ver-id-1230.firebaseapp.com Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ver-id-1230.firebaseapp.com/
Submission: On January 15 via automatic, source phishtank (January 15th 2024, 3:50:39 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is ver-id-1230.firebaseapp.com.
TLS certificate: Issued by GTS CA 1D4 on November 13th 2023. Valid for: 3 months.

This is the only time ver-id-1230.firebaseapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
7	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3031::6815:5328	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.87.62.255 34.87.62.255	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
11	4

7 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

ver-id-1230.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

freeipapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6815:5328 (United States)

ASN13335 (CLOUDFLARENET, US)

chingman.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.87.62.255 (Singapore, Singapore)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 255.62.87.34.bc.googleusercontent.com

x1.function.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	firebaseapp.com ver-id-1230.firebaseapp.com	8 MB
2	function.sh x1.function.sh	279 B
1	chingman.net chingman.net	869 KB
1	freeipapi.com freeipapi.com — Cisco Umbrella Rank: 120671	733 B
11	4

	Domain	Requested by
7	ver-id-1230.firebaseapp.com	ver-id-1230.firebaseapp.com
2	x1.function.sh	ver-id-1230.firebaseapp.com
1	chingman.net	ver-id-1230.firebaseapp.com
1	freeipapi.com	ver-id-1230.firebaseapp.com
11	4

This site contains no links.

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1D4	`2023-11-13` - `2024-02-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-20` - `2024-02-20`	a year	crt.sh
chingman.net E1	`2024-01-02` - `2024-04-01`	3 months	crt.sh
x1.function.sh R3	`2024-01-13` - `2024-04-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ver-id-1230.firebaseapp.com/
Frame ID: EBAF0EBF072CCA0A086EC37E17F32312
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Meta Business

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

11
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

9155 kB
Transfer

10221 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ver-id-1230.firebaseapp.com/ 575 B
572 B 198ms
58ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://ver-id-1230.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a95e07f9ef2c3960b98f79177e4224b382c57191bf274e61cc695ace6d942028

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 208
content-type: text/html; charset=utf-8
date: Mon, 15 Jan 2024 03:50:34 GMT
etag: "7cbbe0c94b217be5af67b58d6f621290e5412b70066873178be29fdaf28cbcd3-br"
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-sof1510026-SOF
x-timer: S1705290634.340536,VS0,VE1

GET
H2 200 chunk-vendors.9b9f46c3.js Show response
ver-id-1230.firebaseapp.com/js/ 298 KB
81 KB 79ms
77ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://ver-id-1230.firebaseapp.com/js/chunk-vendors.9b9f46c3.js

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

49ae0a7898048f958aaf9006f93b193e150351b88a7cf44087c48750d5e3c50f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510026-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 15 Jan 2024 03:50:34 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290634.404003,VS0,VE1
etag: "beded1a990150f6928918e46f43decd8cf8b4c538f63edfd6eb9756adc8cd666-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 83056
x-cache-hits: 1

GET
H2 200 app.f5ed184a.js Show response
ver-id-1230.firebaseapp.com/js/ 107 KB
21 KB 63ms
62ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://ver-id-1230.firebaseapp.com/js/app.f5ed184a.js

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5268ad3fe4fd4b4af79baf0164ee8400a91660fefa033b8a4363f8c5746551c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510026-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 15 Jan 2024 03:50:34 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290634.404022,VS0,VE1
etag: "5660f47fa4bb0614a2c5a7f9835ad4a2f009e853e7aa0d796c692022027bb024-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 21551
x-cache-hits: 1

GET
H2 200 app.eac239d4.css
ver-id-1230.firebaseapp.com/css/ 35 KB
6 KB 58ms
57ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://ver-id-1230.firebaseapp.com/css/app.eac239d4.css

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0aafabb1b825612490c8848e0834b46143f0c6750074a457977833108b6a5837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510026-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 15 Jan 2024 03:50:34 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290634.403844,VS0,VE0
etag: "5ed7ab9cdf70b29f722b102a5d9b596cc6715f27bea32a7b0c93c22d2b79a064-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5932
x-cache-hits: 1

GET
H2 200 json Show response
freeipapi.com/api/ 275 B
733 B 171ms
67ms Fetch
application/json 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freeipapi.com/api/json

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/js/app.f5ed184a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e0e454b415cf6db960cff869eec4390ad4451de8210949b324ea25c7eacb52b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 03:50:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-ratelimit-remaining: 59
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jyblw6Siq%2Bf2ONuDfFtuiwG%2BErjBlY6hN07%2BOlaT%2F0bEtdccRGMKl1CbGNVSPD8choclex1ySqFp6xJR5K8R0xzZZJ8%2BBlYIkI%2FnpgRBGiLIuYHN0dEJSXXQTB8ArP6ZbV9Y6twvXnSRG2qr"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, private
x-ratelimit-limit: 60
cf-ray: 845b27c2f9453649-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 loadingLogo.085728eb.gif
ver-id-1230.firebaseapp.com/img/ 1 MB
1 MB 68ms
67ms Image
image/gif 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ver-id-1230.firebaseapp.com/img/loadingLogo.085728eb.gif

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c296b7a52bb832ae0bdb761d86989ce156c5cff905215c534c34d76f0474ca2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510023-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 15 Jan 2024 03:50:34 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290635.614960,VS0,VE10
etag: "733c2fc6cfba674ea4f2b18192056301959b6d829f0d6272952c0d0481f97b2d-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1243815
x-cache-hits: 1

GET
H2 200 27baHo4dN_O.png
chingman.net/ 868 KB
869 KB 155ms
48ms Image
image/png 2606:4700:3031::6815:5328
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chingman.net/27baHo4dN_O.png

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:5328 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3e46a6556f48d3aa959914ea9a1c29ed4af124befb30aa683605d5e1fba0068

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 03:50:34 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6918
alt-svc: h3=":443"; ma=86400
content-length: 888333
x-xss-protection: 1; mode=block
last-modified: Sun, 10 Dec 2023 19:41:09 GMT
server: cloudflare
etag: "65761455-d8e0d"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7VnNTeREdOPPNhFhy7EkcgTRxALr5znUpej%2BG1SrWVXAKiGHIsLMJHkk%2B7ZNGeEwKiUScQNa%2FI5g8ZdNZonOcoYgdPIOZi07RcwUbKwbzvTeR1KiC4Qq2w6XG94EsyeYAGeo6uiGc%2FdOQdI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 845b27c2fd11366b-FRA

POST
H2 200 tracking Show response
x1.function.sh/api/ 0
279 B 1257ms
1257ms XHR
text/html 34.87.62.255
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://x1.function.sh/api/tracking

Requested by

Host: ver-id-1230.firebaseapp.com
URL: https://ver-id-1230.firebaseapp.com/js/chunk-vendors.9b9f46c3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.87.62.255 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

255.62.87.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://ver-id-1230.firebaseapp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 15 Jan 2024 03:50:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
x-ratelimit-remaining: 59
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, private
x-ratelimit-limit: 60
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking
x1.function.sh/api/ 0
0 635ms
202ms Preflight 34.87.62.255
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://x1.function.sh/api/tracking

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.87.62.255 Singapore, Singapore, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

255.62.87.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://ver-id-1230.firebaseapp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 0
cache-control: no-cache, private
date: Mon, 15 Jan 2024 03:50:35 GMT
server: nginx
vary: Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H3 200 clip-online-security.36da537e.png
ver-id-1230.firebaseapp.com/img/ 216 KB
203 KB 58ms
58ms Image
image/png 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ver-id-1230.firebaseapp.com/img/clip-online-security.36da537e.png

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ab4208aacb46de175fb64aab75bc876538ad17240ebfd4e5949a4536b25b19dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510023-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
date: Mon, 15 Jan 2024 03:50:35 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290636.793267,VS0,VE0
etag: "d2fc2cc5b4ccc92f57152ffa55d77d1f9a976163070e17208bf68b55acdf4bd6"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/png
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 207947
x-cache-hits: 1

GET
H3 200 techny-secure-lock-and-key-successfully-unlocked.faaf6b7f.gif
ver-id-1230.firebaseapp.com/img/ 7 MB
7 MB 58ms
58ms Image
image/gif 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ver-id-1230.firebaseapp.com/img/techny-secure-lock-and-key-successfully-unlocked.faaf6b7f.gif

Protocol

Security

QUIC, , AES_256_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b33cd438d4d34ab2cb9ed56cdc5462c8461bfb832bb0850ab234fa40d73e900a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ver-id-1230.firebaseapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

x-served-by: cache-sof1510023-SOF
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Mon, 15 Jan 2024 03:50:35 GMT
last-modified: Fri, 29 Dec 2023 17:22:38 GMT
x-timer: S1705290636.793259,VS0,VE1
etag: "69af848b2f0038496dfb5107dc948373011094a10083e3e5c7c7e1b01d45a865-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6918849
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chingman.net
freeipapi.com
ver-id-1230.firebaseapp.com
x1.function.sh
2606:4700:3031::6815:5328
2620:0:890::100
2a06:98c1:3121::3
34.87.62.255
0aafabb1b825612490c8848e0834b46143f0c6750074a457977833108b6a5837
49ae0a7898048f958aaf9006f93b193e150351b88a7cf44087c48750d5e3c50f
5268ad3fe4fd4b4af79baf0164ee8400a91660fefa033b8a4363f8c5746551c5
7e0e454b415cf6db960cff869eec4390ad4451de8210949b324ea25c7eacb52b
a95e07f9ef2c3960b98f79177e4224b382c57191bf274e61cc695ace6d942028
ab4208aacb46de175fb64aab75bc876538ad17240ebfd4e5949a4536b25b19dc
b33cd438d4d34ab2cb9ed56cdc5462c8461bfb832bb0850ab234fa40d73e900a
c296b7a52bb832ae0bdb761d86989ce156c5cff905215c534c34d76f0474ca2c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3e46a6556f48d3aa959914ea9a1c29ed4af124befb30aa683605d5e1fba0068

ver-id-1230.firebaseapp.com Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

9155 kBTransfer

10221 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ver-id-1230.firebaseapp.com Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

9155 kB
Transfer

10221 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!