facebook.com2web.casa
Open in
urlscan Pro
2606:4700:3036::681f:4b35
Malicious Activity!
Public Scan
Effective URL: https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/e2ve388f3237p5ynpohavkve.php?app-token=i6207c8adbjgf%...
Submission: On April 23 via automatic, source openphish
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 22nd 2020. Valid for: 6 months.
This is the only time facebook.com2web.casa was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 2606:4700:303... 2606:4700:3036::681f:4b35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 12 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
com2web.casa
facebook.com2web.casa |
205 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | facebook.com2web.casa |
facebook.com2web.casa
|
| 12 | 1 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-22 - 2020-10-09 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/e2ve388f3237p5ynpohavkve.php?app-token=i6207c8adbjgf%204e13%20h595CraK%20NJwL6TDSP1S39kZ8b4%20%20aBfMmXIwHg%20%20uo%20O%20A2GpE7FgY13715042527
Frame ID: B2D0D07F36E89D8B5F84FA2DF9FC141F
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/?reff=NmY0ZTM1YmJmYmJhY2Q2NWFiMzI... Page URL
- https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/e2ve388f3237p5ynpohavkve.php?app-... Page URL
Detected technologies
CloudFlare
(CDN)
Expand
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
44 Outgoing links
These are links going to different origins than the main page.
Title: Sections of this page
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Create New Account
Search URL Search Domain Scan URL
Title: Forgotten account?
Search URL Search Domain Scan URL
Title: Sign up for Facebook
Search URL Search Domain Scan URL
Title: Русский
Search URL Search Domain Scan URL
Title: Türkçe
Search URL Search Domain Scan URL
Title: O'zbek
Search URL Search Domain Scan URL
Title: 한국어
Search URL Search Domain Scan URL
Title: Deutsch
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: العربية
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: Log In
Search URL Search Domain Scan URL
Title: Messenger
Search URL Search Domain Scan URL
Title: Facebook Lite
Search URL Search Domain Scan URL
Title: Watch
Search URL Search Domain Scan URL
Title: People
Search URL Search Domain Scan URL
Title: Pages
Search URL Search Domain Scan URL
Title: Page categories
Search URL Search Domain Scan URL
Title: Places
Search URL Search Domain Scan URL
Title: Games
Search URL Search Domain Scan URL
Title: Locations
Search URL Search Domain Scan URL
Title: Marketplace
Search URL Search Domain Scan URL
Title: Groups
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Local
Search URL Search Domain Scan URL
Title: Fundraisers
Search URL Search Domain Scan URL
Title: Services
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Create ad
Search URL Search Domain Scan URL
Title: Create Page
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: AdChoices
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Settings
Search URL Search Domain Scan URL
Title: Activity log
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/?reff=NmY0ZTM1YmJmYmJhY2Q2NWFiMzIyNWU1OWU4OGJhNzU=&urlmoving=946582752 Page URL
- https://facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/e2ve388f3237p5ynpohavkve.php?app-token=i6207c8adbjgf%204e13%20h595CraK%20NJwL6TDSP1S39kZ8b4%20%20aBfMmXIwHg%20%20uo%20O%20A2GpE7FgY13715042527 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/ |
177 B 512 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
e2ve388f3237p5ynpohavkve.php
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/ |
14 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
uI6bUdb5246.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
2 KB 644 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
8gLYvvNIHAh.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
224 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1uxt1bMNsC3.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
zK_lc8WJmVQ.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
332 KB 78 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KpYp_qtmi98.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
53 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sk2-G3g1713.css
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
96 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.4.0.min.js
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
74 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
6ITmgr9VfYA.png
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
YQNfPR9MJfx.png
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
925 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rFzj1qAbrro.png
facebook.com2web.casa/cmd-login=421b0bb34445aaeca8034a475d86fc55/assets/ |
283 B 283 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| facebook.com2web.casa/ | Name: PHPSESSID Value: vva7j5b6ms4nig7vr47mpfnp7e |
|
| .com2web.casa/ | Name: __cfduid Value: d2d27fbf95cc42df0efe23b32bfa0f0ff1587644729 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebook.com2web.casa
2606:4700:3036::681f:4b35
02257974daf30d3849409a55f8e993da0660fc7689c208e8e4f09479454a6eb8
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
1bec24da7ae874d98ed8415674bb5121d778be67ef2c97a74a457b5a9f110f19
392b2d81949a84b549b91134937248b2f9326cddd76e684b1124b5437fc1caa9
41c2475f08f17797f477f582ce810fe4c0a275ea461834760ddf91b35fe9cd51
8627d83666e5f29db4f5ddfba459bf17a542a4b20569815b8055223dbe6d3f75
93d9ffa7dbd10472bda771bf2be7fedf0ef617510f813631b3bc85fa8b135169
afef57ba7cbdd32ca7d39c177bebfe585c582f213540bfde899e2977746262b4
b32328054a348d351669689805ed2f1113c4f98776e0345c5e1302524bd204f9
c01b4e1dc32c114ef0236109d35d59a4eeea967ec48c490de4ef40e92135c2c5
c71bb147d26fc580c2b9ebd137c2ae2cc2f2217832eccfe759ed5cbb23e589df
e60e1c170d239ef8628c55986ae1b8e68239665363c6355cfc03336718bc2d7f
f4181ffda5ddf47a88f6afef4125d1fbb967dd3884d8b150d3cc8135d7b9fd98