www.m-face-book-support-account-review.darrenspro.com
Open in
urlscan Pro
192.96.200.111
Malicious Activity!
Public Scan
URL:
https://www.m-face-book-support-account-review.darrenspro.com/
Submission: On October 13 via automatic, source certstream-suspicious — Scanned from DE
Submission: On October 13 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 8 HTTP transactions.
The main IP is 192.96.200.111, located in
Manassas, United States and
belongs to LEASEWEB-USA-WDC, US.
The main domain is www.m-face-book-support-account-review.darrenspro.com.
TLS certificate: Issued by R3 on October 13th 2023. Valid for: 3 months.
This is the only time www.m-face-book-support-account-review.darrenspro.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on October 13th 2023. Valid for: 3 months.
This is the only time www.m-face-book-support-account-review.darrenspro.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 192.96.200.111 192.96.200.111 | 30633 (LEASEWEB-...) (LEASEWEB-USA-WDC) | |
| 1 | 2a02:26f0:ab0... 2a02:26f0:ab00:3a7::2d63 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 8 | 2 |
7
192.96.200.111
(Manassas, United States)
ASN30633 (LEASEWEB-USA-WDC, US)
PTR: s621.use8.mysecurecloudhost.com
ASN30633 (LEASEWEB-USA-WDC, US)
PTR: s621.use8.mysecurecloudhost.com
| www.m-face-book-support-account-review.darrenspro.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
darrenspro.com
www.m-face-book-support-account-review.darrenspro.com |
4 KB |
| 1 |
dw.com
static.dw.com — Cisco Umbrella Rank: 96895 |
65 KB |
| 8 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | www.m-face-book-support-account-review.darrenspro.com |
www.m-face-book-support-account-review.darrenspro.com
|
| 1 | static.dw.com |
www.m-face-book-support-account-review.darrenspro.com
|
| 8 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.m-face-book-support-account-review.darrenspro.com R3 |
2023-10-13 - 2024-01-11 |
3 months | crt.sh |
| *.dw.com GeoTrust RSA CA 2018 |
2023-04-30 - 2024-04-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.m-face-book-support-account-review.darrenspro.com/
Frame ID: B65BE9CC863CDC6A350BFC51B272F841
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Login in your accountDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Underscore.js
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- underscore.*\.js(?:\?ver=([\d.]+))?
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.m-face-book-support-account-review.darrenspro.com/ |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gpt.js
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
underscore-min.js
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.css
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.css
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.js
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom.css
www.m-face-book-support-account-review.darrenspro.com/str/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
49305625_401.jpg
static.dw.com/image/ |
65 KB 65 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
static.dw.com
www.m-face-book-support-account-review.darrenspro.com
192.96.200.111
2a02:26f0:ab00:3a7::2d63
07be2d913cf245e810b4bf774f6e088629b1cf3245c0e3c619a7d631c91d9cd6
a8a8b30d51b52e7f2e3858be4a9de839c9b37068c32bc325914d6387b46c4dea