request-account-same-violation.surge.sh Open in urlscan Pro
138.197.235.123  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response request-account-same-violation.surge.sh/	8 KB 3 KB	861ms 177ms	Document text/html	138.197.235.123 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://request-account-same-violation.surge.sh/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.197.235.123 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash 77697d08a1b9da42984af172f1db808967d6c07543ed533d50f9c1776d1964f4 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes Age 1530242 Cache-Control public, max-age=0, must-revalidate Connection close Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 18 Jun 2024 12:23:23 GMT ETag "77697d08a1b9da42984af172f1db808967d6c07543ed533d50f9c1776d1964f4" Response-Time 2ms Server Surge Surge-Cache HIT Surge-Stamp 574::1718648987255-e529e0bcdba6b455486a0b5c5524d886 Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	aes.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/	13 KB 5 KB	113ms 48ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js Requested by Host: request-account-same-violation.surge.sh URL: https://request-account-same-violation.surge.sh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://request-account-same-violation.surge.sh/ Origin https://request-account-same-violation.surge.sh Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 18 Jun 2024 12:23:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 407080 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 4256 last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-3430" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3UdtfBGgZnRY92wrUzM1T7eYFVRhZVdMG89uBRbwHWJwi0yF9y%2FIJSk1YxZ%2BHHeflAbnXRrUy4qMDYjKdhII7cJrqm27Fw4sIODLRDCIiwoeoNIs7T2xzJQEJERDFfTiHCfEofsriNlYyVlY4M9eOjeM"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 895b40154e053688-FRA expires Sun, 08 Jun 2025 12:23:23 GMT
GET H2	200	staticsecure.min.js Show response staticsecure.glitch.me/	955 B 1 KB	720ms 80ms	Script application/javascript	3.213.189.143 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://staticsecure.glitch.me/staticsecure.min.js Requested by Host: request-account-same-violation.surge.sh URL: https://request-account-same-violation.surge.sh/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.189.143 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-189-143.compute-1.amazonaws.com Software AmazonS3 / Resource Hash 07b4a74f102eecf58576ae091db22cc316596afa2791bad20c25824f6519f909 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://request-account-same-violation.surge.sh/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 18 Jun 2024 12:23:24 GMT x-amz-version-id 4h_tlvpK2GOd3prIzlbiQVLzH3I0_CXh last-modified Tue, 16 Apr 2024 15:33:14 GMT server AmazonS3 x-amz-request-id 01SAY1RPKVY25FY0 etag "b1f0b8ee858a206b0ff693796933416e" x-amz-server-side-encryption AES256 content-type application/javascript; charset=utf-8 cache-control no-cache accept-ranges bytes content-length 955 x-amz-id-2 Jx2uMha65JDD16J5UzuAHzB6lfDqP7RIHTVbMClGww56rQwwDqkeDPaMvM6Ky7N7KjCN31iNiQPRlGYkNp0TH6XF9ERDhrt0Z5RgyRsMroc=
GET H2	200	images-fb_icon_325x325.png cdn.glitch.global/42ac90ca-66bc-4886-9161-9ce099d273bc/	3 KB 3 KB	82ms 25ms	Image image/png	151.101.194.132 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.global/42ac90ca-66bc-4886-9161-9ce099d273bc/images-fb_icon_325x325.png?v=1696896812321 Requested by Host: request-account-same-violation.surge.sh URL: https://request-account-same-violation.surge.sh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3 Security Headers Name Value Content-Security-Policy script-src 'none' Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://request-account-same-violation.surge.sh/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none' via 1.1 varnish, 1.1 varnish date Tue, 18 Jun 2024 12:23:23 GMT x-amz-request-id NKRNFK2M5N3B63QZ age 1891045 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 2613 x-amz-id-2 MftXGYbu5rHAHXrK6NVwEoDcGCzkJbsTHvLwhz/8/p8mn44lcfWxXF9Gcp5+2n9ujx+dJOdnoB0= x-served-by cache-iad-kiad7000038-IAD, cache-fra-etou8220113-FRA last-modified Tue, 10 Oct 2023 00:15:17 GMT server AmazonS3 x-timer S1718713404.714862,VS0,VE1 etag "1b070534eb1ab6195f4fc7118dfc8be5" access-control-allow-methods GET, HEAD, POST content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-cache-hits 19, 0
GET H2	200	thumbnails%2Fbluetick.png cdn.glitch.global/0e876aa8-70cf-40f1-951b-94c8002e5dcc/	19 KB 19 KB	78ms 21ms	Image image/png	151.101.194.132 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.global/0e876aa8-70cf-40f1-951b-94c8002e5dcc/thumbnails%2Fbluetick.png?1699082922610 Requested by Host: request-account-same-violation.surge.sh URL: https://request-account-same-violation.surge.sh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.132 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6c91e4f82ff598b2ac2aae3e6d19e2e2d30946097d7a7040870028b4489b7e4e Security Headers Name Value Content-Security-Policy script-src 'none' Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://request-account-same-violation.surge.sh/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none' via 1.1 varnish, 1.1 varnish date Tue, 18 Jun 2024 12:23:23 GMT x-amz-request-id DWB6CB7Y8W7Q9JB3 age 1404696 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 19417 x-amz-id-2 JXBx+b9pyLOzl7CcmIohzYyXlGHSjp17JIc/G9WYCBlwr/WPwLLKeumY9wRljYInWCHqzTlrIJA= x-served-by cache-iad-kiad7000132-IAD, cache-fra-etou8220113-FRA last-modified Sat, 04 Nov 2023 07:28:43 GMT server AmazonS3 x-timer S1718713404.714884,VS0,VE1 etag "c46d520b7be409ba634453a7a7ce0e00" access-control-allow-methods GET, HEAD, POST content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-cache-hits 1783, 0
GET H/1.1	404 Not Found	favicon.ico request-account-same-violation.surge.sh/	8 KB 8 KB	554ms 195ms	Other text/html	138.197.235.123 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://request-account-same-violation.surge.sh/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.197.235.123 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Surge / Resource Hash 5d37f9379291a60f698c2ed035bf47041f32a53251424774300f079e73d33468 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://request-account-same-violation.surge.sh/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 18 Jun 2024 12:23:24 GMT Surge-Stamp 574::1718648987255 Server Surge ETag W/"2037-Bpq88syl4OLNTwUiR08il4/lN+0" Content-Type text/html; charset=utf-8 Connection close Content-Length 8247 Surge-Cache HIT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| CryptoJS function| staticsecure function| _0x4d03 function| _0x598e function| _0x47a560

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://request-account-same-violation.surge.sh/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.glitch.global
cdnjs.cloudflare.com
request-account-same-violation.surge.sh
staticsecure.glitch.me
138.197.235.123
151.101.194.132
2606:4700::6811:190e
3.213.189.143
07b4a74f102eecf58576ae091db22cc316596afa2791bad20c25824f6519f909
5d37f9379291a60f698c2ed035bf47041f32a53251424774300f079e73d33468
6c91e4f82ff598b2ac2aae3e6d19e2e2d30946097d7a7040870028b4489b7e4e
77697d08a1b9da42984af172f1db808967d6c07543ed533d50f9c1776d1964f4
bc40d55fd8796c2bbd2693fd3fc4eb4ebdca9d6b02eb12b7e3efa7e53d4aaeb3
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a