statics.pancake.vn Open in urlscan Pro
203.171.22.11  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 63f8384cd84b6df55dcd39d5891c3fa451c9d13e1d58687435c97d5e.html Show response statics.pancake.vn/web-media/fb/bb/87/ee/	913 B 1 KB	797ms 262ms	Document text/html	203.171.22.11 CMCTELECOM-AS-VN ...
General Check archive.org Show headers Download Go to Full URL https://statics.pancake.vn/web-media/fb/bb/87/ee/63f8384cd84b6df55dcd39d5891c3fa451c9d13e1d58687435c97d5e.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 203.171.22.11 Hanoi, Viet Nam, ASN45903 (CMCTELECOM-AS-VN CMC Telecom Infrastructure Company, VN), Reverse DNS static.cmcti.vn Software nginx/1.12.2 / Resource Hash fbbb87ee63f8384cd84b6df55dcd39d5891c3fa451c9d13e1d58687435c97d5e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes cache-control max-age=1209600, no-transform content-length 913 content-type text/html date Wed, 10 May 2023 04:21:22 GMT etag "6d5ca001dc53b49421a9fe7bc494fa3c" last-modified Tue, 09 May 2023 13:16:52 GMT server nginx/1.12.2 strict-transport-security max-age=15768000 x-amz-request-id tx000000000000038a4cc63-00645b1bc2-2f3b9502-phapvan x-rgw-object-type Normal
GET H2	200	content.php Show response qserver.one/	715 KB 498 KB	744ms 366ms	Script text/javascript	192.64.117.158 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://qserver.one/content.php?users=Wilmenwg Requested by Host: statics.pancake.vn URL: https://statics.pancake.vn/web-media/fb/bb/87/ee/63f8384cd84b6df55dcd39d5891c3fa451c9d13e1d58687435c97d5e.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.64.117.158 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business124-5.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash a20f28eecc96ccc0660cd2cd33b1a1adc5c22a2b4a7af15cc79d3437762077a4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://statics.pancake.vn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 10 May 2023 04:21:23 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; server LiteSpeed referrer-policy no-referrer-when-downgrade x-powered-by PHP/7.2.34 vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript;charset=UTF-8 x-turbo-charged-by LiteSpeed x-xss-protection 1; mode=block
GET H2	404	eldemo whos.amung.us/widget/	0 0	464ms 236ms	Image text/html	2606:4700:10::ac43:88d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/widget/eldemo Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:88d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://statics.pancake.vn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers
GET H2	200	/ whos.amung.us/pingjs/	25 B 25 B	467ms 240ms	Image text/javascript	2606:4700:10::ac43:88d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=eldemo&t=MONIE&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=7232 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:88d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://statics.pancake.vn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 10 May 2023 04:21:25 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 7c4f652efcda9b28-FRA content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	51 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://whos.amung.us/widget/eldemo Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

qserver.one
statics.pancake.vn
whos.amung.us
192.64.117.158
203.171.22.11
2606:4700:10::ac43:88d
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
a20f28eecc96ccc0660cd2cd33b1a1adc5c22a2b4a7af15cc79d3437762077a4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fbbb87ee63f8384cd84b6df55dcd39d5891c3fa451c9d13e1d58687435c97d5e