mailus.ovh
Open in
urlscan Pro
144.91.84.114
Malicious Activity!
Public Scan
Submitted URL: https://www.facebook.mailus.ovh/
Effective URL: http://mailus.ovh/face/?id=login
Submission: On January 29 via automatic, source certstream-suspicious
Effective URL: http://mailus.ovh/face/?id=login
Submission: On January 29 via automatic, source certstream-suspicious
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 14 HTTP transactions.
The main IP is 144.91.84.114, located in
Germany and
belongs to CONTABO, DE.
The main domain is mailus.ovh.
This is the only time mailus.ovh was scanned on urlscan.io!
This is the only time mailus.ovh was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 16 | 144.91.84.114 144.91.84.114 | 51167 (CONTABO) (CONTABO) | |
| 14 | 2 |
16
144.91.84.114
(Germany)
ASN51167 (CONTABO, DE)
PTR: ip-114-84-91-144.static.contabo.net
ASN51167 (CONTABO, DE)
PTR: ip-114-84-91-144.static.contabo.net
| www.facebook.mailus.ovh | |
| mailus.ovh |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
mailus.ovh
2 redirects
www.facebook.mailus.ovh mailus.ovh |
527 KB |
| 14 | 1 |
| Domain | Requested by | |
|---|---|---|
| 14 | mailus.ovh |
mailus.ovh
|
| 2 | www.facebook.mailus.ovh | 2 redirects |
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://mailus.ovh/face/?id=login
Frame ID: 71DEDB62EAF520DCE325286F97C598F2
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.facebook.mailus.ovh/
HTTP 301
http://www.facebook.mailus.ovh/ HTTP 302
http://mailus.ovh/face/?id=login Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
20 Outgoing links
These are links going to different origins than the main page.
URL: https://www.facebook.com/recover/initiate/?ars=facebook_login
Title: Esqueceu a senha?
Title: Esqueceu a senha?
Search URL Search Domain Scan URL
URL: https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: English (US)
Title: English (US)
Search URL Search Domain Scan URL
URL: https://sq-al.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Shqip
Title: Shqip
Search URL Search Domain Scan URL
URL: https://tr-tr.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Türkçe
Title: Türkçe
Search URL Search Domain Scan URL
URL: https://bg-bg.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Български
Title: Български
Search URL Search Domain Scan URL
URL: https://ro-ro.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Română
Title: Română
Search URL Search Domain Scan URL
URL: https://ru-ru.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Русский
Title: Русский
Search URL Search Domain Scan URL
URL: https://ar-ar.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: العربية
Title: العربية
Search URL Search Domain Scan URL
URL: https://de-de.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Deutsch
Title: Deutsch
Search URL Search Domain Scan URL
URL: https://es-la.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Español
Title: Español
Search URL Search Domain Scan URL
URL: https://pt-br.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Frecover
Title: Português (Brasil)
Title: Português (Brasil)
Search URL Search Domain Scan URL
URL: https://el-gr.messenger.com/
Title: Messenger
Title: Messenger
Search URL Search Domain Scan URL
URL: https://www.facebook.com/friends/requests/?fcref=ffi
Title: Βρείτε φίλους
Title: Βρείτε φίλους
Search URL Search Domain Scan URL
URL: https://l.facebook.com/l.php?u=https%3A%2F%2Finstagram.com%2F&h=AT1TpRgLHUka0xDJ6MRHKLAMGf4mGS5Sin-ler7C3B-Aq7t9At6QAD8yvCcTUSY26lCXeezqOvB9GRC627BVuvXJ9_CE7yGTpLphSK-NOk2MX5mPkA18fyyTkuY6yHcQrApYZBhx1M7Bb9hS1X7q3w
Title: Instagram
Title: Instagram
Search URL Search Domain Scan URL
URL: https://l.facebook.com/l.php?u=https%3A%2F%2Fel-gr.facebook.com%2Fads%2Fcreate%2F%3Fcampaign_id%3D402047449186%26placement%3Dpflo%26extra_1%3Dnot-admgr-user&h=AT1eO-aD6w4hgqNt1ZztMicy1StWmBjRz8zSZOpT28rINsBouwauRiHhhsfe1gAjIs_v8fCLPwu5CVnBm09ONQ--vsxJ4605hNvkXHgx6g_Zd6Gxc0QTaWjyBezf--DHi6zBAm791DiR7fXFI7qr
Title: Δημιουργία διαφήμισης
Title: Δημιουργία διαφήμισης
Search URL Search Domain Scan URL
URL: https://developers.facebook.com/?ref=pf
Title: Προγραμματιστές
Title: Προγραμματιστές
Search URL Search Domain Scan URL
URL: https://www.facebook.com/help/568137493302217
Title: Οι διαφημίσεις μου
Title: Οι διαφημίσεις μου
Search URL Search Domain Scan URL
URL: https://www.facebook.com/help/2687943754764396
Title: Ασφάλεια λογαριασμού
Title: Ασφάλεια λογαριασμού
Search URL Search Domain Scan URL
URL: https://www.facebook.com/help/www/1573156092981768/
Title: Βοήθεια για τη σύνδεση
Title: Βοήθεια για τη σύνδεση
Search URL Search Domain Scan URL
URL: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen
Title: Ρυθμίσεις
Title: Ρυθμίσεις
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.facebook.mailus.ovh/
HTTP 301
http://www.facebook.mailus.ovh/ HTTP 302
http://mailus.ovh/face/?id=login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
mailus.ovh/face/ Redirect Chain
|
30 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
LgOiPuVvpbV.css
mailus.ovh/face/css/ |
72 KB 73 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1XIBjWSyEEB.css
mailus.ovh/face/css/ |
230 KB 230 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1FBstn8Sqii.css
mailus.ovh/face/css/ |
82 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
eHYU1NuJeQi.css
mailus.ovh/face/css/ |
12 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ZhxKPgLGsng.css
mailus.ovh/face/css/ |
19 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
23aPnoaeF68.css
mailus.ovh/face/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
oiMMhoZQ-V1.css
mailus.ovh/face/css/ |
29 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Yv7kRB_68g1.css
mailus.ovh/face/css/ |
19 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
74 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hsts-pixel6882.gif
mailus.ovh/fbsbx.com/security/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chiw34vGXw4.png
mailus.ovh/face/img/r/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uZu3h-eKyRA.png
mailus.ovh/face/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
O7nelmd9XSI.png
mailus.ovh/face/img/ |
95 B 335 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
uG24-qCWoPn.png
mailus.ovh/face/img/ |
17 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mailus.ovh
www.facebook.mailus.ovh
144.91.84.114
0070d56cd74309070f6e1d760b6785e40c72f53a7cb34a6725a077906d4ff304
02f646cc1e8d84fe054e98962f643f996b2c0e26eff72d82cfc16f3a3bc6b835
15cb57034349c2277b8839ab644b28bfed0615c4ea181635816a886cd7d5eddd
2aef021f8e41e81b03214fa195b83c3c7b2856d91543abe94c9f43f7e78e02c1
2f8072daa3c74ab15a9569b415d72d5ec8d9d58332bdc14a41cbd9a010df7ae0
4179b210280059509dc95c16346d6a88a5cca3cc0e1180ad9000926add4e40b9
63a0ce71c2d2ac8a879e6130076e4c63b58d1a1ae2550543ac0ff9f04168449f
6e596c899edd3900526566ad66e3baff3d981975084c1f354ae8c3a2829fcd43
8627d83666e5f29db4f5ddfba459bf17a542a4b20569815b8055223dbe6d3f75
a0c666cedaa4b111bf6493c91d9edbfb3048c6aaaff26fca36619cf6ed2732ce
b4fbae6efcdb2da152308ab810e2f02c1aca6af53a31d1c75ce48b91aa4201f0
bf2e257b8ed1a9112ba0e1b65dcb0e1f7182ed7bcdd5a1455f6ecaea3edbe5da
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3