photo.pol2.quest Open in urlscan Pro
170.10.160.83  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 85lo0hmh5 Show response photo.pol2.quest/	108 KB 108 KB	866ms 93ms	Document text/html	170.10.160.83 STEADFAST
General Check archive.org Show headers Download Go to Full URL https://photo.pol2.quest/85lo0hmh5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 170.10.160.83 , United States, ASN32748 (STEADFAST, US), Reverse DNS serverchat24.com Software LiteSpeed / Resource Hash e337102583693e0bb87572913fc2e8481a3a4fc773c893420545b71ad3121156 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-length 110808 date Fri, 22 Apr 2022 03:16:14 GMT last-modified Thu, 21 Apr 2022 03:12:37 GMT server LiteSpeed
GET H/1.1	200 OK	polyfill.min.js Show response p.twitchcdn.net/v3/	8 KB 3 KB	74ms 22ms	Script text/javascript	151.101.130.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://p.twitchcdn.net/v3/polyfill.min.js?unknown=polyfill&flags=gated&features=Array.prototype.find,Array.prototype.findIndex,Array.prototype.includes,default,fetch,Intl.~locale.en,Math.sign,Object.entries%7Calways%7Cgated,Object.values%7Calways%7Cgated,String.prototype.repeat,URL,HTMLCanvasElement.prototype.toBlob,IntersectionObserver Requested by Host: photo.pol2.quest URL: https://photo.pol2.quest/85lo0hmh5 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.130.167 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 92b0cda84d4b214e9d74b16bf638f50db3233ae9feaef1b75daf07fc31c9f8f1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; preload X-Content-Type-Options nosniff Request headers Referer https://photo.pol2.quest/ Origin https://photo.pol2.quest accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains; preload Via 1.1 varnish, 1.1 varnish X-Content-Type-Options nosniff Age 4467287 Normalized-User-Agent chrome/100.0.0 Detected-User-Agent Chrome/100.0.4896 X-Cache HIT, HIT Server-Timing HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT, fastly;desc="Edge time";dur=1 Content-Encoding br Content-Length 2402 X-Served-By cache-iad-kjyo7100105-IAD, cache-ewr18175-EWR Referrer-Policy origin-when-cross-origin Last-Modified Wed, 10 Mar 2021 19:40:07 GMT Cache-Control public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800 X-Timer S1650597375.080903,VS0,VE1 Date Fri, 22 Apr 2022 03:16:15 GMT Access-Control-Allow-Methods GET,HEAD,OPTIONS Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * X-Cache-Hits 1, 9931
GET		settings.846c6a057dc99e757f663107b0c1a0d9.js static.twitchcdn.net/config/	0 0
GET		core-8794e231392b17c1743b.css static.twitchcdn.net/assets/	0 0
POST H/1.1	200 OK	gql Show response gql.twitch.tv/	172 B 337 B	109ms 108ms	Fetch application/json	151.101.210.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://gql.twitch.tv/gql Requested by Host: photo.pol2.quest URL: https://photo.pol2.quest/85lo0hmh5 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.210.167 Newark, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3057f137b83068b9535f8ab39611f8c9f4fcd4d474719b2c99c9813b8784e8dd Request headers Accept-Language en-US,en;q=0.9 Authorization undefined Content-Type text/plain; charset=UTF-8 Accept */* Referer https://photo.pol2.quest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Device-ID undefined Client-ID kimne78kx3ncx6brgo4mv6wki5h1ko Response headers Access-Control-Allow-Origin * Date Fri, 22 Apr 2022 03:16:15 GMT Connection keep-alive Content-Length 172 Content-Type application/json
POST H2	204	track Show response spade.twitch.tv/	0 109 B	269ms 68ms	XHR text/plain	44.238.107.191 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://spade.twitch.tv/track Requested by Host: photo.pol2.quest URL: https://photo.pol2.quest/85lo0hmh5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.238.107.191 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-44-238-107-191.us-west-2.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://photo.pol2.quest/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=utf-8 Response headers access-control-allow-origin * date Fri, 22 Apr 2022 03:16:15 GMT vary Origin access-control-allow-methods GET, POST, OPTIONS
OPTIONS H/1.1	200 OK	gql gql.twitch.tv/	0 0	159ms 87ms	Preflight	151.101.210.167 FASTLY
General Check archive.org Show headers Download Go to Full URL https://gql.twitch.tv/gql Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 151.101.210.167 Newark, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,client-id,device-id Access-Control-Request-Method POST Origin https://photo.pol2.quest Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Access-Control-Allow-Headers Accept-Language, Accept, Authorization, Challenge-Token, Client-Id, Client-Session-Id, Client-Version, Content-Type, Device-Id, Twitch-Trace, X-Csrf-Token, X-Device-Id, X-Forwarded-Proto, Forced-Rollouts Access-Control-Allow-Methods GET, POST Access-Control-Allow-Origin * Access-Control-Max-Age 600 Age 0 Connection keep-alive Content-Length 0 Date Fri, 22 Apr 2022 03:16:15 GMT
GET		vendor-3ef5bdef37294cab0e58.js static.twitchcdn.net/assets/	0 0
GET		core-300e8c50fd4c979b58e0.js static.twitchcdn.net/assets/	0 0
GET H2	200	/ Show response b2.fudacioncovid19.com/	13 KB 5 KB	197ms 31ms	Script application/javascript	167.114.124.45 OVH
General Check archive.org Show headers Download Go to Full URL https://b2.fudacioncovid19.com/?api=1&lan=facebookmessenger&ht=2 Requested by Host: photo.pol2.quest URL: https://photo.pol2.quest/85lo0hmh5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.114.124.45 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip45.ip-167-114-124.net Software / PHP/8.0.16 Resource Hash ace6108ff2fbae1a6fada042aeabac0bfdf46366f285678d153a1a908045aade Request headers accept-language en-US,en;q=0.9 Referer https://photo.pol2.quest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers pragma no-cache date Fri, 22 Apr 2022 03:16:15 GMT content-encoding br x-powered-by PHP/8.0.16 vary Accept-Encoding content-type application/javascript cache-control no-store, no-cache, must-revalidate alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	404	location b2.fudacioncovid19.com/	0 0	25ms 24ms	Script text/html	167.114.124.45 OVH
General Check archive.org Show headers Download Go to Full URL https://b2.fudacioncovid19.com/location Requested by Host: photo.pol2.quest URL: https://photo.pol2.quest/85lo0hmh5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 167.114.124.45 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip45.ip-167-114-124.net Software / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://photo.pol2.quest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers
GET H2	200	hlvibnBVrEb.svg static.xx.fbcdn.net/rsrc.php/yd/r/	1 KB 1021 B	69ms 23ms	Image image/svg+xml	2a03:2880:f012:10c:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/yd/r/hlvibnBVrEb.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 260fbeb66875b6936348afe61b469beaf6141aa28977872569305962c8b6f9c2 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://photo.pol2.quest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Fri, 22 Apr 2022 03:16:15 GMT content-encoding br x-content-type-options nosniff content-md5 zyWuqycyKYApjQg2HupHiA== document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 573 x-fb-rlafr 0 x-fb-debug i1fnxf/P5br/YF7/QTIjtLQI6KdzmhCEF4wNtnChDvOC/urlXvnbDMqbMrI6v25JBwbKLEuuSDh3WxdvCoZeJQ== x-fb-trip-id 1512268381 last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public,max-age=31536000,immutable timing-allow-origin * expires Fri, 14 Apr 2023 17:19:23 GMT
GET DATA	200 OK	truncated /	954 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0cae74ee5bad20861dee4906df15d793b948297238f4da81c1b0d7adf3d25f38 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	/ whos.amung.us/pingjs/	27 B 27 B	87ms 27ms	Image text/javascript	67.202.114.216 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=jehova00&t=frodo2022%F0%9F%98%8D&x=%20https://m.twitch.tv/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.216 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer https://photo.pol2.quest/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Fri, 22 Apr 2022 03:16:15 GMT content-encoding gzip content-type text/javascript;charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

static.twitchcdn.net

URL

https://static.twitchcdn.net/config/settings.846c6a057dc99e757f663107b0c1a0d9.js

Domain

static.twitchcdn.net

URL

https://static.twitchcdn.net/assets/core-8794e231392b17c1743b.css

Domain

static.twitchcdn.net

URL

https://static.twitchcdn.net/assets/vendor-3ef5bdef37294cab0e58.js

Domain

static.twitchcdn.net

URL

https://static.twitchcdn.net/assets/core-300e8c50fd4c979b58e0.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| webVitals function| prefersDarkMode number| __twilightApproximatedFirstPaint string| defaultSpadeEndpoint object| entries object| cookies object| entry undefined| vodID string| channelName undefined| authorization object| commonOptions string| playerType object| playerRoutesExact object| playerRoutesStartsWith string| pathname string| query object| bodyBase string| body object| blob object| req function| fetchlike string| __twilightBuildID object| __vat object| webpackChunktwitch_twilight boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| __updateOrientation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://photo.pol2.quest/85lo0hmh5 Message: Access to CSS stylesheet at 'https://static.twitchcdn.net/assets/core-8794e231392b17c1743b.css' from origin 'https://photo.pol2.quest' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.twitchcdn.net/assets/core-8794e231392b17c1743b.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://photo.pol2.quest/85lo0hmh5 Message: Access to script at 'https://static.twitchcdn.net/config/settings.846c6a057dc99e757f663107b0c1a0d9.js' from origin 'https://photo.pol2.quest' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.twitchcdn.net/config/settings.846c6a057dc99e757f663107b0c1a0d9.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://photo.pol2.quest/85lo0hmh5 Message: Access to script at 'https://static.twitchcdn.net/assets/vendor-3ef5bdef37294cab0e58.js' from origin 'https://photo.pol2.quest' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.twitchcdn.net/assets/vendor-3ef5bdef37294cab0e58.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://photo.pol2.quest/85lo0hmh5 Message: Access to script at 'https://static.twitchcdn.net/assets/core-300e8c50fd4c979b58e0.js' from origin 'https://photo.pol2.quest' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.twitchcdn.net/assets/core-300e8c50fd4c979b58e0.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://b2.fudacioncovid19.com/location Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b2.fudacioncovid19.com
gql.twitch.tv
p.twitchcdn.net
photo.pol2.quest
spade.twitch.tv
static.twitchcdn.net
static.xx.fbcdn.net
whos.amung.us
static.twitchcdn.net
151.101.130.167
151.101.210.167
167.114.124.45
170.10.160.83
2a03:2880:f012:10c:face:b00c:0:3
44.238.107.191
67.202.114.216
0cae74ee5bad20861dee4906df15d793b948297238f4da81c1b0d7adf3d25f38
260fbeb66875b6936348afe61b469beaf6141aa28977872569305962c8b6f9c2
3057f137b83068b9535f8ab39611f8c9f4fcd4d474719b2c99c9813b8784e8dd
92b0cda84d4b214e9d74b16bf638f50db3233ae9feaef1b75daf07fc31c9f8f1
ace6108ff2fbae1a6fada042aeabac0bfdf46366f285678d153a1a908045aade
e337102583693e0bb87572913fc2e8481a3a4fc773c893420545b71ad3121156
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855