f2f8zd.csb.app Open in urlscan Pro
2606:4700:4400::6812:24f5  Malicious Activity! Public Scan

URL: https://f2f8zd.csb.app/
Submission: On June 25 via automatic, source openphish — Scanned from DE

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 9 HTTP transactions. The main IP is 2606:4700:4400::6812:24f5, located in United States and belongs to CLOUDFLARENET, US. The main domain is f2f8zd.csb.app.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 2nd 2022. Valid for: a year.
This is the only time f2f8zd.csb.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:440... 13335 (CLOUDFLAR...)
3 2606:4700:440... 13335 (CLOUDFLAR...)
1 3 2a02:4780:1:6... 47583 (AS-HOSTINGER)
2 67.202.94.86 32748 (STEADFAST)
9 5
Apex Domain
Subdomains
Transfer
3 cabadita.com
cabadita.com
12 KB
3 codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 85427
47 KB
2 amung.us
whos.amung.us — Cisco Umbrella Rank: 14886
169 B
2 csb.app
f2f8zd.csb.app
1 KB
9 4
Domain Requested by
3 cabadita.com 1 redirects f2f8zd.csb.app
3 codesandbox.io f2f8zd.csb.app
codesandbox.io
2 whos.amung.us f2f8zd.csb.app
2 f2f8zd.csb.app cabadita.com
9 4

This site contains no links.

Subject Issuer Validity Valid
csb.app
Cloudflare Inc ECC CA-3
2022-03-02 -
2023-03-01
a year crt.sh
codesandbox.io
Cloudflare Inc ECC CA-3
2022-04-18 -
2023-04-18
a year crt.sh
cabadita.com
ZeroSSL RSA Domain Secure Site CA
2022-04-27 -
2022-07-26
3 months crt.sh
*.amung.us
Sectigo RSA Domain Validation Secure Server CA
2022-05-18 -
2023-06-17
a year crt.sh

This page contains 1 frames:

Primary Page: https://f2f8zd.csb.app/
Frame ID: A54482EB96424F2C261AC0CCEC6C86DD
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Log into Facebook | Facebook

Page Statistics

9
Requests

89 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

1
Countries

60 kB
Transfer

204 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://cabadita.com/pc/location HTTP 301
  • https://cabadita.com/pc/location/

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
f2f8zd.csb.app/
354 B
553 B
Document
General
Full URL
https://f2f8zd.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:24f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff5cb4097ca03b396219ffe7129f647c4cf90e13b9a6f8fe2cbe61f5fa4ea1c0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-cache, no-store
cf-cache-status
DYNAMIC
cf-ray
720d903cef129ba0-FRA
content-encoding
br
content-type
text/html
date
Sat, 25 Jun 2022 12:04:02 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
vary
Accept-Encoding
via
1.1 google
x-request-id
Fvvbgs4-NluME1QUUvfC
sse-hooks.f648b14c15c640a14a557113a991cb8d.js
codesandbox.io/public/sse-hooks/
172 KB
44 KB
Script
General
Full URL
https://codesandbox.io/public/sse-hooks/sse-hooks.f648b14c15c640a14a557113a991cb8d.js
Requested by
Host: f2f8zd.csb.app
URL: https://f2f8zd.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:90ef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:02 GMT
via
1.1 google
cf-cache-status
HIT
age
10093193
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 23 Feb 2022 10:43:08 GMT
server
cloudflare
etag
W/"62160fbc-2aeac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
720d903e1e549188-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
banner.be879265d.js
codesandbox.io/static/js/
4 KB
2 KB
Script
General
Full URL
https://codesandbox.io/static/js/banner.be879265d.js
Requested by
Host: f2f8zd.csb.app
URL: https://f2f8zd.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:90ef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:02 GMT
via
1.1 google
cf-cache-status
HIT
age
13061262
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 19 Jan 2022 13:20:28 GMT
server
cloudflare
etag
W/"61e8101c-f3a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
720d903e1e569188-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
cabadita.com/pc/
20 KB
12 KB
Script
General
Full URL
https://cabadita.com/pc/?api=1&lan=mobil&ht=2
Requested by
Host: f2f8zd.csb.app
URL: https://f2f8zd.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:4780:1:636:0:1c54:eb7b:6 , United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.26
Resource Hash
371fe197c04a8d0260b1069e5967a1aa40d141ce9e2fee63fe5079ec97464fd5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 25 Jun 2022 12:04:03 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.4.26
vary
Accept-Encoding
content-type
application/javascript
cache-control
no-store, no-cache, must-revalidate
content-security-policy
upgrade-insecure-requests
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
expires
Thu, 19 Nov 1981 08:52:00 GMT
phishing
codesandbox.io/api/v1/sandboxes/f2f8zd/
33 B
456 B
Fetch
General
Full URL
https://codesandbox.io/api/v1/sandboxes/f2f8zd/phishing
Requested by
Host: codesandbox.io
URL: https://codesandbox.io/static/js/banner.be879265d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:4400::ac40:90ef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d91020394c232a07e303c0caff12346b174a759ed94de8bb0eac6c8b60e2660

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:03 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin
content-type
application/vnd.github.v3+json; charset=utf-8
access-control-allow-origin
https://f2f8zd.csb.app
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
cf-ray
720d903e688d91d2-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
33
x-request-id
FvvbgtWUzU8Cjx0UUvzC
styles.css
f2f8zd.csb.app/
354 B
524 B
Stylesheet
General
Full URL
https://f2f8zd.csb.app/styles.css?v=1656158643
Requested by
Host: cabadita.com
URL: https://cabadita.com/pc/?api=1&lan=mobil&ht=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:4400::6812:24f5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff5cb4097ca03b396219ffe7129f647c4cf90e13b9a6f8fe2cbe61f5fa4ea1c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray
720d90430c95917d-FRA
date
Sat, 25 Jun 2022 12:04:04 GMT
via
1.1 google
cf-cache-status
MISS
last-modified
Sat, 25 Jun 2022 12:04:04 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html
cache-control
private, max-age=0, no-cache, no-store
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id
FvvbgwwlN178Y_AV6pXB
/
whos.amung.us/pingjs/
28 B
144 B
Fetch
General
Full URL
https://whos.amung.us/pingjs/?k=teamcr2025
Requested by
Host: f2f8zd.csb.app
URL: https://f2f8zd.csb.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.202.94.86 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
b58e83fdd66a83aa3d693d500a6285a69b599d665a96ff381747d3e4ea3d2403

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:03 GMT
content-encoding
gzip
content-type
text/javascript;charset=UTF-8
/
cabadita.com/pc/location/
Redirect Chain
  • https://cabadita.com/pc/location
  • https://cabadita.com/pc/location/
1 KB
644 B
Script
General
Full URL
https://cabadita.com/pc/location/
Protocol
H3
Server
2a02:4780:1:636:0:1c54:eb7b:6 , United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.26
Resource Hash
22710290fd086d33f2b7b6088bbaf62bebb8ba299149914736b0d69194d3eb94
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:04 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.4.26
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
content-security-policy
upgrade-insecure-requests
content-length
521
expires
Sat, 02 Jul 2022 12:04:04 GMT

Redirect headers

location
https://cabadita.com/pc/location/
content-security-policy
upgrade-insecure-requests
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
server
LiteSpeed
date
Sat, 25 Jun 2022 12:04:03 GMT
content-length
707
content-type
text/html
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9c74356e8464722d314b3b8ac1dfe373a43b1325c85f2faeae17f3d941203e2e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9cc994413cf9252fa1565b865769689c57b695e5602d6bc509d55ffac0ac249f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
/
whos.amung.us/pingjs/
25 B
25 B
Image
General
Full URL
https://whos.amung.us/pingjs/?k=reyes07&t=pc&x=https://www.youtube.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
67.202.94.86 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://f2f8zd.csb.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Sat, 25 Jun 2022 12:04:03 GMT
content-encoding
gzip
content-type
text/javascript;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms

0 Cookies