facebaok.herokuapp.com Open in urlscan Pro
54.165.58.209 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://facebaok.herokuapp.com/
Effective URL:
https://facebaok.herokuapp.com/index.html
Submission: On October 30 via api (October 30th 2021, 4:07:27 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 54.165.58.209, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is facebaok.herokuapp.com.
TLS certificate: Issued by Amazon on June 1st 2021. Valid for: a year.

This is the only time facebaok.herokuapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address		AS Autonomous System
1 11	54.165.58.209 54.165.58.209		14618 (AMAZON-AES) (AMAZON-AES)
10	1

11 54.165.58.209 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-165-58-209.compute-1.amazonaws.com

facebaok.herokuapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	herokuapp.com 1 redirects facebaok.herokuapp.com	177 KB
10	1

	Domain	Requested by
11	facebaok.herokuapp.com	1 redirects facebaok.herokuapp.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
*.herokuapp.com Amazon	`2021-06-01` - `2022-06-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://facebaok.herokuapp.com/index.html
Frame ID: 4D14BF27A79369059DD6812DEBF61DDD
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook - Log In or Sign Up

Page URL History Show full URLs

https://facebaok.herokuapp.com/ HTTP 302
https://facebaok.herokuapp.com/index.html Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

177 kB
Transfer

174 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://facebaok.herokuapp.com/ HTTP 302
https://facebaok.herokuapp.com/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response facebaok.herokuapp.com/ Redirect Chain https://facebaok.herokuapp.com/ https://facebaok.herokuapp.com/index.html	2 KB 2 KB	104ms 104ms	Document text/html	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `62dda944f4906e221805796154bafdb4f043138cced4719c968bbcc0cb8845a1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Connection keep-alive Date Sat, 30 Oct 2021 16:07:22 GMT Server Apache Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Etag "8eb-5ceb26a641e00" Accept-Ranges bytes Content-Length 2283 Content-Type text/html Via 1.1 vegur Redirect headers Connection keep-alive Date Sat, 30 Oct 2021 16:07:22 GMT Server Apache Location index.html Content-Length 0 Content-Type text/html; charset=UTF-8 Via 1.1 vegur
GET H/1.1	200 OK	styles.css facebaok.herokuapp.com/css/	3 KB 4 KB	104ms 104ms	Stylesheet text/css	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/css/styles.css Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `824dcc405f4116b8479c6168e5822d095aafad4570e786dfd480cb2fd3f38773` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:22 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "d4c-5ceb26a641e00" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 3404
GET H/1.1	200 OK	media-queries.css facebaok.herokuapp.com/css/	2 KB 2 KB	209ms 104ms	Stylesheet text/css	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/css/media-queries.css Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `6f2a21df61efc730108b2215e79f1b1ae3f497af6f9cc8246af502b47129cd97` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "62e-5ceb26a641e00" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1582
GET H/1.1	200 OK	logo.svg facebaok.herokuapp.com/images/	2 KB 3 KB	106ms 106ms	Image image/svg+xml	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://facebaok.herokuapp.com/images/logo.svg Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "951-5ceb26a641e00" Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 2385
GET H/1.1	200 OK	eye-off.png facebaok.herokuapp.com/images/	498 B 751 B	103ms 103ms	Image image/png	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://facebaok.herokuapp.com/images/eye-off.png Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `1ddb24c756e9a8e8b405f56530d230441b6775ac0e19a3f2c9a07455506ddb21` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "1f2-5ceb26a641e00" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 498
GET H/1.1	200 OK	jquery-3.1.1.min.js Show response facebaok.herokuapp.com/assets/js/libs/	85 KB 85 KB	299ms 102ms	Script application/javascript	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/assets/js/libs/jquery-3.1.1.min.js Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "152b5-5ceb26a641e00" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 86709
GET H/1.1	200 OK	popper.min.js Show response facebaok.herokuapp.com/bootstrap/js/	19 KB 19 KB	309ms 107ms	Script application/javascript	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/bootstrap/js/popper.min.js Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `3675f226f985b64eea6ae8544d5496a32d19993aae1ac4a3fa101263ef3206f7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "4a32-5ceb26a641e00" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 18994
GET H/1.1	200 OK	bootstrap.min.js Show response facebaok.herokuapp.com/bootstrap/js/	59 KB 59 KB	407ms 204ms	Script application/javascript	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/bootstrap/js/bootstrap.min.js Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "ea6a-5ceb26a641e00" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 60010
GET H/1.1	200 OK	script.js Show response facebaok.herokuapp.com/js/	890 B 1 KB	310ms 106ms	Script application/javascript	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/js/script.js Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `5988461be8ee3ecaa90a37b72b2da76ff5061da295699389798cd0d4a93bb5da` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "37a-5ceb26a641e00" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 890
GET H/1.1	200 OK	user-register.js Show response facebaok.herokuapp.com/js/userRegister/	1 KB 2 KB	206ms 106ms	Script application/javascript	54.165.58.209 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://facebaok.herokuapp.com/js/userRegister/user-register.js Requested by Host: facebaok.herokuapp.com URL: https://facebaok.herokuapp.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.165.58.209 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-165-58-209.compute-1.amazonaws.com Software Apache / Resource Hash `ea20efa7e9d36c3c8b118b95ae73cee8be37dffa69598dc266ada0f0e48b0cb3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://facebaok.herokuapp.com/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Sat, 30 Oct 2021 16:07:23 GMT Via 1.1 vegur Last-Modified Tue, 19 Oct 2021 10:49:28 GMT Server Apache Etag "5c1-5ceb26a641e00" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 1473

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebaok.herokuapp.com
54.165.58.209
1ddb24c756e9a8e8b405f56530d230441b6775ac0e19a3f2c9a07455506ddb21
3675f226f985b64eea6ae8544d5496a32d19993aae1ac4a3fa101263ef3206f7
5988461be8ee3ecaa90a37b72b2da76ff5061da295699389798cd0d4a93bb5da
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
62dda944f4906e221805796154bafdb4f043138cced4719c968bbcc0cb8845a1
6f2a21df61efc730108b2215e79f1b1ae3f497af6f9cc8246af502b47129cd97
824dcc405f4116b8479c6168e5822d095aafad4570e786dfd480cb2fd3f38773
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
ea20efa7e9d36c3c8b118b95ae73cee8be37dffa69598dc266ada0f0e48b0cb3

facebaok.herokuapp.com Open in urlscan Pro 54.165.58.209 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

177 kBTransfer

174 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

facebaok.herokuapp.com Open in urlscan Pro
54.165.58.209 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

177 kB
Transfer

174 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!