www.r3csitesfbwtrs.xyz Open in urlscan Pro
162.0.229.117 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://j.mp/2ZZtIeM?/pages-help.htm
Effective URL:
https://www.r3csitesfbwtrs.xyz/checkpoint.htm
Submission: On July 25 via automatic, source phishtank (July 25th 2020, 8:21:01 pm UTC)

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 162.0.229.117, located in Canada and belongs to NAMECHEAP-NET, US. The main domain is www.r3csitesfbwtrs.xyz.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 25th 2020. Valid for: a year.

This is the only time www.r3csitesfbwtrs.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.16 67.199.248.16	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
9	162.0.229.117 162.0.229.117	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	157.240.2.34 157.240.2.34	32934 (FACEBOOK) (FACEBOOK)
10	2

1 67.199.248.16 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)

j.mp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 162.0.229.117 (Canada)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium118-2.web-hosting.com

www.r3csitesfbwtrs.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.2.34 (United States)

ASN32934 (FACEBOOK, US)
PTR: edge-sonar-mini-shv-01-ort2.fbcdn.net

external-lhr3-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	r3csitesfbwtrs.xyz www.r3csitesfbwtrs.xyz	61 KB
1	fbcdn.net external-lhr3-1.xx.fbcdn.net	157 B
1	j.mp 1 redirects j.mp	263 B
10	3

	Domain	Requested by
9	www.r3csitesfbwtrs.xyz	www.r3csitesfbwtrs.xyz
1	external-lhr3-1.xx.fbcdn.net	www.r3csitesfbwtrs.xyz
1	j.mp	1 redirects
10	3

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
r3csitesfbwtrs.xyz Sectigo RSA Domain Validation Secure Server CA	`2020-07-25` - `2021-07-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.r3csitesfbwtrs.xyz/checkpoint.htm
Frame ID: 8ACDA9F8D89CA54DD26BA0EFD5E3179A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://j.mp/2ZZtIeM?/pages-help.htm HTTP 301
https://www.r3csitesfbwtrs.xyz/checkpoint.htm Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

61 kB
Transfer

178 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/?ref=logo
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://j.mp/2ZZtIeM?/pages-help.htm HTTP 301
https://www.r3csitesfbwtrs.xyz/checkpoint.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request checkpoint.htm Show response www.r3csitesfbwtrs.xyz/ Redirect Chain https://j.mp/2ZZtIeM?/pages-help.htm https://www.r3csitesfbwtrs.xyz/checkpoint.htm	5 KB 2 KB	516ms 173ms	Document text/html	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `f482057aa2607ee68bff12b9408502961e50685862e319d21407edfbaa41e1af` Request headers :method GET :authority www.r3csitesfbwtrs.xyz :scheme https :path /checkpoint.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 25 Jul 2020 20:20:45 GMT server Apache last-modified Sun, 24 Nov 2019 01:06:34 GMT accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 2104 content-type text/html Redirect headers status 301 server nginx date Sat, 25 Jul 2020 20:20:45 GMT content-type text/html; charset=utf-8 content-length 132 cache-control private, max-age=90 content-security-policy referrer always; location https://www.r3csitesfbwtrs.xyz/checkpoint.htm referrer-policy unsafe-url set-cookie _bit=k6pkkJ-fc5a491975e9d86d11-00y; Domain=j.mp; Expires=Thu, 21 Jan 2021 20:20:45 GMT via 1.1 google alt-svc clear
GET H2	200	1-ko0cSbN1S2P.css www.r3csitesfbwtrs.xyz/css/	36 KB 9 KB	330ms 329ms	Stylesheet text/css	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/css/1-ko0cSbN1S2P.css Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 25 Jul 2020 20:20:45 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 8895
GET H2	200	2-fBxAYxBW8eI.css www.r3csitesfbwtrs.xyz/css/	29 KB 7 KB	486ms 485ms	Stylesheet text/css	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/css/2-fBxAYxBW8eI.css Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 25 Jul 2020 20:20:45 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 7487
GET H2	200	3-pTiS7o2eCja.css www.r3csitesfbwtrs.xyz/css/	58 KB 10 KB	486ms 485ms	Stylesheet text/css	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/css/3-pTiS7o2eCja.css Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `8d69acb0868c07ee2eeb5b68fb0fc3a0a9f484dd29b8ba773f58fb5bf061b8d8` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 25 Jul 2020 20:20:45 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 10075
GET H2	200	4-2-9N8qo_l-I.css www.r3csitesfbwtrs.xyz/css/	17 KB 5 KB	488ms 487ms	Stylesheet text/css	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/css/4-2-9N8qo_l-I.css Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 25 Jul 2020 20:20:45 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 4523
GET H2	200	5-o-wil6C-n6y.css www.r3csitesfbwtrs.xyz/css/	7 KB 2 KB	175ms 174ms	Stylesheet text/css	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.r3csitesfbwtrs.xyz/css/5-o-wil6C-n6y.css Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 25 Jul 2020 20:20:45 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 2133
GET H2	200	F8n3WrEc0r.png www.r3csitesfbwtrs.xyz/img/	6 KB 6 KB	174ms 173ms	Image image/png	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.r3csitesfbwtrs.xyz/img/F8n3WrEc0r.png Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4` Request headers Referer https://www.r3csitesfbwtrs.xyz/checkpoint.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 25 Jul 2020 20:20:45 GMT last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache accept-ranges bytes content-length 6331 content-type image/png
GET H/1.1	400 Bad Request	safe_image.php external-lhr3-1.xx.fbcdn.net/	0 157 B	348ms 116ms	Image text/plain	157.240.2.34 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://external-lhr3-1.xx.fbcdn.net/safe_image.php?d=AQA2_Pb4-pLPsoDq&url=https%3A%2F%2Fpixel.facebook.com%2Fsi%2Fkappa%2F%3FKo%3Dp&_nc_hash=AQBbs84gy-QEmIJ_ Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 157.240.2.34 , United States, ASN32934 (FACEBOOK, US), Reverse DNS edge-sonar-mini-shv-01-ort2.fbcdn.net Software proxygen-bolt / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.r3csitesfbwtrs.xyz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 25 Jul 2020 20:20:46 GMT Server proxygen-bolt Connection keep-alive Content-Length 0 Content-Type text/plain
GET H2	404	ccm050L6PDw.png www.r3csitesfbwtrs.xyz/rsrc.php/v3/y3/r/	315 B 315 B	183ms 182ms	Image text/html	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.r3csitesfbwtrs.xyz/rsrc.php/v3/y3/r/ccm050L6PDw.png Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.r3csitesfbwtrs.xyz/css/1-ko0cSbN1S2P.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Sat, 25 Jul 2020 20:20:46 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	security.png www.r3csitesfbwtrs.xyz/img/	19 KB 19 KB	180ms 180ms	Image image/png	162.0.229.117 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.r3csitesfbwtrs.xyz/img/security.png Requested by Host: www.r3csitesfbwtrs.xyz URL: https://www.r3csitesfbwtrs.xyz/checkpoint.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.0.229.117 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium118-2.web-hosting.com Software Apache / Resource Hash `e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5` Request headers Referer https://www.r3csitesfbwtrs.xyz/css/3-pTiS7o2eCja.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Sat, 25 Jul 2020 20:20:46 GMT last-modified Sun, 24 Nov 2019 01:06:34 GMT server Apache accept-ranges bytes content-length 19461 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

external-lhr3-1.xx.fbcdn.net
j.mp
www.r3csitesfbwtrs.xyz
157.240.2.34
162.0.229.117
67.199.248.16
3ff1415445131bbbddf45c0acf3fd041340b087344a3e31629e5aa9d1ae13bad
501237d327bb841254b036b7ec88cba61f1cbdf63856ff1df6d87c825bc506ce
8d69acb0868c07ee2eeb5b68fb0fc3a0a9f484dd29b8ba773f58fb5bf061b8d8
91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4
9531e4a4c6eb0612dba54cd2463bdcfef8fa244191a4f772286e1de040715c03
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e22f0b443102814b944012f560c353732076fcc03e49455720c66c49e7c833f5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef774d6b935403a6fe54e3a8021093125985a0f3dd7e36aa33aaba880faa41e1
f482057aa2607ee68bff12b9408502961e50685862e319d21407edfbaa41e1af

www.r3csitesfbwtrs.xyz Open in urlscan Pro 162.0.229.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

61 kBTransfer

178 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.r3csitesfbwtrs.xyz Open in urlscan Pro
162.0.229.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

61 kB
Transfer

178 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!