urlscan.io logo urlscan.io
SecurityTrails logo

facebook-verified.ml Open in urlscan Pro
51.83.96.160  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://facebook-verified.ml/
Submission: On April 19 via automatic, source openphish — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 51.83.96.160, located in Mont-Saint-Aignan, France and belongs to OVH, FR. The main domain is facebook-verified.ml.
TLS certificate: Issued by R3 on April 15th 2022. Valid for: 3 months.
This is the only time facebook-verified.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 51.83.96.160 16276 (OVH)
2 2
Apex Domain
Subdomains		 Transfer
1 facebook-verified.ml
facebook-verified.ml
2 KB
0 postimg.org Failed
s33.postimg.org Failed
2 2
Domain Requested by
1 facebook-verified.ml
0 s33.postimg.org Failed facebook-verified.ml
2 2

This site contains links to these domains. Also see Links.

Domain
m.facebook.com
Subject Issuer Validity Valid
facebook-verified.ml
R3		 2022-04-15 -
2022-07-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://facebook-verified.ml/
Frame ID: 04765C31F6647E85C2CEFC7C7C80A717
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

2 kB
Transfer

6 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
facebook-verified.ml/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://facebook-verified.ml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.83.96.160 Mont-Saint-Aignan, France, ASN16276 (OVH, FR),
Reverse DNS
sbg107.truehost.cloud
Software
/
Resource Hash
e03fa3924de728c26cbdc287b122f80a81e500ec1650e5106ecb53d2b04d2de5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-encoding
br
content-length
1580
content-type
text/html
date
Tue, 19 Apr 2022 01:05:40 GMT
last-modified
Thu, 25 Oct 2018 20:48:44 GMT
vary
Accept-Encoding
1512334555590.png
s33.postimg.org/hksxwrjb3/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s33.postimg.org
URL
https://s33.postimg.org/hksxwrjb3/1512334555590.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://facebook-verified.ml/(Line 220)
Message:
Mixed Content: The page at 'https://facebook-verified.ml/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://m.facebook.com/reg'. This endpoint should be made available over a secure connection.
network error URL: https://s33.postimg.org/hksxwrjb3/1512334555590.png
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook-verified.ml
s33.postimg.org
s33.postimg.org
51.83.96.160
e03fa3924de728c26cbdc287b122f80a81e500ec1650e5106ecb53d2b04d2de5