supportbusiness-verifyadvertising.com Open in urlscan Pro
2606:4700:3030::6815:3494 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://supportbusiness-verifyadvertising.com/
Submission: On March 26 via automatic, source certstream-suspicious (March 26th 2024, 7:02:58 pm UTC) — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3030::6815:3494, located in United States and belongs to CLOUDFLARENET, US. The main domain is supportbusiness-verifyadvertising.com.
TLS certificate: Issued by E1 on March 26th 2024. Valid for: 3 months.

This is the only time supportbusiness-verifyadvertising.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3030::6815:3494	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	104.16.86.20 104.16.86.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	172.67.200.139 172.67.200.139	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
14	6

1 2606:4700:3030::6815:3494 (United States)

ASN13335 (CLOUDFLARENET, US)

supportbusiness-verifyadvertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.86.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.67.200.139 (United States)

ASN13335 (CLOUDFLARENET, US)

supportbusiness-verifyadvertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	supportbusiness-verifyadvertising.com supportbusiness-verifyadvertising.com	3 MB
3	gstatic.com fonts.gstatic.com	47 KB
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 834	10 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 449	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 112	1 KB
14	5

	Domain	Requested by
7	supportbusiness-verifyadvertising.com	supportbusiness-verifyadvertising.com
3	fonts.gstatic.com	fonts.googleapis.com
2	static.xx.fbcdn.net
1	cdn.jsdelivr.net	supportbusiness-verifyadvertising.com
1	fonts.googleapis.com	supportbusiness-verifyadvertising.com
14	5

This site contains no links.

Subject Issuer	Validity	Valid
supportbusiness-verifyadvertising.com E1	`2024-03-26` - `2024-06-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-04` - `2024-04-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://supportbusiness-verifyadvertising.com/
Frame ID: 381F0FD9ECC8231D3D4EA0A10335C5A8
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Support Help Contact

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

3489 kB
Transfer

4210 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
supportbusiness-verifyadvertising.com/ 1 KB
1 KB 127ms
63ms Document
text/html 2606:4700:3030::6815:3494
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://supportbusiness-verifyadvertising.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:3494 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90664810b8a8c7165ce12f1fe77c9601fa8848d9f2904bcd547fb9e109874699

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86a965c4998f699b-FRA
content-encoding: br
content-type: text/html
date: Tue, 26 Mar 2024 19:02:52 GMT
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V2se9T%2FCcr%2BrhCI3SiKE9NTCWEOElUuLTBdkilBBwE8ZOcqafzOT4LhXOYQtIIb8VwyH9bNG8KoT74kp2JxhVVGaisjh5TKrpUhTL2WPiBQI8t6wfQvglDB5sgEBpisPBWwgIXcWlM0eCWLoVK5PRNKZ9vmbVSrSqArDEzKL7hMoSyT0"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 79ms
30ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Requested by

Host: supportbusiness-verifyadvertising.com
URL: https://supportbusiness-verifyadvertising.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

59031fbe9c55f4bb1626065b56161ab7bdd3ae68912586f6f0e9735cc4badb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 26 Mar 2024 19:02:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Mar 2024 19:02:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 26 Mar 2024 19:02:53 GMT

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ 152 KB
24 KB 70ms
45ms Stylesheet
text/css 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

Requested by

Host: supportbusiness-verifyadvertising.com
URL: https://supportbusiness-verifyadvertising.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
Origin: https://supportbusiness-verifyadvertising.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1131613
x-jsd-version: 5.0.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230097-FRA, cache-lga21934-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yFbN2v1B%2B%2BVRKjE3bgq2IgF3zqg1cSxZJzXHv1Tz1AXZ6QP10au8qRNHDY78SMq%2FVU3AOblHxUqZ4opljafeQBYHwQjil0z%2B1i%2Fn65vi%2BcneDrJZHIwuwiCOPopal9WVtvI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86a965c52f173a85-FRA

GET
H3 200 main.38e4ebf7.js Show response
supportbusiness-verifyadvertising.com/static/js/ 823 KB
244 KB 186ms
186ms Script
application/javascript 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://supportbusiness-verifyadvertising.com/static/js/main.38e4ebf7.js
Requested by: Host: supportbusiness-verifyadvertising.com
URL: https://supportbusiness-verifyadvertising.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7fad5e9c21eef4c3ed535243ff63c76c32647e4b36703e95ff6afbc527977ba6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6603170b-cdd7f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zuiP8DNBllQ77o0ERZjGKSLXZwUDYVSpkfyrMYfYss32ltQn0k9z%2BftJ%2F%2FAm%2BcIusB6yJGy%2B56y8utu6r7Ih0DnExayldhOtHsLXAndpq09cKwgw3B3HNF40xDfow9lOw9FAF8NI4sQw8pY8r7Ood6oLn%2BW9PKwj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 86a965c52abb04aa-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.92cd38fb.css
supportbusiness-verifyadvertising.com/static/css/ 12 KB
4 KB 86ms
86ms Stylesheet
text/css 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://supportbusiness-verifyadvertising.com/static/css/main.92cd38fb.css
Requested by: Host: supportbusiness-verifyadvertising.com
URL: https://supportbusiness-verifyadvertising.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e5b6ec2430ad46b47b2374025ff34d6b027aa0d8bfd82730a42fd349538115a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6603170b-31f9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9dt%2BQ6a%2BIzQ9N2IS2wnCH07ivs8z2deQUb1jxoqC04UqkTuhfvV8Mb4ppwiu2LIOBw%2FGxdWQ7PahBnMQ22m605UIdElFzmS3qauT0A%2BuqcQKN0G1GVSz5Zqn3jA1AJ9vKipdWnT8SnbQb%2FUxOgNZyby%2Fo%2FwahBc"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 86a965c50a9304aa-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 pexels-binyamin-mellish-186078.75b5d52bc068ebba8786.png
supportbusiness-verifyadvertising.com/static/media/ 1 MB
1 MB 151ms
150ms Image
image/png 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://supportbusiness-verifyadvertising.com/static/media/pexels-binyamin-mellish-186078.75b5d52bc068ebba8786.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e744a0b7b4c51587e4e43acd7c903f19042277023f915410653cc7b01dcaade3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6603170b-11017f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZuUzBwnue%2F5eAIltBUF24aIPVN9W0YGlP%2FfPC3uCM36%2BR7fTe9V2oZBarR%2FkWT8gPJ18ZEFcTkK%2FZIE9GUTNOwvjIyzx7dg5RMsVVY2H0v%2F4PJyZ6yL6JPcCMwrH9LEJ4fuUNKvLjwlfJjSlF8z5q84kVWy%2FA1AU"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86a965c7be0504aa-CDG
alt-svc: h3=":443"; ma=86400
content-length: 1114495

GET
H3 200 pexels-alex-staudinger-1732414.b653d3234bbb06c26a1f.jpg
supportbusiness-verifyadvertising.com/static/media/ 2 MB
2 MB 139ms
139ms Image
image/jpeg 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://supportbusiness-verifyadvertising.com/static/media/pexels-alex-staudinger-1732414.b653d3234bbb06c26a1f.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 561029982d02fdf250f303bdf860793c31cf30b01ee2726668f70c0a5596f0f4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6603170b-19c0df"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IvfiJLDp2CDSJ03HTlewYVWiXHUCjHi%2F0HFMSKPrsTp1G8ZfXF5yqtKcXLnlmpDqT%2BocZww34o4zjeqRSOWJ0BrNPSmSMizr0A3zTyM9HHWpIj5IIjR1hh%2FsOxkshICj0e7v2FKzMPVmbJ73ytkDdpiSObci90E3"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86a965c7be0604aa-CDG
alt-svc: h3=":443"; ma=86400
content-length: 1687775

GET
H3 200 pexels-pixabay-271816.2d2e1749c12ea2cd56f5.jpg
supportbusiness-verifyadvertising.com/static/media/ 342 KB
343 KB 108ms
108ms Image
image/jpeg 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://supportbusiness-verifyadvertising.com/static/media/pexels-pixabay-271816.2d2e1749c12ea2cd56f5.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a97264562d9ea4bb79367ed41f6c2355b162bbd8d9626aa9b83360c008acba2

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6603170b-557dc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=08t%2FWnowMSqokdb4jevwuvBwBbUssbiTYgY1%2BntwLwwcS8qaWxl5GOADn6XepSuRbWB1kDbrOOUSkiEpmG8GFURO3S0xG2urorn2cBKQeO%2BCIY0uy%2Fa30IRaZOzjSPBdX3ODuOag7UmunrH7TkpC3CYURcH7B0Re"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86a965c7be0804aa-CDG
alt-svc: h3=":443"; ma=86400
content-length: 350172

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 84ms
27ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://supportbusiness-verifyadvertising.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 07:44:17 GMT
x-content-type-options: nosniff
age: 40716
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 07:44:17 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 103ms
47ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://supportbusiness-verifyadvertising.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 04:10:19 GMT
x-content-type-options: nosniff
age: 53554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 04:10:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 80ms
24ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://supportbusiness-verifyadvertising.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 01:17:56 GMT
x-content-type-options: nosniff
age: 63897
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 01:17:56 GMT

GET
H3 200 waring.f1ebfd88a8d439c9a344.png
supportbusiness-verifyadvertising.com/static/media/ 76 KB
76 KB 1176ms
1175ms Image
image/png 172.67.200.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://supportbusiness-verifyadvertising.com/static/media/waring.f1ebfd88a8d439c9a344.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.200.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8cb9a23a623e526f5c3399a6dbf7faf0eaa171846961a9867747676335f33d8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/help-100823847823627384548
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
cf-cache-status: MISS
last-modified: Tue, 26 Mar 2024 18:42:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6603170b-12f0f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=70hBD5Txjto81%2BWm%2FPwrys3Hhkgtq8RNVsOSPzHhpRd3upJlP5vD%2FT7M4CpJQ1lK3YKns%2FZtc20LzaBx%2Bchnh7GRNeJaXuOkgXywHvRxyfmLNeqNLWD6hBcMj5%2FhHzDcqrompUKxA3QtkQswQECKKnAIEMHmd0%2FS"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 86a965c7ce1604aa-CDG
alt-svc: h3=":443"; ma=86400
content-length: 77583

GET
H2 200 hLRJ1GG_y0J.ico
static.xx.fbcdn.net/rsrc.php/yb/r/ 4 KB
5 KB 70ms
23ms Other
image/x-icon 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/yb/r/hLRJ1GG_y0J.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
x-content-type-options: nosniff
content-md5: jN3KQn2um5Jec0MvhzPgWg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4286
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=18, rtx=0, c=12, mss=1294, tbw=2778, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: VCXg8Hx9ATop22KknMcp37NTbAs4ejhUZXPSOkVx/JV3xLUKCDHGV6Ns4d539myueoP7hU5R/rWkwfz8XukXoA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 13 Mar 2025 23:58:53 GMT

GET
H2 200 hLRJ1GG_y0J.ico
static.xx.fbcdn.net/rsrc.php/yb/r/ 4 KB
4 KB 70ms
23ms Other
image/x-icon 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/yb/r/hLRJ1GG_y0J.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://supportbusiness-verifyadvertising.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 19:02:53 GMT
x-content-type-options: nosniff
content-md5: jN3KQn2um5Jec0MvhzPgWg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4286
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=18, rtx=0, c=12, mss=1294, tbw=2778, tp=-1, tpl=-1, uplat=0, ullat=-1
x-fb-debug: VCXg8Hx9ATop22KknMcp37NTbAs4ejhUZXPSOkVx/JV3xLUKCDHGV6Ns4d539myueoP7hU5R/rWkwfz8XukXoA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Thu, 13 Mar 2025 23:58:53 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
static.xx.fbcdn.net
supportbusiness-verifyadvertising.com
104.16.86.20
172.67.200.139
2606:4700:3030::6815:3494
2a00:1450:4001:80b::2003
2a00:1450:4001:82b::200a
2a03:2880:f084:d:face:b00c:0:3
2a97264562d9ea4bb79367ed41f6c2355b162bbd8d9626aa9b83360c008acba2
4e5b6ec2430ad46b47b2374025ff34d6b027aa0d8bfd82730a42fd349538115a
561029982d02fdf250f303bdf860793c31cf30b01ee2726668f70c0a5596f0f4
59031fbe9c55f4bb1626065b56161ab7bdd3ae68912586f6f0e9735cc4badb64
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7fad5e9c21eef4c3ed535243ff63c76c32647e4b36703e95ff6afbc527977ba6
89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
90664810b8a8c7165ce12f1fe77c9601fa8848d9f2904bcd547fb9e109874699
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
e744a0b7b4c51587e4e43acd7c903f19042277023f915410653cc7b01dcaade3
e8cb9a23a623e526f5c3399a6dbf7faf0eaa171846961a9867747676335f33d8
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

supportbusiness-verifyadvertising.com Open in urlscan Pro 2606:4700:3030::6815:3494 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

3489 kBTransfer

4210 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

supportbusiness-verifyadvertising.com Open in urlscan Pro
2606:4700:3030::6815:3494 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

3489 kB
Transfer

4210 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!