6ta.in Open in urlscan Pro
2606:4700:3036::6815:274d  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://linkzip.me/3ZoQ2 Page URL
2. https://blankrefer.com/?https://6ta.in/uSHE Page URL
3. https://6ta.in/uSHE Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	3ZoQ2 Show response linkzip.me/	177 B 815 B	411ms 380ms	Document text/html	2606:4700:3032::ac43:9bb6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://linkzip.me/3ZoQ2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:9bb6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.34 Resource Hash f77e1ddb96d67555311d0844ccbb3f32bab4089eecbd7e337b0bd884fab0926e Request headers :method GET :authority linkzip.me :scheme https :path /3ZoQ2 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 13:16:32 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dad0701deeb75f6a8d21b3f025a5180741619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.linkzip.me; HttpOnly; SameSite=Lax; Secure x-powered-by PHP/7.2.34 vary Accept-Encoding x-turbo-charged-by LiteSpeed cf-cache-status DYNAMIC cf-request-id 09a59f64570000c29027141000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8e1O%2Fg7%2FJ%2BtfMmDGAgG0jtX8GhbFN95OEj4WPPqpZyWTcoQ1vYWpR%2BkR892KabYyLBTdhE%2F9dfo9K3vfildtGhGcawzLnUcNyNxxUgas9cVDs8kjHSaD"}]} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 644f9b4d4804c290-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	/ Show response blankrefer.com/	793 B 1 KB	193ms 177ms	Document text/html	2606:4700:3037::ac43:bb96 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://blankrefer.com/?https://6ta.in/uSHE Requested by Host: linkzip.me URL: https://linkzip.me/3ZoQ2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:bb96 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.3.28 Resource Hash 88ad4b23837f42ba59d2513d5d4ed2f42b20ec269b18157bdf182bf42e317c8e Request headers :method GET :authority blankrefer.com :scheme https :path /?https://6ta.in/uSHE pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://linkzip.me/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://linkzip.me/ Response headers date Sat, 24 Apr 2021 13:16:32 GMT content-type text/html set-cookie __cfduid=d3b3454c067e4834f0ed7825934cd40851619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.blankrefer.com; HttpOnly; SameSite=Lax x-powered-by PHP/5.3.28 vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 09a59f65e500004e8ca23d9000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JmGtf1QvtFS5oS7DpEwJXVenOQ6rXHV4IS7WLkF0LfyY%2Fz1JtmkV5sXQQhrgLmV%2F1O%2BjVtEMVqIWvSu%2BZL5nuIS77tR4wJO0IOuOW4dqlGSUhY%2FkludD1vo5kw%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 644f9b4fdf2a4e8c-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	rocket-loader.min.js Show response ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/	12 KB 5 KB	37ms 21ms	Script application/javascript	2606:4700::6810:a823 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Requested by Host: blankrefer.com URL: https://blankrefer.com/?https://6ta.in/uSHE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://blankrefer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 13:16:32 GMT content-encoding gzip x-content-type-options nosniff nel {"max_age":604800,"report_to":"cf-nel"} vary Accept-Encoding cf-request-id 09a59f66ad00004dbeb3811000000001 last-modified Wed, 14 Apr 2021 08:33:47 GMT server cloudflare x-frame-options DENY etag W/"6076a8eb-3016" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=T0qHosJD3XQc6DAi4haBgFr4e9yZKKERFhmyMRlQNn5Duh8ZTXuDlodAWEmSlD%2B5Hkc%2F6TA4N7apy8qSyLnV87YlZDvPiB7KI%2BB38BIZlGDPamYL8pcsCWsc27BebNXA"}],"max_age":604800,"group":"cf-nel"} content-type application/javascript cache-control max-age=172800, public cf-ray 644f9b51197f4dbe-FRA expires Mon, 26 Apr 2021 13:16:32 GMT
GET H2	200	counter.js secure.statcounter.com/counter/	38 KB 13 KB	100ms 39ms	Script application/x-javascript	104.22.53.65 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure.statcounter.com/counter/counter.js Requested by Host: ajax.cloudflare.com URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.22.53.65 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://blankrefer.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 13:16:32 GMT content-encoding br cf-cache-status HIT last-modified Tue, 19 Jan 2021 10:15:35 GMT server cloudflare age 6676 etag W/"6006b147-98f7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control max-age=43200 cf-ray 644f9b51bad00016-WAW cf-request-id 09a59f671100000016b58eb000000001 expires Sat, 24 Apr 2021 23:25:16 GMT
GET H2	200	Primary Request uSHE Show response 6ta.in/	3 KB 2 KB	264ms 248ms	Document text/html	2606:4700:3036::6815:274d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6ta.in/uSHE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:274d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5706e256337c9bd51b5b2a19477f621f2c7f557ccfcc9b5c386029410f1aaeb3 Security Headers Name Value Content-Security-Policy default-src *;img-src * 'self' data: https:; script-src '*' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' * X-Frame-Options SAMEORIGIN Request headers :method GET :authority 6ta.in :scheme https :path /uSHE pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://blankrefer.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://blankrefer.com/ Response headers date Sat, 24 Apr 2021 13:16:33 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d95ee2a41a305ea87949e129c2ccad1811619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.6ta.in; HttpOnly; SameSite=Lax; Secure __cfduid=d7f238e115c55e99c648c47bf365ffa211619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.6ta.in; HttpOnly; SameSite=Lax; Secure __cfduid=d188ce7512794dac09571bbefef7fe4531619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.6ta.in; HttpOnly; SameSite=Lax; Secure __cfduid=dbfe8b6b7d70b3b9ac8f82c790ed27c661619270192; expires=Mon, 24-May-21 13:16:32 GMT; path=/; domain=.6ta.in; HttpOnly; SameSite=Lax; Secure x-frame-options SAMEORIGIN access-control-allow-origin https://script-esm.xyz vary Origin access-control-allow-credentials true content-security-policy default-src *;img-src * 'self' data: https:; script-src '*' 'unsafe-inline' 'unsafe-eval' *;style-src 'self' 'unsafe-inline' * cache-control public, max-age=0 last-modified Wed, 21 Apr 2021 11:27:05 GMT cf-cache-status DYNAMIC cf-request-id 09a59f66d7000005fda1318000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FJtPPvf67NsA6mFr4jNmkLgfQYVYrmZfm%2B19Nsjw%2BI2qvbL8eZvoqtZmSuJljsILMHZsx0yKIPBsmm6RE0QYRVEVtsWZb%2Fo%3D"}]} nel {"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 server cloudflare cf-ray 644f9b515ffb05fd-FRA content-encoding br
GET		t.php c.statcounter.com/	0 0
GET H2	200	/ Show response 1sk.re/	33 KB 15 KB	211ms 193ms	Script text/javascript	2606:4700:3033::6815:27a0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://1sk.re/ Requested by Host: linkzip.me URL: https://linkzip.me/3ZoQ2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:27a0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 08f3aa4ff6dd21c4651b86677dbe80d17f6eb3a09e6e476535524f262c9de12e Request headers Referer https://6ta.in/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers cf-request-id 09a59f67eb00002c569901a000000001 content-encoding br cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} server cloudflare date Sat, 24 Apr 2021 13:16:33 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sxjUI53BKmQHkTsNx015N8Q57A%2BgXaO6wx7lK8gul5JFmIWdjyGMvhO7FFqXq5QGYAY2UDocuymAiu81zs9D4l1iWUd8Dss%3D"}],"group":"cf-nel"} content-type text/javascript;charset=UTF-8 cf-ray 644f9b530bfc2c56-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET DATA	200 OK	truncated /	512 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	160 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	/ whos.amung.us/pingjs/	28 B 28 B	432ms 144ms	Image text/javascript	67.202.94.93 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=2378x351&t=https://anti-brecheros.com/&x= Requested by Host: 6ta.in URL: https://6ta.in/uSHE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.94.93 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://6ta.in/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 24 Apr 2021 13:16:33 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	875 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

c.statcounter.com

URL

https://c.statcounter.com/t.php?u1=3F291A2FC15B4F07979AE535414B45CA&sc_project=11231577&java=1&security=ef1d4180&sc_snum=1&sess=830817&p=0&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=https%3A//linkzip.me/&u=https%3A//blankrefer.com/%3Fhttps%3A//6ta.in/uSHE&t=BlankRefer.com&invisible=1&sc_rum_e_s=349&sc_rum_e_e=354&sc_rum_f_s=0&sc_rum_f_e=347&get_config=true

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| bannedips string| ip object| handleips function| e0ad90d8 string| k object| _0x5092 function| _0x309a function| _0xcd4b function| _0x37cf3a function| _0xb4ccd1 function| _slicedToArray function| _nonIterableRest function| _unsupportedIterableToArray function| _arrayLikeToArray function| _iterableToArrayLimit function| _arrayWithHoles function| init function| _0x1a88e8

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.6ta.in/	1970-01-19 18:31:02	Name: __cfduid Value: dbfe8b6b7d70b3b9ac8f82c790ed27c661619270192

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1sk.re
6ta.in
ajax.cloudflare.com
blankrefer.com
c.statcounter.com
linkzip.me
secure.statcounter.com
whos.amung.us
c.statcounter.com
104.22.53.65
2606:4700:3032::ac43:9bb6
2606:4700:3033::6815:27a0
2606:4700:3036::6815:274d
2606:4700:3037::ac43:bb96
2606:4700::6810:a823
67.202.94.93
08f3aa4ff6dd21c4651b86677dbe80d17f6eb3a09e6e476535524f262c9de12e
5706e256337c9bd51b5b2a19477f621f2c7f557ccfcc9b5c386029410f1aaeb3
6e0fc29250dff289b4edc1f0b8600b7dc1356bcb7e719a5164acb989d3eae625
88ad4b23837f42ba59d2513d5d4ed2f42b20ec269b18157bdf182bf42e317c8e
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
c711f7274ba8f89b7cd7c33ee993bf4e9561cb48f84182511e28f9dc62f069b5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4522006a008d745a6cd005a1abd07c0c6b7715eb41fb15616ed82f39ad74f85
f77e1ddb96d67555311d0844ccbb3f32bab4089eecbd7e337b0bd884fab0926e