www.facebook.com.cwr-art.com Open in urlscan Pro
193.189.139.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.facebook.com.cwr-art.com/
Effective URL:
https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true
Submission: On February 27 via automatic, source certstream-suspicious (February 27th 2020, 10:55:58 am UTC)

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 193.189.139.34, located in Netherlands and belongs to VIVOR-AS, NL. The main domain is www.facebook.com.cwr-art.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 27th 2020. Valid for: 3 months.

This is the only time www.facebook.com.cwr-art.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
1 10	193.189.139.34 193.189.139.34		34942 (VIVOR-AS) (VIVOR-AS)
9	2

10 193.189.139.34 (Netherlands) 1 redirects

ASN34942 (VIVOR-AS, NL)
PTR: angela.zenid.net

www.facebook.com.cwr-art.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	cwr-art.com 1 redirects www.facebook.com.cwr-art.com	277 KB
9	1

	Domain	Requested by
10	www.facebook.com.cwr-art.com	1 redirects www.facebook.com.cwr-art.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
facebook.com.cwr-art.com Let's Encrypt Authority X3	`2020-02-27` - `2020-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true
Frame ID: 764E16E4CC84F4561840A3A22657B4A5
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in

Page URL History Show full URLs

https://www.facebook.com.cwr-art.com/ HTTP 302
https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Page URL

Detected technologies

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

276 kB
Transfer

274 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.facebook.com.cwr-art.com/ HTTP 302
https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response www.facebook.com.cwr-art.com/ Redirect Chain https://www.facebook.com.cwr-art.com/ https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true	7 KB 7 KB	101ms 99ms	Document text/html	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `28d485a725c0f5649d66cbc035c6ec5de2707c203abed285cb59e21b76a385b1` Request headers :method GET :authority www.facebook.com.cwr-art.com :scheme https :path /login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Thu, 27 Feb 2020 10:55:39 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 content-type text/html; charset=UTF-8 Redirect headers status 302 date Thu, 27 Feb 2020 10:55:39 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 location login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true content-type text/html; charset=UTF-8
GET H2	200	modal.js Show response www.facebook.com.cwr-art.com/fb_login_files/	14 KB 14 KB	128ms 126ms	Script application/javascript	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/fb_login_files/modal.js Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `8521048ffd2659447d3335e3444efa75ad217a6b865026a3a8d8a77351391d8f` Request headers Referer https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 27 Feb 2020 10:55:39 GMT last-modified Wed, 12 Jul 2017 09:31:02 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d931-3774-5541b79734180" content-type application/javascript status 200 accept-ranges bytes content-length 14196
GET H2	200	yRsrEo6f23y.css www.facebook.com.cwr-art.com/fb_login_files/	91 KB 91 KB	127ms 126ms	Stylesheet text/css	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/fb_login_files/yRsrEo6f23y.css Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `ce8cd9a74aa8be62e8accdf265547eed5d432edafe92ceae9a34b86d2caed131` Request headers Referer https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Origin https://www.facebook.com.cwr-art.com Sec-Fetch-Dest style User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 10:55:39 GMT last-modified Tue, 29 Aug 2017 11:26:14 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d947-16a60-557e2add20180" content-type text/css status 200 accept-ranges bytes content-length 92768
GET H2	200	xQ-fBqMutWX.css www.facebook.com.cwr-art.com/fb_login_files/	5 KB 5 KB	57ms 55ms	Stylesheet text/css	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/fb_login_files/xQ-fBqMutWX.css Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `5c57c97c17165690da796adee8d1e4c34d990db6ab53c7526a92b7e6eb49992c` Request headers Referer https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Origin https://www.facebook.com.cwr-art.com Sec-Fetch-Dest style User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 10:55:39 GMT last-modified Tue, 29 Aug 2017 02:53:38 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d943-134c-557db849eb080" content-type text/css status 200 accept-ranges bytes content-length 4940
GET H2	200	HUKazdsS6nj.css www.facebook.com.cwr-art.com/fb_login_files/	55 KB 55 KB	57ms 56ms	Stylesheet text/css	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/fb_login_files/HUKazdsS6nj.css Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `51af973a865d57ed37f54524a59d7ac9b15b5e3cc8779726847c7da7dd564ad2` Request headers Referer https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Origin https://www.facebook.com.cwr-art.com Sec-Fetch-Dest style User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 10:55:39 GMT last-modified Tue, 29 Aug 2017 11:25:36 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d92d-da2a-557e2ab8e2c00" content-type text/css status 200 accept-ranges bytes content-length 55850
GET H2	200	Vc0J30urjKv.css www.facebook.com.cwr-art.com/fb_login_files/	87 KB 87 KB	127ms 126ms	Stylesheet text/css	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com.cwr-art.com/fb_login_files/Vc0J30urjKv.css Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `d396fad09d319e35c54364c9fc4572518c39882b3e340e6ae1707cbc357407ed` Request headers Referer https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Origin https://www.facebook.com.cwr-art.com Sec-Fetch-Dest style User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 10:55:39 GMT last-modified Tue, 29 Aug 2017 02:53:38 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d93d-15a7b-557db849eb080" content-type text/css status 200 accept-ranges bytes content-length 88699
GET DATA	200 OK	truncated /	74 B 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8627d83666e5f29db4f5ddfba459bf17a542a4b20569815b8055223dbe6d3f75` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Origin https://www.facebook.com.cwr-art.com Response headers Content-Type text/css;charset=utf-8
GET H2	200	wJenc0Dii8d.png www.facebook.com.cwr-art.com/fb_login_files/	14 KB 14 KB	41ms 40ms	Image image/png	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com.cwr-art.com/fb_login_files/wJenc0Dii8d.png Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `c30dcf80fe031ae47998a29beeaf412036887f9dd230456c9aac8d4f1e0ed4b5` Request headers Referer https://www.facebook.com.cwr-art.com/fb_login_files/yRsrEo6f23y.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 27 Feb 2020 10:55:40 GMT last-modified Tue, 29 Aug 2017 11:24:38 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d940-36fb-557e2a8192980" content-type image/png status 200 accept-ranges bytes content-length 14075
GET H2	200	O7nelmd9XSI.png www.facebook.com.cwr-art.com/fb_login_files/	95 B 169 B	43ms 43ms	Image image/png	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com.cwr-art.com/fb_login_files/O7nelmd9XSI.png Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c` Request headers Referer https://www.facebook.com.cwr-art.com/fb_login_files/HUKazdsS6nj.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 27 Feb 2020 10:55:40 GMT last-modified Tue, 29 Aug 2017 11:24:28 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d934-5f-557e2a7809300" content-type image/png status 200 accept-ranges bytes content-length 95
GET H2	200	IqVixQJiiaf.png www.facebook.com.cwr-art.com/fb_login_files/	2 KB 2 KB	41ms 41ms	Image image/png	193.189.139.34 VIVOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com.cwr-art.com/fb_login_files/IqVixQJiiaf.png Requested by Host: www.facebook.com.cwr-art.com URL: https://www.facebook.com.cwr-art.com/login.php?&sessionid=7f9b259d3cb16294067d453cfcadb39c&securessl=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.189.139.34 , Netherlands, ASN34942 (VIVOR-AS, NL), Reverse DNS angela.zenid.net Software Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 / Resource Hash `b79608b51853eb70b01d8b19ab5a706b3906f323a3d9748cd7e631835f617017` Request headers Referer https://www.facebook.com.cwr-art.com/fb_login_files/yRsrEo6f23y.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 27 Feb 2020 10:55:40 GMT last-modified Tue, 29 Aug 2017 11:24:48 GMT server Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 etag "22d92f-92c-557e2a8b1c000" content-type image/png status 200 accept-ranges bytes content-length 2348

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.facebook.com.cwr-art.com
193.189.139.34
28d485a725c0f5649d66cbc035c6ec5de2707c203abed285cb59e21b76a385b1
51af973a865d57ed37f54524a59d7ac9b15b5e3cc8779726847c7da7dd564ad2
5c57c97c17165690da796adee8d1e4c34d990db6ab53c7526a92b7e6eb49992c
8521048ffd2659447d3335e3444efa75ad217a6b865026a3a8d8a77351391d8f
8627d83666e5f29db4f5ddfba459bf17a542a4b20569815b8055223dbe6d3f75
b79608b51853eb70b01d8b19ab5a706b3906f323a3d9748cd7e631835f617017
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
c30dcf80fe031ae47998a29beeaf412036887f9dd230456c9aac8d4f1e0ed4b5
ce8cd9a74aa8be62e8accdf265547eed5d432edafe92ceae9a34b86d2caed131
d396fad09d319e35c54364c9fc4572518c39882b3e340e6ae1707cbc357407ed

www.facebook.com.cwr-art.com Open in urlscan Pro 193.189.139.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

276 kBTransfer

274 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

www.facebook.com.cwr-art.com Open in urlscan Pro
193.189.139.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

276 kB
Transfer

274 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!