www.recovery.fb-business.com Open in urlscan Pro
192.142.18.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.recovery.fb-business.com/
Submission: On January 04 via automatic, source openphish (January 4th 2025, 2:23:06 am UTC) — Scanned from DE

Summary HTTP 23 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 23 HTTP transactions. The main IP is 192.142.18.217, located in Manila, Philippines and belongs to CDNEXT Datacamp Limited, GB. The main domain is www.recovery.fb-business.com.
TLS certificate: Issued by R10 on January 3rd 2025. Valid for: 3 months.

This is the only time www.recovery.fb-business.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
6	192.142.18.217 192.142.18.217	212238 (CDNEXT Da...) (CDNEXT Datacamp Limited)
1	157.240.0.6 157.240.0.6	32934 (FACEBOOK) (FACEBOOK)
23	3

6 192.142.18.217 (Manila, Philippines)

ASN212238 (CDNEXT Datacamp Limited, GB)

www.recovery.fb-business.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.0.6 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	fb-business.com www.recovery.fb-business.com	68 KB
1	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 965 Failed	327 B
23	2

	Domain	Requested by
6	www.recovery.fb-business.com	www.recovery.fb-business.com
1	static.xx.fbcdn.net	www.recovery.fb-business.com
23	2

This site contains links to these domains. Also see Links.

Domain
facebook.com
about.facebook.com
messenger.com
m.facebook.com
pay.facebook.com
www.oculus.com
portal.facebook.com
lm.facebook.com
www.bulletin.com
developers.facebook.com

Subject Issuer	Validity	Valid
webdisk.recovery.fb-business.com R10	`2025-01-03` - `2025-04-03`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-13` - `2025-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.recovery.fb-business.com/
Frame ID: 472E6763B9973B0705CDE98E125DBECC
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Retrictions Information

Page Statistics

23
Requests

30 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

68 kB
Transfer

319 kB
Size

0
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://facebook.com/login/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNjQ1MDk0OTI4LCJjYWxsc2l0ZV9pZCI6Nzk2MTcwNzM0NTY5ODY0fQ%3D%3D&refid=8

Search URL Search Domain Scan URL

URL: https://facebook.com/recover/initiate/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNjQ1MDk0OTI4LCJjYWxsc2l0ZV9pZCI6Mjg0Nzg1MTQ5MzQ1MzY5fQ%3D%3D&c=https%3A%2F%2Fm.facebook.com%2F&r&cuid&ars=facebook_login&lwv=100&refid=8
Title: Forgotten password?

Search URL Search Domain Scan URL

URL: https://facebook.com/reg-no-deeplink/?cid=103&refid=8
Title: Create New Account

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=as_IN&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Hindi

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=ne_NP&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Bangladesh

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=pt_BR&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Portugues (Brasil)

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=bn_IN&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Pakistan

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=hi_IN&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Hindi

Search URL Search Domain Scan URL

URL: https://facebook.com/intl/save_locale/?loc=es_LA&href=https%3A%2F%2Fm.facebook.com%2F&ls_ref=mobile_suggested_locale_selector&refid=8
Title: Espanol

Search URL Search Domain Scan URL

URL: https://facebook.com/language/?next_uri=https%3A%2F%2Fm.facebook.com%2F&refid=8

Search URL Search Domain Scan URL

URL: https://about.facebook.com/?refid=8
Title: About

Search URL Search Domain Scan URL

URL: https://facebook.com/help/?ref=pf&refid=8
Title: Help

Search URL Search Domain Scan URL

URL: https://messenger.com/
Title: Messenger

Search URL Search Domain Scan URL

URL: https://facebook.com/lite/?refid=8
Title: Facebook Lite

Search URL Search Domain Scan URL

URL: https://m.facebook.com/watch/?refid=8
Title: Watch

Search URL Search Domain Scan URL

URL: https://facebook.com/places/?refid=8
Title: Places

Search URL Search Domain Scan URL

URL: https://facebook.com/games/?refid=8
Title: Games

Search URL Search Domain Scan URL

URL: https://facebook.com/marketplace/?refid=8
Title: Marketplace

Search URL Search Domain Scan URL

URL: https://pay.facebook.com/?refid=8
Title: Facebook Pay

Search URL Search Domain Scan URL

URL: https://www.oculus.com/
Title: Oculus

Search URL Search Domain Scan URL

URL: https://portal.facebook.com/?refid=8
Title: Portal

Search URL Search Domain Scan URL

URL: https://lm.facebook.com/l.php?u=https%3A%2F%2Fwww.instagram.com%2F&h=AT3q1KOVdNNW2fRs0wun0KBGwuhQjWftomvC45U7wCfjOxlqfEp99sHmq8HrrbXLqzA0O7d_q37E4UyydZ20fevuW3s8ztqEHZrtvg7esnvtsIErzEcnYjaN9EYnbSrOhzFuoOxNajUEXJvQRC_1
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.bulletin.com/
Title: Bulletin

Search URL Search Domain Scan URL

URL: https://facebook.com/local/lists/245019872666104/?refid=8
Title: Local

Search URL Search Domain Scan URL

URL: https://facebook.com/fundraisers/?refid=8
Title: Fundraisers

Search URL Search Domain Scan URL

URL: https://facebook.com/biz/directory/?refid=8
Title: Services

Search URL Search Domain Scan URL

URL: https://developers.facebook.com/?ref=pf&refid=8
Title: Developers

Search URL Search Domain Scan URL

URL: https://facebook.com/careers/?ref=pf&refid=8
Title: Careers

Search URL Search Domain Scan URL

URL: https://facebook.com/privacy/explanation?refid=8
Title: Privacy

Search URL Search Domain Scan URL

URL: https://facebook.com/groups/explore/?refid=8
Title: Groups

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.recovery.fb-business.com/ 115 KB
24 KB 92ms
36ms Document
text/html 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.recovery.fb-business.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 67adc4812e7e5fc5a90055eac9e5ace84db1c62b6c467a58ee71029ae480fced

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 04 Jan 2025 02:23:01 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 style.css
www.recovery.fb-business.com/ 199 KB
40 KB 17ms
16ms Stylesheet
text/css 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.recovery.fb-business.com/style.css
Requested by: Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: dc1e4e7e5e60fdb734150946705c631f66cb81f72a50367f7d74c738ce207db3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recovery.fb-business.com/

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 11 Jan 2025 02:23:01 GMT
accept-ranges: bytes
content-length: 40773
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: text/css
last-modified: Sat, 30 Mar 2024 18:59:58 GMT
vary: Accept-Encoding
server: LiteSpeed

GET kkyLGbyp9NX.css
static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/ 0
0

GET aktAT6r-inm.css
static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/ 0
0

GET JSkF6PDP_-u.css
static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/ 0
0

GET Z0lvzk8hKg6.css
static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/ 0
0

GET A3AUGyI9e-_.js
static.xx.fbcdn.net/rsrc.php/v3/yQ/r/ 0
0

GET
H2 200 logo.svg
www.recovery.fb-business.com/ 2 KB
1 KB 28ms
28ms Image
image/svg+xml 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.recovery.fb-business.com/logo.svg
Requested by: Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recovery.fb-business.com/

Response headers

cache-control: public, max-age=604800
content-encoding: br
expires: Sat, 11 Jan 2025 02:23:01 GMT
accept-ranges: bytes
content-length: 1029
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: image/svg+xml
last-modified: Sat, 30 Mar 2024 19:00:20 GMT
vary: Accept-Encoding
server: LiteSpeed

GET
H3 200 hsts-pixel.gif
www.recovery.fb-business.com/ 43 B
299 B 19ms
19ms Image
image/gif 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.recovery.fb-business.com/hsts-pixel.gif
Requested by: Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recovery.fb-business.com/

Response headers

cache-control: public, max-age=604800
expires: Sat, 11 Jan 2025 02:23:01 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 43
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: image/gif
last-modified: Sat, 30 Mar 2024 19:00:16 GMT
server: LiteSpeed

GET 7h7eltYM2yJ.js
static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/ 0
0

GET Acb2WBg1OPJ.js
static.xx.fbcdn.net/rsrc.php/v3/yW/r/ 0
0

GET gQXCqyYfa9n.js
static.xx.fbcdn.net/rsrc.php/v3/yl/r/ 0
0

GET zhzi8IsbkFt.js
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ 0
0

GET
H3 200 2jr_tFUjDMy.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yB/r/ 188 B
327 B 15ms
14ms Script
application/x-javascript 157.240.0.6
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/2jr_tFUjDMy.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra3.fbcdn.net

Software

Resource Hash

3e12a28b55984ed1775cbea3e5282269a50c6de0bd3bef2eb3d7186b833a2041

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://www.recovery.fb-business.com
Referer: https://www.recovery.fb-business.com/

Response headers

content-md5: mVQyasVzpw423801EMBogA==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 30 Dec 2025 01:58:37 GMT
alt-svc: h3=":443"; ma=86400
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: MhMXiQ16gtREJYtUAR+3kTQdJncCV9PDQpsyWXUZBACo+z4s2LT13rk+tZzMo8W0NUi078ElT65KxVlNYmA6cQ==
priority: u=2
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=38, mss=1232, tbw=26030, tp=45, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 188
origin-agent-cluster: ?1

GET 6GjO9u0EGU3.js
static.xx.fbcdn.net/rsrc.php/v3/yy/r/ 0
0

GET kkyLGbyp9NX.css
static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/ 0
0

GET aktAT6r-inm.css
static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/ 0
0

GET 7h7eltYM2yJ.js
static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/ 0
0

GET JSkF6PDP_-u.css
static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/ 0
0

GET Z0lvzk8hKg6.css
static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/ 0
0

GET
H3 404 SO2mBiDoFWw.png
www.recovery.fb-business.com/rsrc.php/v3/yL/r/ 1 KB
1 KB 18ms
18ms Image
text/html 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.recovery.fb-business.com/rsrc.php/v3/yL/r/SO2mBiDoFWw.png
Requested by: Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recovery.fb-business.com/style.css

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1251
pragma: no-cache
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: text/html
server: LiteSpeed

GET
H3 404 NjeWm6eM-wH.png
www.recovery.fb-business.com/rsrc.php/v3/yD/r/ 1 KB
1 KB 18ms
18ms Image
text/html 192.142.18.217
CDNEXT Datacamp L...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.recovery.fb-business.com/rsrc.php/v3/yD/r/NjeWm6eM-wH.png
Requested by: Host: www.recovery.fb-business.com
URL: https://www.recovery.fb-business.com/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.142.18.217 Manila, Philippines, ASN212238 (CDNEXT Datacamp Limited, GB),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://www.recovery.fb-business.com/style.css

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 1251
pragma: no-cache
date: Sat, 04 Jan 2025 02:23:01 GMT
content-type: text/html
server: LiteSpeed

GET gB76kJXPYJV.png
static.xx.fbcdn.net/rsrc.php/v3/yj/r/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/A3AUGyI9e-_.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/Acb2WBg1OPJ.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/gQXCqyYfa9n.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/zhzi8IsbkFt.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/6GjO9u0EGU3.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yj/r/gB76kJXPYJV.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

42 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/Acb2WBg1OPJ.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/Acb2WBg1OPJ.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/A3AUGyI9e-_.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/A3AUGyI9e-_.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/zhzi8IsbkFt.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/zhzi8IsbkFt.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://www.recovery.fb-business.com/rsrc.php/v3/yL/r/SO2mBiDoFWw.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.recovery.fb-business.com/rsrc.php/v3/yD/r/NjeWm6eM-wH.png Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/6GjO9u0EGU3.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/6GjO9u0EGU3.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.recovery.fb-business.com/ Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/gQXCqyYfa9n.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://www.recovery.fb-business.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/gQXCqyYfa9n.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/zhzi8IsbkFt.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yV/l/0,cross/JSkF6PDP_-u.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/Acb2WBg1OPJ.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/2jr_tFUjDMy.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/6GjO9u0EGU3.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yR/l/0,cross/kkyLGbyp9NX.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/aktAT6r-inm.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3imlz4/yx/l/en_GB/7h7eltYM2yJ.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/Z0lvzk8hKg6.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://www.recovery.fb-business.com/ Message: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/gQXCqyYfa9n.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.xx.fbcdn.net
www.recovery.fb-business.com
static.xx.fbcdn.net
157.240.0.6
192.142.18.217
3e12a28b55984ed1775cbea3e5282269a50c6de0bd3bef2eb3d7186b833a2041
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
67adc4812e7e5fc5a90055eac9e5ace84db1c62b6c467a58ee71029ae480fced
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
dc1e4e7e5e60fdb734150946705c631f66cb81f72a50367f7d74c738ce207db3

www.recovery.fb-business.com Open in urlscan Pro 192.142.18.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

23 Requests

30 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

68 kBTransfer

319 kBSize

0 Cookies

30 Outgoing links

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

42 Console Messages

Indicators

www.recovery.fb-business.com Open in urlscan Pro
192.142.18.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

30 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

68 kB
Transfer

319 kB
Size

0
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!