1364574862.online
Open in
urlscan Pro
2a02:4780:b:1038:0:908:36dc:b
Malicious Activity!
Public Scan
Effective URL: https://1364574862.online/appeal.php
Submission Tags: @ecarlesi possiblethreat #phishing #facebook Search All
Submission: On July 02 via api from SG — Scanned from SG
Summary
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on July 1st 2023. Valid for: 3 months.
This is the only time 1364574862.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 2a02:4780:b:1... 2a02:4780:b:1038:0:908:36dc:b | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2404:6800:400... 2404:6800:4005:805::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2404:6800:400... 2404:6800:4005:809::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2404:6800:400... 2404:6800:4005:811::200e | 15169 (GOOGLE) (GOOGLE) | |
12 | 6 |
ASN47583 (AS-HOSTINGER, CY)
1364574862.online |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
1364574862.online
2 redirects
1364574862.online |
23 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 63 |
21 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 79 |
142 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433 |
31 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 368 |
8 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2767 |
25 KB |
12 | 6 |
Domain | Requested by | |
---|---|---|
6 | 1364574862.online |
2 redirects
1364574862.online
|
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.googletagmanager.com |
1364574862.online
www.googletagmanager.com |
1 | ajax.googleapis.com |
1364574862.online
|
1 | cdn.jsdelivr.net |
1364574862.online
|
1 | stackpath.bootstrapcdn.com |
1364574862.online
|
12 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
1364574862.online ZeroSSL RSA Domain Secure Site CA |
2023-07-01 - 2023-09-29 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://1364574862.online/appeal.php
Frame ID: 7482430CA153E766ACD8A1F1F1092727
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
FacebookPage URL History Show full URLs
-
http://1364574862.online/
HTTP 301
https://1364574862.online/ HTTP 302
https://1364574862.online/appeal.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://1364574862.online/
HTTP 301
https://1364574862.online/ HTTP 302
https://1364574862.online/appeal.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
appeal.php
1364574862.online/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
forbusiness.svg
1364574862.online/ |
8 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
175 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
1364574862.online/ |
59 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
YQNfPR9MJfx.png
1364574862.online/rsrc.php/v3/yO/r/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
217 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 207 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 56 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData function| Popper function| submitFunction object| bootstrap function| $ function| jQuery5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
1364574862.online/ | Name: PHPSESSID Value: bt7qjidb7lljb8rkipfe9saiug |
|
.1364574862.online/ | Name: _gid Value: GA1.2.657637317.1688264324 |
|
.1364574862.online/ | Name: _gat_gtag_UA_177207786_1 Value: 1 |
|
.1364574862.online/ | Name: _ga_E1JRCPFLF6 Value: GS1.1.1688264324.1.0.1688264324.0.0.0 |
|
.1364574862.online/ | Name: _ga Value: GA1.1.432548734.1688264324 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1364574862.online
ajax.googleapis.com
cdn.jsdelivr.net
stackpath.bootstrapcdn.com
www.google-analytics.com
www.googletagmanager.com
2404:6800:4005:805::2008
2404:6800:4005:809::200a
2404:6800:4005:811::200e
2606:4700::6812:acf
2a02:4780:b:1038:0:908:36dc:b
2a04:4e42::485
08ec9a678697a078037f6931d7887a5027d8c51bdd98ddc8c6dfc69013b9bcea
1ef322f6e3fe1c3e4bb2495fa431744e3ceeb182f628094d5c189d6e96421c4c
2df0926d586e81ff390af82744175ea140e467c0cf43084ff4785d3dbd0cb53b
32bc5e2a8f7069d7e0fac1f9c6e9065333fe66d6ffae2d78c5a30490659f7343
3d70ce95eb1eb78620cc57fe1a6a479e6f2d70508bf813238e573863df000d6e
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
d267f11c28aa9deeefe75db94f86359841d25a26df8b61580937be4f5b9ad766
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e