nhannick.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3031::ac43:a011, located in United States and belongs to CLOUDFLARENET, US. The main domain is nhannick.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 14th 2020. Valid for: a year.

This is the only time nhannick.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3031::ac43:a011	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:81d::2001	15169 (GOOGLE) (GOOGLE)
5	3

3 2606:4700:3031::ac43:a011 (United States)

ASN13335 (CLOUDFLARENET, US)

nhannick.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh3.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	nhannick.com nhannick.com	32 KB
1	googleusercontent.com lh3.googleusercontent.com	44 KB
1	fbcdn.net static.xx.fbcdn.net	2 KB
5	3

	Domain	Requested by
3	nhannick.com	nhannick.com
1	lh3.googleusercontent.com	nhannick.com
1	static.xx.fbcdn.net	nhannick.com
5	3

This site contains links to these domains. Also see Links.

Domain
m.facebook.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-14` - `2021-07-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nhannick.com/facebook/
Frame ID: F89002DA091D95E62E44BB1A4838DF49
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

77 kB
Transfer

184 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://m.facebook.com/reg/?cid=103&next=https%3A%2F%2Fwww.facebook.com%2Fdialog%2Foauth%3Fclient_id%3D2036793259884297%26redirect_uri%3Dhttps%253A%252F%252Fauth.garena.com%252Foauth%252Flogin%253Fclient_id%253D100067%2526redirect_uri%253Dhttps%25253A%25252F%25252Fgiaidau.ff.garena.vn%25252Flogin%25252Fcallback%2526response_type%253Dtoken%2526platform%253D3%2526locale%253Dvi-VN%26response_type%3Dtoken%26scope%3Dpublic_profile%252Cemail%252Cuser_friends%26ret%3Dlogin%26fbapp_pres%3D0%26logger_id%3Db06a8f56-81cb-4296-bc49-4e7d9d0b8657&locale2=vi_VN&refsrc=https%3A%2F%2Fm.facebook.com%2Flogin.php&soft=hjk
Title: Tạo tài khoản mới

Search URL Search Domain Scan URL

URL: https://m.facebook.com/login/identify/?ctx=recover&c=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fskip_api_login%3D1%26api_key%3D2036793259884297%26kid_directed_site%3D0%26app_id%3D2036793259884297%26signed_next%3D1%26next%3Dhttps%253A%252F%252Fwww.facebook.com%252Fdialog%252Foauth%253Fclient_id%253D2036793259884297%2526redirect_uri%253Dhttps%25253A%25252F%25252Fauth.garena.com%25252Foauth%25252Flogin%25253Fclient_id%25253D100067%252526redirect_uri%25253Dhttps%2525253A%2525252F%2525252Fgiaidau.ff.garena.vn%2525252Flogin%2525252Fcallback%252526response_type%25253Dtoken%252526platform%25253D3%252526locale%25253Dvi-VN%2526response_type%253Dtoken%2526scope%253Dpublic_profile%25252Cemail%25252Cuser_friends%2526ret%253Dlogin%2526fbapp_pres%253D0%2526logger_id%253Db06a8f56-81cb-4296-bc49-4e7d9d0b8657%26cancel_url%3Dhttps%253A%252F%252Fauth.garena.com%252Foauth%252Flogin%253Fclient_id%253D100067%2526redirect_uri%253Dhttps%25253A%25252F%25252Fgiaidau.ff.garena.vn%25252Flogin%25252Fcallback%2526response_type%253Dtoken%2526platform%253D3%2526locale%253Dvi-VN%2526error%253Daccess_denied%2526error_code%253D200%2526error_description%253DPermissions%252Berror%2526error_reason%253Duser_denied%2523_%253D_%26display%3Dpage%26locale%3Dvi_VN%26pl_dbl%3D0&multiple_results=0&ars=facebook_login&lwv=100&locale2=vi_VN&_rdr
Title: Quên mật khẩu?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nhannick.com/facebook/ 7 KB
3 KB 576ms
537ms Document
text/html 2606:4700:3031::ac43:a011
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhannick.com/facebook/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:a011 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.21
Resource Hash: d5efabd75d7df9690b652a213f835add2dd61d256d02e75f64a0746d99efbba1

Request headers

:method: GET
:authority: nhannick.com
:scheme: https
:path: /facebook/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 11 Sep 2020 00:56:13 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d75ab3a6a29f52fc5bb636457008a7b7f1599785772; expires=Sun, 11-Oct-20 00:56:12 GMT; path=/; domain=.nhannick.com; HttpOnly; SameSite=Lax; Secure PHPSESSID=dd843385a49c0d0fc3134d718c355482; path=/
x-powered-by: PHP/7.2.21
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
cf-request-id: 051c42bfa500001f2128a43200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d0d6d790daf1f21-FRA
content-encoding: br

GET
H2 200 fb.css
nhannick.com/assets/ 132 KB
29 KB 1463ms
1462ms Stylesheet
text/css 2606:4700:3031::ac43:a011
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nhannick.com/assets/fb.css
Requested by: Host: nhannick.com
URL: https://nhannick.com/facebook/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:a011 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0266969bed75dfd1e36a659e75798e807a4aeeb72550d76bdc4ba4148472b65

Request headers

Referer: https://nhannick.com/facebook/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 00:56:14 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 20 Aug 2020 19:32:29 GMT
server: cloudflare
etag: W/"20f9f-5ad542e571029"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5d0d6d7c68d51f21-FRA
cf-request-id: 051c42c1c400001f2128a57200000001

GET
H2 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
2 KB 8ms
6ms Image
image/svg+xml 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Host: nhannick.com
URL: https://nhannick.com/facebook/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

/

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nhannick.com/facebook/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1027
x-xss-protection: 0
x-fb-debug: nl1UNXMHx3jFDh+cYkMrQiD51xqWQGTxyM1+ej5PFkkz9MVNKrHqAiHxYtISQvE0myOErhkfF/2WVssDdJQTog==
x-fb-trip-id: 664085054
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
date: Fri, 11 Sep 2020 00:56:13 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Tue, 07 Sep 2021 21:52:53 GMT

GET
H2 200 mWPW-R_6UmlUJMrXSUBZ78OerQfV1wlL3BrWPDD7odzLJi7EBFYVlA4rFo4VUEVF0FI=s180-rw
lh3.googleusercontent.com/ 43 KB
44 KB 44ms
22ms Image
image/webp 2a00:1450:4001:81d::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/mWPW-R_6UmlUJMrXSUBZ78OerQfV1wlL3BrWPDD7odzLJi7EBFYVlA4rFo4VUEVF0FI=s180-rw

Requested by

Host: nhannick.com
URL: https://nhannick.com/facebook/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

ae89a3336c21aff35e5936e7994d9cd9822540c3dd6714b167da6986071f3d5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nhannick.com/facebook/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 00:56:13 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="unnamed.webp"
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44256
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 06 Sep 2020 17:27:13 GMT

GET
H2 404 jT0UEYSEi4D.png
nhannick.com/images/ 339 B
339 B 429ms
428ms Image
text/html 2606:4700:3031::ac43:a011
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nhannick.com/images/jT0UEYSEi4D.png
Requested by: Host: nhannick.com
URL: https://nhannick.com/assets/fb.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:a011 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6927bac8009b43e452b7aff0340fffb630ef47f261a7ff97407419c87dd72b1d

Request headers

Referer: https://nhannick.com/assets/fb.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 11 Sep 2020 00:56:15 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=iso-8859-1
status: 404
cache-control: max-age=14400
cf-ray: 5d0d6d85a9511f21-FRA
cf-request-id: 051c42c78800001f2128a77200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| login

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nhannick.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: dd843385a49c0d0fc3134d718c355482
			.nhannick.com/	1970-01-19 13:06:17	Name: __cfduid Value: d75ab3a6a29f52fc5bb636457008a7b7f1599785772

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lh3.googleusercontent.com
nhannick.com
static.xx.fbcdn.net
2606:4700:3031::ac43:a011
2a00:1450:4001:81d::2001
2a03:2880:f01c:8012:face:b00c:0:3
6927bac8009b43e452b7aff0340fffb630ef47f261a7ff97407419c87dd72b1d
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
ae89a3336c21aff35e5936e7994d9cd9822540c3dd6714b167da6986071f3d5f
d0266969bed75dfd1e36a659e75798e807a4aeeb72550d76bdc4ba4148472b65
d5efabd75d7df9690b652a213f835add2dd61d256d02e75f64a0746d99efbba1

nhannick.com Open in urlscan Pro 2606:4700:3031::ac43:a011 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

77 kBTransfer

184 kBSize

2 Cookies

2 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

Indicators

nhannick.com Open in urlscan Pro
2606:4700:3031::ac43:a011 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

77 kB
Transfer

184 kB
Size

2
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!