www.facebook-login.demo.inano.ro

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 89.44.120.66, located in Romania and belongs to CYBERFOLKS-ROMANIA-DC-CLJ, RO. The main domain is www.facebook-login.demo.inano.ro.
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.

This is the only time www.facebook-login.demo.inano.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2	89.44.120.66 89.44.120.66	44043 (CYBERFOLK...) (CYBERFOLKS-ROMANIA-DC-CLJ)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	146.75.36.193 146.75.36.193	54113 (FASTLY) (FASTLY)
6	4

2 89.44.120.66 (Romania)

ASN44043 (CYBERFOLKS-ROMANIA-DC-CLJ, RO)
PTR: 66-120-static.mxserver.ro

www.facebook-login.demo.inano.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.193 (Reston, United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 770	3 KB
2	inano.ro www.facebook-login.demo.inano.ro	4 KB
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 6429	31 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 395	11 KB
6	4

	Domain	Requested by
2	static.xx.fbcdn.net	www.facebook-login.demo.inano.ro
2	www.facebook-login.demo.inano.ro	www.facebook-login.demo.inano.ro
1	i.imgur.com	www.facebook-login.demo.inano.ro
1	cdnjs.cloudflare.com	www.facebook-login.demo.inano.ro
6	4

This site contains links to these domains. Also see Links.

Domain
github.com

Subject Issuer	Validity	Valid
facebook-login.demo.inano.ro R3	`2024-01-09` - `2024-04-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-10-19` - `2024-01-17`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-13` - `2024-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.facebook-login.demo.inano.ro/
Frame ID: 157E5C74EA0B5C2D2C8F0AA8A9EFC92B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook Test - login or signup

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

49 kB
Transfer

108 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/manasyahuu
Title: Clona Facebook - Ene George Cristian © 2023

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.facebook-login.demo.inano.ro/ 8 KB
2 KB 1226ms
261ms Document
text/html 89.44.120.66
CYBERFOLKS-ROMANI...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.facebook-login.demo.inano.ro/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 89.44.120.66 , Romania, ASN44043 (CYBERFOLKS-ROMANIA-DC-CLJ, RO),
Reverse DNS: 66-120-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: 6d88ef0750f9e788d5af8608bdf07483b0bacc609050689ab88b27716e32c167

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 09 Jan 2024 21:40:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding,User-Agent

GET
H2 200 styles.css
www.facebook-login.demo.inano.ro/css/ 7 KB
2 KB 205ms
203ms Stylesheet
text/css 89.44.120.66
CYBERFOLKS-ROMANI...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.facebook-login.demo.inano.ro/css/styles.css
Requested by: Host: www.facebook-login.demo.inano.ro
URL: https://www.facebook-login.demo.inano.ro/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 89.44.120.66 , Romania, ASN44043 (CYBERFOLKS-ROMANIA-DC-CLJ, RO),
Reverse DNS: 66-120-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: 6272bff8ac15d694c7f52f7a173f562c63ecb6c1393208c6c02741faa8e4c364

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.facebook-login.demo.inano.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 21:40:46 GMT
content-encoding: br
last-modified: Tue, 09 Jan 2024 18:25:54 GMT
server: LiteSpeed
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1856
expires: Tue, 16 Jan 2024 21:40:46 GMT

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 57 KB
11 KB 143ms
42ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Requested by

Host: www.facebook-login.demo.inano.ro
URL: https://www.facebook-login.demo.inano.ro/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.facebook-login.demo.inano.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 21:40:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2343520
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 10301
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-e4d2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=523s22iultotRzqRerzIoR3QZqeLDwM7wDwaUzjTeUmwHzpm6C253KKoFl7h%2FKj5v3L3RgbYG8F7IIgaTMv9XglmhWQn7LMZR9B1i%2Fof%2FlCq2y7J%2BPR2CqP5RNgZNaHPLJ8%2BST8X5L0rRrjZclG%2FG645"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 842fd72e8d37370c-MIA
expires: Sun, 29 Dec 2024 21:40:46 GMT

GET
H2 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
1 KB 231ms
87ms Image
image/svg+xml 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Host: www.facebook-login.demo.inano.ro
URL: https://www.facebook-login.demo.inano.ro/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.facebook-login.demo.inano.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
date: Tue, 09 Jan 2024 21:40:46 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1027
reporting-endpoints
x-fb-debug: IVz1Mv4aqBmo9rsWuC0vYiCHy8ZCN+DKinJtE5XXQR0ekq9Ue1W4kclyLxiFrIf7UEWmxf33nk9PM8BQTaLY8w==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Wed, 01 Jan 2025 08:58:46 GMT

GET
H2 200 4lCu2zih0ca.svg
static.xx.fbcdn.net/rsrc.php/y1/r/ 2 KB
2 KB 229ms
85ms Image
image/svg+xml 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y1/r/4lCu2zih0ca.svg

Requested by

Host: www.facebook-login.demo.inano.ro
URL: https://www.facebook-login.demo.inano.ro/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.facebook-login.demo.inano.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
date: Tue, 09 Jan 2024 21:40:46 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mOuWB7wXlE6XUTOVRHYuCQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 956
reporting-endpoints
x-fb-debug: alzfRHoPhvxjFYkXsS812T5v6LzmmzSUugAdwbQhRxgTa0BUehotmI71ZVIIs8UtrBcprSICS3qP6fpAL3JVQw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Thu, 26 Dec 2024 21:46:52 GMT

GET
H2 200 LLoz1n1.gif
i.imgur.com/ 31 KB
31 KB 370ms
66ms Image
image/gif 146.75.36.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/LLoz1n1.gif

Requested by

Host: www.facebook-login.demo.inano.ro
URL: https://www.facebook-login.demo.inano.ro/css/styles.css

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.36.193 Reston, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

a64d4961085f4165699553aa3fc486b7b97c6525ab95c68fb909dfa54babc2b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.facebook-login.demo.inano.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Tue, 09 Jan 2024 21:40:46 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: PHL50-C1
age: 2953813
x-cache: Miss from cloudfront, HIT
content-length: 31513
x-served-by: cache-iad-kcgs7200129-IAD
last-modified: Sat, 09 Sep 2017 01:04:16 GMT
server: cat factory 1.0
x-timer: S1704836447.914349,VS0,VE5
etag: "6a2928106b907101787cd87f6613bdec"
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: FCmHgA8uCT-ySVrqUwFJ1UBjFZPy2gSpm22mk7yHst92DjtuW1dmdA==
x-cache-hits: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.facebook-login.demo.inano.ro/	1969-12-31 23:59:59	Name: PHPSESSID Value: ct10vbv4ionlaufp3otnf6tse0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
i.imgur.com
static.xx.fbcdn.net
www.facebook-login.demo.inano.ro
146.75.36.193
2606:4700::6811:180e
2a03:2880:f012:8:face:b00c:0:1
89.44.120.66
0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a
6272bff8ac15d694c7f52f7a173f562c63ecb6c1393208c6c02741faa8e4c364
6d88ef0750f9e788d5af8608bdf07483b0bacc609050689ab88b27716e32c167
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
a64d4961085f4165699553aa3fc486b7b97c6525ab95c68fb909dfa54babc2b7

www.facebook-login.demo.inano.ro Open in urlscan Pro 89.44.120.66 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

49 kBTransfer

108 kBSize

1 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

www.facebook-login.demo.inano.ro Open in urlscan Pro
89.44.120.66 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

49 kB
Transfer

108 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!