidate cf-ray 61426cedee0ce003-FRA access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token
GET H2	200	G2Jb-logo.png uploads.codesandbox.io/uploads/user/91008ee3-f3dc-4f69-8305-758b5234b413/	3 KB 4 KB	147ms 29ms	Image image/png	2606:4700::6812:17cf CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://uploads.codesandbox.io/uploads/user/91008ee3-f3dc-4f69-8305-758b5234b413/G2Jb-logo.png Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:17cf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5265fec4dfad9d1a9c01d7c6516ec123eb55a6456f498bd5ecd1a5f8181568c7 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 19 Jan 2021 17:55:14 GMT cf-cache-status HIT age 3250 cf-polished origSize=4125 x-guploader-uploadid ABg5-UyJIBKWdt7L7Qz_2g8K1X2hjxfxMxdN1Zy2ZsC8HArKjtY2UzsH74iSYR931Ezo8Bu9nIAQiBXiL2_P0R1nSus_m5q6_Q x-goog-storage-class REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity content-type image/png content-length 3153 cf-request-id 07bd6268b600004ac30b060000000001 expires Tue, 19 Jan 2021 18:01:04 GMT last-modified Tue, 08 Dec 2020 19:09:31 GMT server cloudflare etag "90075ce2495285e6efbb4adb03592043" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=xr4o7g==, md5=kAdc4klShebvu0rbA1kgQw== x-goog-generation 1607454571333892 access-control-allow-origin * access-control-expose-headers Content-Type cache-control public, max-age=3600 x-goog-stored-content-length 4125 accept-ranges bytes cf-ray 61426cedff3d4ac3-FRA cf-bgj imgq:100,h2pri
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 23 KB	149ms 40ms	Script application/javascript	2001:4de0:ac19::1:b:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer https://2ig2d.csb.app/ Origin https://2ig2d.csb.app User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-10fdd" vary Accept-Encoding x-hw 1611078914.dop227.fr8.t,1611078914.cds272.fr8.hc,1611078914.cds257.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 6 KB	82ms 20ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://2ig2d.csb.app/ Origin https://2ig2d.csb.app User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"max_age":604800,"report_to":"cf-nel"} age 2123863 cross-origin-resource-policy cross-origin vary Accept-Encoding content-length 6157 cf-request-id 07bd62687d000032407d86a000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ukQr2YWxxyYdVDrYYMffJRpZAcigKfmLm%2FyISLAnaBaJK%2F5t23eQV%2BaaXAfeePeVfyyZbGc9Ud8zVpm%2Bihn27Y%2FhpTzv9rE54zZK0XU1gKCxzyhKNE7EAdC0GhjsYohUsQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes cf-ray 61426ced9b323240-FRA expires Sun, 09 Jan 2022 17:55:14 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 13 KB	77ms 18ms	Script text/javascript	2001:4de0:ac19::1:b:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: hail-foregoing-basement.glitch.me URL: https://hail-foregoing-basement.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://2ig2d.csb.app/ Origin https://2ig2d.csb.app User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 19 Jan 2021 17:55:14 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 12 Dec 2018 18:33:52 GMT etag "1544639632" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 13105
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	59 KB 13 KB	261ms 75ms	Fetch text/css	2606:4700:e6::ac40:cb1c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 19 Jan 2021 17:55:14 GMT via 1.1 9891f2220bf61a27cb1f26085ab3703d.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 871 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br cf-request-id 07bd626a1500004a9765b4f000000001 last-modified Wed, 13 Jan 2021 18:32:18 GMT server cloudflare etag W/"4ecc071b77d6b1790fa9fb8a5173f972" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZWeuwC1Pk%2FdZdBKml7%2B56s7N6OUCELTcChvPNj3X58vcQtrDcQIEBMbqVTqD0WLuUoSf6JQn6bbhikzdh7P6Rn%2Fc4BOPhHkBs4cEkt0ujwaoX2c4e4ERB3deNufwAhVtvQ%3D%3D"}],"max_age":604800,"group":"cf-nel"} content-type text/css access-control-allow-origin * cache-control max-age=31556926 x-amz-cf-pop CDG3-C2 cf-ray 61426cf028b64a97-FRA access-control-allow-headers fa-kit-token x-amz-cf-id vAfq88nou1ASAxDFrvN6kyzghoOTh0GeyP_FgLweaNbRtrVdE_FbZA==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	26 KB 4 KB	264ms 78ms	Fetch text/css	2606:4700:e6::ac40:cb1c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e6::ac40:cb1c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 19 Jan 2021 17:55:14 GMT via 1.1 d6561aeeccb210202cf78b99f07c5235.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 871 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br cf-request-id 07bd626a1500004a973d82b000000001 last-modified Wed, 13 Jan 2021 18:32:17 GMT server cloudflare etag W/"1848e71668f42835079e5fa2af6cf4a8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HaUgRsHpFL%2FKNVR5gUbcRiwsAI2Aro%2BOUOTrSvB1qSexpLgoq20XU8eabq7aukueQcnaOif0U4fZnEsXkIEIuudmM7CAV44BGBpGH%2F18R8P1973YicqGiO97lyeYrl3YfQ%3D%3D"}],"max_age":604800,"group":"cf-nel"} content-type text/css access-control-allow-origin * cache-control max-age=31556926 x-amz-cf-pop CDG3-C2 cf-ray 61426cf028ba4a97-FRA access-control-allow-headers fa-kit-token x-amz-cf-id 7r-0knMheNYLkxp4Zoq14z0xLD5bHwLqamoRSp18i6cS1eObQIDGgg==
GET H/1.1	200 OK	ZJH_2F3Xi0SopxxCuN7EKeDY.jpg s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/	17 KB 18 KB	636ms 137ms	Image image/jpeg	52.217.100.102 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3.amazonaws.com/simbla-static-2/2020/11/5faba665321d68001d4fc0e4/5faba6db73aef50019af7085/ZJH_2F3Xi0SopxxCuN7EKeDY.jpg Requested by Host: 2ig2d.csb.app URL: https://2ig2d.csb.app/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.100.102 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers Referer https://2ig2d.csb.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 19 Jan 2021 17:55:16 GMT x-amz-meta-websiteid 5faba6db73aef50019af7085 Last-Modified Wed, 11 Nov 2020 08:56:44 GMT Server AmazonS3 x-amz-meta-userid 5faba665321d68001d4fc0e4 ETag "7916a894ebde7d29c2cc29b267f1299f" Content-Type image/jpeg Cache-Control max-age=2592000000 x-amz-request-id 2E91FF2A72F238A6 Accept-Ranges bytes Content-Length 17453 x-amz-id-2 b+Z+3qqvDzG8V9Oah5VVRPwvI/kQBQCkLvmYVd+eLT5YlvXIjESH2+ypUR7hSGc2R92OE9T8piA=

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| cambiarxiyizi number| timeexpiracion number| timehoy string| ep function| dc function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.csb.app/	1970-01-19 16:14:30	Name: __cfduid Value: d49cc3c62e647973b9a5319bbbb7c42891611078913

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2ig2d.csb.app
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
hail-foregoing-basement.glitch.me
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
s3.amazonaws.com
uploads.codesandbox.io
2001:4de0:ac19::1:b:1a
2001:4de0:ac19::1:b:3b
2606:4700::6810:125e
2606:4700::6812:1634
2606:4700::6812:17cf
2606:4700::6812:1a72
2606:4700:e6::ac40:cb1c
2a00:1450:4001:818::200a
2a00:1450:4001:821::200a
3.231.39.129
52.217.100.102
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
20a273e1ff0d5f02674f7bc573fc381a3b08557bd3e3a1f5d546fedc25d96a5a
2641774a75edf22f36ae246a5ae426c1497e0827018f458323b34d9260d35994
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
5265fec4dfad9d1a9c01d7c6516ec123eb55a6456f498bd5ecd1a5f8181568c7
7943d6d067db8587e9fb675f0d2cc78d6c90c91b187cf8642a3f52ff91381685
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
bf8aa8eebce3a68bd1932f9e2ec4df458c9bdb7a9a08024c2cca96cf1efd99c4
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b