f2f8zd.csb.app
Open in
urlscan Pro
2606:4700:4400::6812:24f5
Malicious Activity!
Public Scan
Submission: On June 25 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 2nd 2022. Valid for: a year.
This is the only time f2f8zd.csb.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2606:4700:440... 2606:4700:4400::6812:24f5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700:440... 2606:4700:4400::ac40:90ef | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 3 | 2a02:4780:1:6... 2a02:4780:1:636:0:1c54:eb7b:6 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
2 | 67.202.94.86 67.202.94.86 | 32748 (STEADFAST) (STEADFAST) | |
9 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cabadita.com
1 redirects
cabadita.com |
12 KB |
3 |
codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 85427 |
47 KB |
2 |
amung.us
whos.amung.us — Cisco Umbrella Rank: 14886 |
169 B |
2 |
csb.app
f2f8zd.csb.app |
1 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
3 | cabadita.com |
1 redirects
f2f8zd.csb.app
|
3 | codesandbox.io |
f2f8zd.csb.app
codesandbox.io |
2 | whos.amung.us |
f2f8zd.csb.app
|
2 | f2f8zd.csb.app |
cabadita.com
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
csb.app Cloudflare Inc ECC CA-3 |
2022-03-02 - 2023-03-01 |
a year | crt.sh |
codesandbox.io Cloudflare Inc ECC CA-3 |
2022-04-18 - 2023-04-18 |
a year | crt.sh |
cabadita.com ZeroSSL RSA Domain Secure Site CA |
2022-04-27 - 2022-07-26 |
3 months | crt.sh |
*.amung.us Sectigo RSA Domain Validation Secure Server CA |
2022-05-18 - 2023-06-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://f2f8zd.csb.app/
Frame ID: A54482EB96424F2C261AC0CCEC6C86DD
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://cabadita.com/pc/location HTTP 301
- https://cabadita.com/pc/location/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
f2f8zd.csb.app/ |
354 B 553 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sse-hooks.f648b14c15c640a14a557113a991cb8d.js
codesandbox.io/public/sse-hooks/ |
172 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.be879265d.js
codesandbox.io/static/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
cabadita.com/pc/ |
20 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
phishing
codesandbox.io/api/v1/sandboxes/f2f8zd/ |
33 B 456 B |
Fetch
application/vnd.github.v3+json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.css
f2f8zd.csb.app/ |
354 B 524 B |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
28 B 144 B |
Fetch
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
cabadita.com/pc/location/ Redirect Chain
|
1 KB 644 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
25 B 25 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cabadita.com
codesandbox.io
f2f8zd.csb.app
whos.amung.us
2606:4700:4400::6812:24f5
2606:4700:4400::ac40:90ef
2a02:4780:1:636:0:1c54:eb7b:6
67.202.94.86
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73
22710290fd086d33f2b7b6088bbaf62bebb8ba299149914736b0d69194d3eb94
2d91020394c232a07e303c0caff12346b174a759ed94de8bb0eac6c8b60e2660
371fe197c04a8d0260b1069e5967a1aa40d141ce9e2fee63fe5079ec97464fd5
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60
9c74356e8464722d314b3b8ac1dfe373a43b1325c85f2faeae17f3d941203e2e
9cc994413cf9252fa1565b865769689c57b695e5602d6bc509d55ffac0ac249f
b58e83fdd66a83aa3d693d500a6285a69b599d665a96ff381747d3e4ea3d2403
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff5cb4097ca03b396219ffe7129f647c4cf90e13b9a6f8fe2cbe61f5fa4ea1c0