www.help-mediacenters.cf Open in urlscan Pro
2a02:4780:dead:8af9::1  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.help-mediacenters.cf/	8 KB 3 KB	396ms 111ms	Document text/html	2a02:4780:dead:8af9::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:8af9::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 6389252ead98d66ea58c9fa7b079324992534db2c56abf3a0fb1d604a6418319 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.help-mediacenters.cf :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:26 GMT content-type text/html; charset=UTF-8 server awex x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 91d0803d4dd619053376bc20b15015b2 content-encoding gzip
GET H2	200	insta_3.png linkpicture.com/q/	14 KB 14 KB	285ms 258ms	Image image/png	2606:4700:3031::6815:5547 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://linkpicture.com/q/insta_3.png Requested by Host: www.help-mediacenters.cf URL: https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:5547 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PleskLin Resource Hash 34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9 Request headers Referer https://www.help-mediacenters.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:26 GMT cf-cache-status REVALIDATED nel {"report_to":"cf-nel","max_age":604800} x-powered-by PleskLin content-length 14205 cf-request-id 0a3bf552500000d6e9fd209000000001 last-modified Tue, 18 May 2021 19:24:37 GMT server cloudflare etag "60a41475-377d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CKFPK43C65r5PcxWW5TqcPXoHCCMG4b%2BNn3WDYVZsS4ZtUDqATUxYEzAd67BMrgtmaSrS4qI1m8G79V4YaRGsbHFI529wpD5UKjWPG1G8Ad6OcCzKltKnUW8WZc%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=31536000 accept-ranges bytes cf-ray 654024ca1817d6e9-FRA
GET H2	200	giphy.gif media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/	619 KB 619 KB	93ms 28ms	Image image/gif	151.101.14.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/giphy.gif Requested by Host: www.help-mediacenters.cf URL: https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Referer https://www.help-mediacenters.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:26 GMT via 1.1 varnish, 1.1 varnish age 1699099 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 633406 x-served-by cache-bwi5134-BWI, cache-fra19172-FRA last-modified Thu, 14 Mar 2019 04:23:52 GMT x-timer S1621792406.143817,VS0,VE1 etag "ae106de830d353e782457e518990e94f" strict-transport-security max-age=86400 content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	Varl%C4%B1k%201-273x274.png istalya.com/image/cache/catalog/resimler/	5 KB 5 KB	356ms 97ms	Image image/png	89.252.151.50 KAPTEYAN
General Check archive.org Show headers Download Go to Show image Full URL https://istalya.com/image/cache/catalog/resimler/Varl%C4%B1k%201-273x274.png Requested by Host: www.help-mediacenters.cf URL: https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.252.151.50 , Turkey, ASN207429 (KAPTEYAN, TR), Reverse DNS rdns50.kapteyan.com.tr Software nginx / PleskLin Resource Hash 1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b Request headers Referer https://www.help-mediacenters.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:54 GMT last-modified Fri, 17 Apr 2020 08:42:15 GMT server nginx x-powered-by PleskLin etag "5e996be7-1501" content-type image/png accept-ranges bytes content-length 5377
GET H2	200	facebook-logosu-degisti.gif img.paratic.com/dosya/2019/11/	444 KB 445 KB	227ms 87ms	Image image/gif	104.26.8.235 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://img.paratic.com/dosya/2019/11/facebook-logosu-degisti.gif Requested by Host: www.help-mediacenters.cf URL: https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.8.235 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9 Request headers Referer https://www.help-mediacenters.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:26 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 27053 content-length 455009 cf-request-id 0a3bf552de0000e8ebc83d0000000001 last-modified Tue, 05 Nov 2019 06:48:41 GMT server cloudflare etag "5dc11b49-6f161" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZQ6FKw4CPEkmgBq6mHXkDGd0fNlqj13%2B8R8QCkHiA9qzbslhm7C%2B4bkJY%2FrXG2G5w5lw0ESxNDDY7qJLbMgPZM4vZsIhSKUK8GquBCMqyls%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 654024cafa2de8eb-MXP expires Mon, 23 May 2022 10:22:30 GMT
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	50ms 26ms	Image image/webp	2606:4700::6812:6c08 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: www.help-mediacenters.cf URL: https://www.help-mediacenters.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:6c08 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://www.help-mediacenters.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 23 May 2021 17:53:26 GMT x-content-type-options nosniff cf-cache-status HIT age 6369 cf-polished origFmt=png, origSize=2046 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" cf-bgj imgq:100,h2pri x-hostinger-datacenter srv alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block last-modified Wed, 19 May 2021 20:28:16 GMT server cloudflare x-frame-options sameorigin etag "60a574e0-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn1 cf-request-id 0a3bf5524d00004ee648284000000001 accept-ranges bytes cf-ray 654024ca1aae4ee6-FRA expires Sun, 23 May 2021 21:53:26 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.help-mediacenters.cf/(Line 105) Message: Script Ahmet Guven Tarafindan Yapilmistir.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
img.paratic.com
istalya.com
linkpicture.com
media1.giphy.com
www.help-mediacenters.cf
104.26.8.235
151.101.14.2
2606:4700:3031::6815:5547
2606:4700::6812:6c08
2a02:4780:dead:8af9::1
89.252.151.50
1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b
34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9
632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492
6389252ead98d66ea58c9fa7b079324992534db2c56abf3a0fb1d604a6418319
6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5