facebook-log-in-attempt.levelteknoloji.com Open in urlscan Pro
109.232.221.72 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.log-in-facebook.levelteknoloji.com/
Effective URL:
http://facebook-log-in-attempt.levelteknoloji.com/
Submission: On July 24 via automatic, source certstream-suspicious (July 24th 2020, 8:04:56 pm UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 109.232.221.72, located in Istanbul, Turkey and belongs to AEROTEK-AS, TR. The main domain is facebook-log-in-attempt.levelteknoloji.com.

This is the only time facebook-log-in-attempt.levelteknoloji.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
1 11	109.232.221.72 109.232.221.72		42807 (AEROTEK-AS) (AEROTEK-AS)
10	2

11 109.232.221.72 (Istanbul, Turkey) 1 redirects

ASN42807 (AEROTEK-AS, TR)
PTR: srv.rizedeyiz.biz

www.log-in-facebook.levelteknoloji.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
facebook-log-in-attempt.levelteknoloji.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	levelteknoloji.com 1 redirects www.log-in-facebook.levelteknoloji.com facebook-log-in-attempt.levelteknoloji.com	125 KB
10	1

	Domain	Requested by
10	facebook-log-in-attempt.levelteknoloji.com	facebook-log-in-attempt.levelteknoloji.com
1	www.log-in-facebook.levelteknoloji.com	1 redirects
10	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://facebook-log-in-attempt.levelteknoloji.com/
Frame ID: F509AAE0CD217E9C43B57F35028CAE34
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.log-in-facebook.levelteknoloji.com/ HTTP 301
http://facebook-log-in-attempt.levelteknoloji.com/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

125 kB
Transfer

226 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.log-in-facebook.levelteknoloji.com/ HTTP 301
http://facebook-log-in-attempt.levelteknoloji.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response facebook-log-in-attempt.levelteknoloji.com/ Redirect Chain https://www.log-in-facebook.levelteknoloji.com/ http://facebook-log-in-attempt.levelteknoloji.com/	769 B 943 B	127ms 114ms	Document text/html	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / PHP/5.6.40 Resource Hash `95810b83a2383bffd5dce1d405f57f90d809d207430c49517396392ec4828059` Request headers Host facebook-log-in-attempt.levelteknoloji.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:18 GMT Server Apache X-Powered-By PHP/5.6.40 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-Encoding gzip Vary Accept-Encoding,User-Agent Set-Cookie PHPSESSID=7a795972aed2ec2d0222208a04fc947d; path=/ Upgrade h2,h2c Connection Upgrade, Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers status 301 date Fri, 24 Jul 2020 20:04:18 GMT server Apache location http://facebook-log-in-attempt.levelteknoloji.com content-length 257 content-type text/html; charset=iso-8859-1
GET H/1.1	200 OK	app.e9f888b5.css facebook-log-in-attempt.levelteknoloji.com/css/	9 KB 3 KB	66ms 63ms	Stylesheet text/css	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/css/app.e9f888b5.css Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `161536ae6d01643c13f3e94d6ec4419beb22563f55e3d05339bcd96e7f60a375` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:18 GMT Content-Encoding gzip Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2902
GET H/1.1	200 OK	app.9256d9e9.js Show response facebook-log-in-attempt.levelteknoloji.com/js/	28 KB 8 KB	127ms 113ms	Script application/javascript	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/js/app.9256d9e9.js Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `8875f5921290ac5c3598b02ffdade0510c7f690ef3b26bf007e7fb66f69c6f18` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:18 GMT Content-Encoding gzip Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=100 Content-Length 7998
GET H/1.1	200 OK	chunk-vendors.adac2eae.js Show response facebook-log-in-attempt.levelteknoloji.com/js/	109 KB 38 KB	139ms 126ms	Script application/javascript	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/js/chunk-vendors.adac2eae.js Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `f8a9ef8d812e8cbee6c008b178557c69ffc82412100d1c8fbfeef6656ca052ad` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:18 GMT Content-Encoding gzip Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=100 Content-Length 38743
GET H/1.1	200 OK	fontface.css facebook-log-in-attempt.levelteknoloji.com/fonts/	262 B 462 B	121ms 109ms	Stylesheet text/css	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/fonts/fontface.css Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `a11c7ff7d4f572249c4fbd83f5ac8c7c53aaef0db43a4e6da6fc822652a5ad72` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:18 GMT Content-Encoding gzip Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type text/css Keep-Alive timeout=5, max=100 Content-Length 137
GET H/1.1	200 OK	fblogo.313c0f24.png facebook-log-in-attempt.levelteknoloji.com/img/	11 KB 11 KB	62ms 61ms	Image image/png	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Show image Full URL http://facebook-log-in-attempt.levelteknoloji.com/img/fblogo.313c0f24.png Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `651f8089835bc38b4d7a7ba7a858d89621080269a0ee207a033bab1efb035c24` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:19 GMT Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 11123
GET H/1.1	200 OK	connecting.611f6ec2.png facebook-log-in-attempt.levelteknoloji.com/img/	42 KB 42 KB	63ms 62ms	Image image/png	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Show image Full URL http://facebook-log-in-attempt.levelteknoloji.com/img/connecting.611f6ec2.png Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `f4287d1528382e5a28f80ea974fe73f74c6516bcf60cdabfc3f6202f1f6da03f` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:19 GMT Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 42565
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a949623e8f44929e53c4baa3af403a2f04401c77fe99f1b83140ed297f892be1` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	833 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bda1862fdf99fe4bee6d1e7b8a3578bd084736d8dec092f4e3f42bb32912f679` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	fbandroid.0a78166b.png facebook-log-in-attempt.levelteknoloji.com/img/	9 KB 9 KB	61ms 60ms	Image image/png	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Show image Full URL http://facebook-log-in-attempt.levelteknoloji.com/img/fbandroid.0a78166b.png Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `bba16cb55bc6e6841d41d716c52f51f097f418ba2c9d5db94246a254db995145` Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 24 Jul 2020 20:04:19 GMT Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 8905
POST H/1.1	200 OK	access.php facebook-log-in-attempt.levelteknoloji.com/API/mail/	0 0	460ms 460ms	Fetch text/html	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/API/mail/access.php Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/js/app.9256d9e9.js Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / PHP/5.6.40 Resource Hash Request headers Referer http://facebook-log-in-attempt.levelteknoloji.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryJqDBpfL38R1125h3 Response headers Pragma no-cache Date Fri, 24 Jul 2020 20:04:19 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/5.6.40 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=98 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	kk.otf facebook-log-in-attempt.levelteknoloji.com/fonts/	15 KB 12 KB	118ms 106ms	Font font/otf	109.232.221.72 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.levelteknoloji.com/fonts/kk.otf Requested by Host: facebook-log-in-attempt.levelteknoloji.com URL: http://facebook-log-in-attempt.levelteknoloji.com/ Protocol HTTP/1.1 Server 109.232.221.72 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srv.rizedeyiz.biz Software Apache / Resource Hash `9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://facebook-log-in-attempt.levelteknoloji.com/fonts/fontface.css Origin http://facebook-log-in-attempt.levelteknoloji.com Response headers Date Fri, 24 Jul 2020 20:04:19 GMT Content-Encoding gzip Last-Modified Fri, 17 Apr 2020 02:45:20 GMT Server Apache Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type font/otf Keep-Alive timeout=5, max=100 Content-Length 11824

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonp object| regeneratorRuntime

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			facebook-log-in-attempt.levelteknoloji.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7a795972aed2ec2d0222208a04fc947d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook-log-in-attempt.levelteknoloji.com
www.log-in-facebook.levelteknoloji.com
109.232.221.72
161536ae6d01643c13f3e94d6ec4419beb22563f55e3d05339bcd96e7f60a375
651f8089835bc38b4d7a7ba7a858d89621080269a0ee207a033bab1efb035c24
8875f5921290ac5c3598b02ffdade0510c7f690ef3b26bf007e7fb66f69c6f18
95810b83a2383bffd5dce1d405f57f90d809d207430c49517396392ec4828059
9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773
a11c7ff7d4f572249c4fbd83f5ac8c7c53aaef0db43a4e6da6fc822652a5ad72
a949623e8f44929e53c4baa3af403a2f04401c77fe99f1b83140ed297f892be1
bba16cb55bc6e6841d41d716c52f51f097f418ba2c9d5db94246a254db995145
bda1862fdf99fe4bee6d1e7b8a3578bd084736d8dec092f4e3f42bb32912f679
f4287d1528382e5a28f80ea974fe73f74c6516bcf60cdabfc3f6202f1f6da03f
f8a9ef8d812e8cbee6c008b178557c69ffc82412100d1c8fbfeef6656ca052ad

facebook-log-in-attempt.levelteknoloji.com Open in urlscan Pro 109.232.221.72 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

0 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

125 kBTransfer

226 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

facebook-log-in-attempt.levelteknoloji.com Open in urlscan Pro
109.232.221.72 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

125 kB
Transfer

226 kB
Size

1
Cookies

10 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!