facebook.help1001536148119.com Open in urlscan Pro
78.40.143.14 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://facebook.help1001536148119.com/
Submission: On April 08 via manual (April 8th 2022, 3:00:36 pm UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 78.40.143.14, located in Bulgaria and belongs to VERDINA, BZ. The main domain is facebook.help1001536148119.com.
TLS certificate: Issued by R3 on April 8th 2022. Valid for: 3 months.

This is the only time facebook.help1001536148119.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
12	78.40.143.14 78.40.143.14	201133 (VERDINA) (VERDINA)
2	2606:4700::68... 2606:4700::6810:5914	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
17	5

12 78.40.143.14 (Bulgaria)

ASN201133 (VERDINA, BZ)

facebook.help1001536148119.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5914 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	help1001536148119.com facebook.help1001536148119.com	173 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 436	402 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	1 KB
17	4

	Domain	Requested by
12	facebook.help1001536148119.com	facebook.help1001536148119.com
2	fonts.gstatic.com	fonts.googleapis.com
2	cdn.jsdelivr.net	facebook.help1001536148119.com cdn.jsdelivr.net
1	fonts.googleapis.com	facebook.help1001536148119.com
17	4

This site contains no links.

Subject Issuer	Validity	Valid
*.help1001536148119.com R3	`2022-04-08` - `2022-07-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://facebook.help1001536148119.com/
Frame ID: 5A823D54120976728BE5B7D733D84D02
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pages | Facebook Help Centre

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

608 kB
Transfer

959 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
facebook.help1001536148119.com/ 29 KB
4 KB 354ms
229ms Document
text/html 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed / PHP/8.0.17
Resource Hash: 67a7c4974ceb6aa094d2c6d0fcf6f91fe1e4f3c013f581a53d378af61690a724

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 08 Apr 2022 15:00:29 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/8.0.17

GET
H2 200 materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/ 298 KB
49 KB 117ms
52ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css

Requested by

Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1575518
x-jsd-version: 6.5.95
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-mxp6932-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"4a77e-zA2GoL0mTEDvUuLc3XyUhUKPyv0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lYvJBR8EKeWQtoTiXQgPO5aK3Z9t55BzNcS38t%2BsmcLyV74Ol799OG%2BJS69FMTZIxa2zAY6tqrOhnnq%2BAxTvVSz7Grk%2F%2FbGpeXypRnuEyxjt%2BrfkgeFrksgwgUkW%2BTCFXh1IMXayJ1S2arJzSwE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6f8bdf7d1fdc7345-MRS

GET
H2 200 style.css
facebook.help1001536148119.com/public/css/ 13 KB
3 KB 34ms
33ms Stylesheet
text/css 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help1001536148119.com/public/css/style.css
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e5487a0d03ad711e6293f87fecb5a8f893650bf7f3c19995860648f685826ac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
content-encoding: br
last-modified: Wed, 02 Mar 2022 14:29:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3439
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 mobile.css
facebook.help1001536148119.com/public/css/ 4 KB
1 KB 31ms
31ms Stylesheet
text/css 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help1001536148119.com/public/css/mobile.css
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 99319f9be38b6497b23d96a56454fca59ba0dfca02992411f9c79d5dcc02ee6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
content-encoding: br
last-modified: Wed, 16 Feb 2022 03:34:34 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1208
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 logo.png
facebook.help1001536148119.com/public/images/ 33 KB
33 KB 133ms
131ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/logo.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 28853c473e0f6e00721af9e3def3d287982e0ac0db41a9cee9d51ab4ac12430e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
last-modified: Sun, 13 Feb 2022 23:58:50 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 34097
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 search.svg
facebook.help1001536148119.com/public/images/ 287 B
249 B 255ms
253ms Image
image/svg+xml 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/search.svg
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: fabbf2a7fd35f0c06a52e20d04a1fcc2b157764806c95af60827dcbb2822a232

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
content-encoding: br
last-modified: Mon, 14 Feb 2022 00:22:14 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 182
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 pg1.png
facebook.help1001536148119.com/public/images/ 15 KB
15 KB 255ms
254ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/pg1.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
last-modified: Mon, 14 Feb 2022 18:53:32 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 15685
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 pg2.png
facebook.help1001536148119.com/public/images/ 4 KB
4 KB 64ms
63ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/pg2.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4e7707fadcf9e2b0dd69ac76362f94098d70f6182eebf94d4f1e1aa451558056

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
last-modified: Mon, 14 Feb 2022 18:53:52 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4269
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 pg3.png
facebook.help1001536148119.com/public/images/ 5 KB
5 KB 256ms
254ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/pg3.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 6523207b31b02c40fd0364d902630cdd595aa25765e4ae47df7d94460ec3f4e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
last-modified: Mon, 14 Feb 2022 18:54:06 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5460
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 logo2.png
facebook.help1001536148119.com/public/images/ 14 KB
14 KB 255ms
254ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/logo2.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
last-modified: Mon, 14 Feb 2022 19:47:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 14311
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
facebook.help1001536148119.com/public/js/ 87 KB
30 KB 257ms
255ms Script
application/javascript 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help1001536148119.com/public/js/jquery-3.5.1.min.js
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
content-encoding: br
last-modified: Tue, 02 Mar 2021 19:26:16 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 30280
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 main.js Show response
facebook.help1001536148119.com/public/js/ 1 KB
535 B 255ms
253ms Script
application/javascript 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help1001536148119.com/public/js/main.js
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 88df158913101e3837d7b07ce419bf87945952ef39ccf356fceee82daebb3f67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:29 GMT
content-encoding: br
last-modified: Tue, 15 Feb 2022 20:10:28 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 462
expires: Fri, 15 Apr 2022 15:00:29 GMT

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 52ms
23ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Requested by

Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/public/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e1f98ccf79d380deb41bb2c3a281390b81ccee0e182e47827847a15a4f8e9411

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 08 Apr 2022 13:10:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 08 Apr 2022 15:00:30 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 08 Apr 2022 15:00:30 GMT

GET
DATA 200
OK truncated
/ 241 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9668b153f3169d94dc4d713cb95638f7b10409d12ba334881c968aa62b113402

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 banner.png
facebook.help1001536148119.com/public/images/ 61 KB
61 KB 294ms
293ms Image
image/png 78.40.143.14
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help1001536148119.com/public/images/banner.png
Requested by: Host: facebook.help1001536148119.com
URL: https://facebook.help1001536148119.com/public/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.40.143.14 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 2ffa07d617579b7fd988c5be0055f23684935edb7378bda1cd876dc7b9c30965

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help1001536148119.com/public/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:30 GMT
last-modified: Wed, 16 Feb 2022 02:22:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 62407
expires: Fri, 15 Apr 2022 15:00:30 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 29ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://facebook.help1001536148119.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 240755
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 05 Apr 2023 20:07:55 GMT

GET
H3 200 materialdesignicons-webfont.woff2
cdn.jsdelivr.net/npm/@mdi/font@6.5.95/fonts/ 353 KB
354 KB 56ms
29ms Font
font/woff2 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/fonts/materialdesignicons-webfont.woff2?v=6.5.95

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11e3d4caeceb6a9d4be5144f349b5abbb8e586f1568d58a24794331023249733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css
Origin: https://facebook.help1001536148119.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 15:00:31 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1574939
x-jsd-version: 6.5.95
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 361384
x-served-by: cache-fra19138-FRA, cache-mxp6979-MXP
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"583a8-B9VpeWogWvpubHiiAGMvQ5DcXIs"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rqv9ehd3hJlvQ5e6Xzp%2BmNkA5zki43BUxDHhi0fsS97ez2houg6ByjewZmeeF%2BXeybO50Zu2AgvDWyrMGp6%2F%2B6z2D2pbHTw9YgZX4tJDwt0mkjnu7rJFJ2leILqyyyMQxy5pgB3io22fuEdOHoA%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
cf-ray: 6f8bdf7dcfc1f92f-MXP

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 30ms
8ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://facebook.help1001536148119.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 18:59:49 GMT
x-content-type-options: nosniff
age: 244841
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 05 Apr 2023 18:59:49 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			facebook.help1001536148119.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6mig6k4k3ungcnc8tg7hko4dv7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
facebook.help1001536148119.com
fonts.googleapis.com
fonts.gstatic.com
2606:4700::6810:5914
2a00:1450:4001:809::2003
2a00:1450:4001:813::200a
78.40.143.14
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
11e3d4caeceb6a9d4be5144f349b5abbb8e586f1568d58a24794331023249733
28853c473e0f6e00721af9e3def3d287982e0ac0db41a9cee9d51ab4ac12430e
2ffa07d617579b7fd988c5be0055f23684935edb7378bda1cd876dc7b9c30965
4e7707fadcf9e2b0dd69ac76362f94098d70f6182eebf94d4f1e1aa451558056
50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7
6523207b31b02c40fd0364d902630cdd595aa25765e4ae47df7d94460ec3f4e5
67a7c4974ceb6aa094d2c6d0fcf6f91fe1e4f3c013f581a53d378af61690a724
84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6
88df158913101e3837d7b07ce419bf87945952ef39ccf356fceee82daebb3f67
9668b153f3169d94dc4d713cb95638f7b10409d12ba334881c968aa62b113402
99319f9be38b6497b23d96a56454fca59ba0dfca02992411f9c79d5dcc02ee6b
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
e1f98ccf79d380deb41bb2c3a281390b81ccee0e182e47827847a15a4f8e9411
e5487a0d03ad711e6293f87fecb5a8f893650bf7f3c19995860648f685826ac2
ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fabbf2a7fd35f0c06a52e20d04a1fcc2b157764806c95af60827dcbb2822a232

facebook.help1001536148119.com Open in urlscan Pro 78.40.143.14 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

608 kBTransfer

959 kBSize

1 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

facebook.help1001536148119.com Open in urlscan Pro
78.40.143.14 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

608 kB
Transfer

959 kB
Size

1
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!