accfb-qrw398wkt.mejling.si Open in urlscan Pro
212.44.106.23  Malicious Activity! Public Scan

URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Submission: On May 21 via automatic, source openphish

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 212.44.106.23, located in Slovenia and belongs to SEEWEB Web hosting, colocation and cloud services, IT. The main domain is accfb-qrw398wkt.mejling.si.
This is the only time accfb-qrw398wkt.mejling.si was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
6 212.44.106.23 12637 (SEEWEB We...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a03:2880:f02... 32934 (FACEBOOK)
8 3
Domain Requested by
6 accfb-qrw398wkt.mejling.si accfb-qrw398wkt.mejling.si
1 static.xx.fbcdn.net accfb-qrw398wkt.mejling.si
1 stackpath.bootstrapcdn.com accfb-qrw398wkt.mejling.si
8 3
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-03-01 -
2022-02-28
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-04-06 -
2021-07-03
3 months crt.sh

This page contains 1 frames:

Primary Page: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Frame ID: 4A451EE1A8512C43DBCD7FB198EDD989
Requests: 8 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

25 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

146 kB
Transfer

280 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set connect.html
accfb-qrw398wkt.mejling.si/
15 KB
15 KB
Document
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
e99f06ccbe5da3be9f80050324f6840d802a7c16ef43ee6a082c15a868820c2e

Request headers

Host
accfb-qrw398wkt.mejling.si
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Server
Apache
Last-Modified
Sun, 31 Jan 2021 15:11:54 GMT
Accept-Ranges
bytes
Content-Length
15373
Content-Type
text/html
Set-Cookie
PH_HPXY_CHECK=s1; path=/
Cache-control
private
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/
156 KB
21 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
http://accfb-qrw398wkt.mejling.si
Referer
http://accfb-qrw398wkt.mejling.si/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 13:08:59 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601, 617, 617
age
51895
cdn-cachedat
2021-05-21 00:42:47
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a30a4303c000031400a2c1000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:09 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
2d953da68aebdc813563067a8706ed6f
cf-ray
652e09606e0f3140-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
53txlwvKeRS.css
accfb-qrw398wkt.mejling.si/connect_files/
18 KB
18 KB
Stylesheet
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect_files/53txlwvKeRS.css
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
837a841d947230dc361bc2334a4e34ae9976b0fd2e6714d1c57a8a8f8c82ff81

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
accfb-qrw398wkt.mejling.si
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Cookie
PH_HPXY_CHECK=s1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Last-Modified
Sun, 31 Jan 2021 14:58:20 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
18407
Content-Type
text/css
O3MUGuHC-nX.css
accfb-qrw398wkt.mejling.si/connect_files/
37 KB
38 KB
Stylesheet
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect_files/O3MUGuHC-nX.css
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
dfd4557cf10f1920c4363b5304bcdfe3e884ca415807a8b6c6b0f462c5f73d17

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
accfb-qrw398wkt.mejling.si
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Cookie
PH_HPXY_CHECK=s1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Last-Modified
Sun, 31 Jan 2021 14:58:20 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
38328
Content-Type
text/css
y_XtUdqeKN-.css
accfb-qrw398wkt.mejling.si/connect_files/
49 KB
49 KB
Stylesheet
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect_files/y_XtUdqeKN-.css
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
fee797a6c5a83da83cf3e0532164c84bca0f910e50447ff29b7179d0438187cf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
accfb-qrw398wkt.mejling.si
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Cookie
PH_HPXY_CHECK=s1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Last-Modified
Sun, 31 Jan 2021 14:58:20 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
50405
Content-Type
text/css
dF5SId3UHWd.svg
accfb-qrw398wkt.mejling.si/connect_files/
2 KB
3 KB
Image
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect_files/dF5SId3UHWd.svg
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
accfb-qrw398wkt.mejling.si
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Cookie
PH_HPXY_CHECK=s1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Last-Modified
Sun, 31 Jan 2021 14:58:20 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
2385
Content-Type
image/svg+xml
hsts-pixel.gif
accfb-qrw398wkt.mejling.si/connect_files/
43 B
228 B
Image
General
Full URL
http://accfb-qrw398wkt.mejling.si/connect_files/hsts-pixel.gif
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
HTTP/1.1
Server
212.44.106.23 , Slovenia, ASN12637 (SEEWEB Web hosting, colocation and cloud services, IT),
Reverse DNS
vps-kreativija.controlpanel.si
Software
Apache /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
accfb-qrw398wkt.mejling.si
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Cookie
PH_HPXY_CHECK=s1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 13:08:59 GMT
Last-Modified
Sun, 31 Jan 2021 14:58:22 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
43
Content-Type
image/gif
JJsC9S33ata.png
static.xx.fbcdn.net/rsrc.php/v3/yP/r/
2 KB
2 KB
Image
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yP/r/JJsC9S33ata.png
Requested by
Host: accfb-qrw398wkt.mejling.si
URL: http://accfb-qrw398wkt.mejling.si/connect.html?timelimit=0a355d5bf8da856f344043a219496200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
39851cf509d8e6142c7e77cc2ee475c50ad358ca3be899954bf17c2155ae49ca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://accfb-qrw398wkt.mejling.si/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug
NvbBR95j8PtIrDn5EErwZp8Uk6ThUPbZlpPj+z/im9kQ5n32EJ+ZMyZOIKjBmrq2Wk0chtTd6c4nOUOPj8y0IA==
x-fb-trip-id
917726464
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
5bLIZb0mh/ooqLt48dFV7Q==
date
Fri, 21 May 2021 13:08:59 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
2325
x-fb-rlafr
0
expires
Sun, 15 May 2022 01:34:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Domain/Path Name / Value
accfb-qrw398wkt.mejling.si/ Name: PH_HPXY_CHECK
Value: s1