plpipe.cryptobalticpipe.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 104.21.59.231, located in and belongs to CLOUDFLARENET, US. The main domain is plpipe.cryptobalticpipe.com.
TLS certificate: Issued by E1 on October 25th 2023. Valid for: 3 months.

This is the only time plpipe.cryptobalticpipe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.21.59.231 104.21.59.231	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2

1 104.21.59.231 (None, )

ASN13335 (CLOUDFLARENET, US)

plpipe.cryptobalticpipe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	54 KB
1	cryptobalticpipe.com plpipe.cryptobalticpipe.com	1 KB
2	2

	Domain	Requested by
1	connect.facebook.net	plpipe.cryptobalticpipe.com
1	plpipe.cryptobalticpipe.com
2	2

This site contains no links.

Subject Issuer	Validity	Valid
cryptobalticpipe.com E1	`2023-10-25` - `2024-01-23`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-11` - `2023-12-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://plpipe.cryptobalticpipe.com/
Frame ID: DF8B60AC8F97A81FECD51BBE856A38C5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Только посмотри!

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

55 kB
Transfer

203 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
plpipe.cryptobalticpipe.com/ 863 B
1 KB 450ms
345ms Document
text/html 104.21.59.231
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plpipe.cryptobalticpipe.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.59.231 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 573a936f654f71fdcf77d0683d5958ebb1f97af702175bceb1774bbed39cf77a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 82f7b50d0ac79acf-MIA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 03 Dec 2023 00:31:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DMkRiOtvLOrb7E9hmWIe5fxvVsxg7KUs3OWBOqktfpvabKZOavLhAmSSbzikgAMdgsg9VUIL3mET%2Bfzpi50P5TiqMmGN9jsIqKHa%2F8VN5Rw75J%2FD8wXCHM1hwa1ayRZ%2F2nzexMETSqpItz3ewi8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 422ms
55ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: plpipe.cryptobalticpipe.com
URL: https://plpipe.cryptobalticpipe.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plpipe.cryptobalticpipe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 03 Dec 2023 00:31:32 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: +8pVZH7qtHVpeDe8gEFTNq2o4l+SBiJbXdfWXdbTgoI4Pr6V6g/Mqx0s1UNbbaTTzEMWykf5MNH9wTXfAwFYMQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| fbq function| _fbq

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			plpipe.cryptobalticpipe.com/	1970-01-20 16:40:49	Name: uclick Value: fnhobl
			plpipe.cryptobalticpipe.com/	1970-01-20 16:40:49	Name: uclickhash Value: fnhobl-fnhobl-vr-0-bl-17-gx-af7902

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
plpipe.cryptobalticpipe.com
104.21.59.231
2a03:2880:f003:c0e:face:b00c:0:3
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
573a936f654f71fdcf77d0683d5958ebb1f97af702175bceb1774bbed39cf77a

plpipe.cryptobalticpipe.com Open in urlscan Pro 104.21.59.231 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

55 kBTransfer

203 kBSize

2 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

2 Cookies

Indicators

plpipe.cryptobalticpipe.com Open in urlscan Pro
104.21.59.231 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

55 kB
Transfer

203 kB
Size

2
Cookies

2 HTTP transactions
0 data transactions