fauth.salivirt.tk Open in urlscan Pro
2400:cb00:2048:1::681c:1d9f Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://fauth.salivirt.tk/?snr=419
Submission: On June 22 via automatic, source phishtank (June 22nd 2017, 8:11:09 am UTC)

Summary HTTP 7 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2400:cb00:2048:1::681c:1d9f, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is fauth.salivirt.tk.

This is the only time fauth.salivirt.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
5	2400:cb00:204... 2400:cb00:2048:1::681c:1d9f	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2400:cb00:204... 2400:cb00:2048:1::681c:1c9f	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
7	4

5 2400:cb00:2048:1::681c:1d9f (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

fauth.salivirt.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:cb00:2048:1::681c:1c9f (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

fauth.salivirt.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	salivirt.tk fauth.salivirt.tk	42 KB
1	googleapis.com ajax.googleapis.com	33 KB
7	2

	Domain	Requested by
6	fauth.salivirt.tk	fauth.salivirt.tk ajax.googleapis.com
1	ajax.googleapis.com	fauth.salivirt.tk
7	2

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
ru-ru.facebook.com
en-gb.facebook.com
uk-ua.facebook.com
fi-fi.facebook.com
zh-cn.facebook.com
de-de.facebook.com
ar-ar.facebook.com
tr-tr.facebook.com
fr-fr.facebook.com
es-la.facebook.com
messenger.com
developers.facebook.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://fauth.salivirt.tk/?snr=419
Frame ID: 8660.1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

0 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

75 kB
Transfer

264 kB
Size

2
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/
Title: логотип Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/r.php?locale=ru_RU
Title: Регистрация

Search URL Search Domain Scan URL

URL: https://www.facebook.com/recover/initiate?lwv=120&lwc=1348028
Title: Забыли пароль?

Search URL Search Domain Scan URL

URL: https://www.facebook.com/r.php?next&locale=ru_RU&display=page
Title: Зарегистрируйтесь на Facebook

Search URL Search Domain Scan URL

URL: https://ru-ru.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Русский

Search URL Search Domain Scan URL

URL: https://en-gb.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: English (UK)

Search URL Search Domain Scan URL

URL: https://uk-ua.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Українська

Search URL Search Domain Scan URL

URL: https://fi-fi.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Suomi

Search URL Search Domain Scan URL

URL: https://zh-cn.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: 中文(简体)

Search URL Search Domain Scan URL

URL: https://de-de.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://ar-ar.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: العربية

Search URL Search Domain Scan URL

URL: https://tr-tr.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Türkçe

Search URL Search Domain Scan URL

URL: https://fr-fr.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Français (France)

Search URL Search Domain Scan URL

URL: https://es-la.facebook.com/login.php?login_attempt=1&lwv=120&lwc=1348028
Title: Español

Search URL Search Domain Scan URL

URL: https://www.facebook.com/r.php
Title: Регистрация

Search URL Search Domain Scan URL

URL: https://www.facebook.com/login/
Title: Вход

Search URL Search Domain Scan URL

URL: https://messenger.com/
Title: Messenger

Search URL Search Domain Scan URL

URL: https://www.facebook.com/lite/
Title: Facebook Lite

Search URL Search Domain Scan URL

URL: https://www.facebook.com/mobile/?ref=pf
Title: Push-уведомления

Search URL Search Domain Scan URL

URL: https://www.facebook.com/find-friends?ref=pf
Title: Найти друзей

Search URL Search Domain Scan URL

URL: https://www.facebook.com/badges/?ref=pf
Title: Визитки

Search URL Search Domain Scan URL

URL: https://www.facebook.com/directory/people/
Title: Люди

Search URL Search Domain Scan URL

URL: https://www.facebook.com/directory/pages/
Title: Страницы

Search URL Search Domain Scan URL

URL: https://www.facebook.com/places/
Title: Места

Search URL Search Domain Scan URL

URL: https://www.facebook.com/games/
Title: Игры

Search URL Search Domain Scan URL

URL: https://www.facebook.com/directory/places/
Title: Местонахождения

Search URL Search Domain Scan URL

URL: https://www.facebook.com/directory/celebrities/
Title: Знаменитости

Search URL Search Domain Scan URL

URL: https://www.facebook.com/directory/groups/
Title: Группы

Search URL Search Domain Scan URL

URL: https://www.facebook.com/facebook
Title: О нас

Search URL Search Domain Scan URL

URL: https://www.facebook.com/campaign/landing.php?placement=pflo&campaign_id=402047449186&extra_1=auto
Title: Создать рекламу

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/create/?ref_type=sitefooter
Title: Создать Страницу

Search URL Search Domain Scan URL

URL: https://developers.facebook.com/?ref=pf
Title: Разработчикам

Search URL Search Domain Scan URL

URL: https://www.facebook.com/careers/?ref=pf
Title: Вакансии

Search URL Search Domain Scan URL

URL: https://www.facebook.com/privacy/explanation
Title: Конфиденциальность

Search URL Search Domain Scan URL

URL: https://www.facebook.com/help/cookies/?ref=sitefooter
Title: Файлы «cookie»

Search URL Search Domain Scan URL

URL: https://www.facebook.com/help/568137493302217
Title: Выбор рекламы

Search URL Search Domain Scan URL

URL: https://www.facebook.com/policies/?ref=pf
Title: Условия использования

Search URL Search Domain Scan URL

URL: https://www.facebook.com/help/?ref=pf
Title: Помощь

Search URL Search Domain Scan URL

URL: https://www.facebook.com/settings
Title: Настройки

Search URL Search Domain Scan URL

URL: https://www.facebook.com/allactivity?privacy_source=activity_log_top_menu
Title: Журнал действий

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
fauth.salivirt.tk/ 15 KB
6 KB 54ms
41ms Document
text/html 2400:cb00:2048:1::681c:1d9f
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://fauth.salivirt.tk/?snr=419
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1d9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx / PHP/5.3.3
Resource Hash: 66507cc31daf8f5492aaa821419d2da558d97078e3d4822a547ec632b80284ca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Jun 2017 08:10:58 GMT
Content-Encoding: gzip
Server: cloudflare-nginx
X-Powered-By: PHP/5.3.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
CF-RAY: 372dbbf463a1650b-FRA
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 91 KB
33 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

Requested by

Host: fauth.salivirt.tk
URL: http://fauth.salivirt.tk/?snr=419

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://fauth.salivirt.tk/?snr=419
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Tue, 16 May 2017 13:55:37 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Dec 2016 18:17:03 GMT
Server: sffe
Age: 3176121
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 33593
X-XSS-Protection: 1; mode=block
Expires: Wed, 16 May 2018 13:55:37 GMT

GET
H/1.1 200
OK to.js Show response
fauth.salivirt.tk/file/ 3 KB
1 KB 31ms
31ms Script
text/javascript 2400:cb00:2048:1::681c:1c9f
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://fauth.salivirt.tk/file/to.js
Requested by: Host: fauth.salivirt.tk
URL: http://fauth.salivirt.tk/?snr=419
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1c9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 787cea6938a0d8e476d3f483eb1089a8083486552958ee5d07b96a6dceb83fbb

Request headers

Referer: http://fauth.salivirt.tk/?snr=419
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 08:10:58 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Thu, 05 Jan 2017 11:43:05 GMT
Server: cloudflare-nginx
ETag: W/"4094e-a88-545576794ce6f"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 372dbbf4b678279e-FRA
Expires: Sun, 16 Jul 2017 08:10:58 GMT

GET
H/1.1 200
OK script.js Show response
fauth.salivirt.tk/to/templates/temp/fb/js/ 469 B
302 B 25ms
25ms Script
text/javascript 2400:cb00:2048:1::681c:1d9f
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://fauth.salivirt.tk/to/templates/temp/fb/js/script.js?2
Requested by: Host: fauth.salivirt.tk
URL: http://fauth.salivirt.tk/?snr=419
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1d9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 814c5b4708cf5655d909f5867a92b52ed9ee295ecb1eff97e70ae71ac25c1e68

Request headers

Referer: http://fauth.salivirt.tk/?snr=419
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 08:10:58 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Thu, 05 Jan 2017 11:44:01 GMT
Server: cloudflare-nginx
ETag: W/"40a37-2a0-545576aec2347"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 372dbbf5129c2678-FRA
Expires: Sun, 16 Jul 2017 08:10:58 GMT

GET
H/1.1 200
OK CC8icygeyKA.css
fauth.salivirt.tk/to/templates/temp/fb/index_files/ 149 KB
30 KB 59ms
55ms Stylesheet
text/css 2400:cb00:2048:1::681c:1d9f
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://fauth.salivirt.tk/to/templates/temp/fb/index_files/CC8icygeyKA.css?i=1
Requested by: Host: fauth.salivirt.tk
URL: http://fauth.salivirt.tk/?snr=419
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1d9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: f6e6ec3f72235bc5ab75fccf0ca8cafe5f9f991ecea77b0721ab42994f51bd98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36
Referer: http://fauth.salivirt.tk/?snr=419
Origin: http://fauth.salivirt.tk

Response headers

Date: Thu, 22 Jun 2017 08:10:58 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Thu, 05 Jan 2017 11:44:01 GMT
Server: cloudflare-nginx
ETag: W/"40a34-25427-545576ae535d7"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=2073600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 372dbbf4a3d4650b-FRA
Expires: Sun, 16 Jul 2017 08:10:58 GMT

POST
H/1.1 404
Not Found ads.php Show response
fauth.salivirt.tk/templates/ 1 KB
702 B 37ms
26ms XHR
text/html 2400:cb00:2048:1::681c:1d9f
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL: http://fauth.salivirt.tk/templates/ads.php
Requested by: Host: ajax.googleapis.com
URL: http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1d9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx / PHP/5.3.3
Resource Hash: 0e0b0b74b65b34ba43f04d5e39b8a0f7a69fb7c134b1c158fdb407280f3e5673

Request headers

Accept: */*
Referer: http://fauth.salivirt.tk/?snr=419
Origin: http://fauth.salivirt.tk
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 08:10:58 GMT
Content-Encoding: gzip
Server: cloudflare-nginx
X-Powered-By: PHP/5.3.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Connection: keep-alive
CF-RAY: 372dbbf4e2862678-FRA

GET
DATA 200
OK truncated
/ 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 556d6f312fc9263007a328683ae62ceedf64878dea7618d71725044c19a9e144

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK ZVyMWStefv_.png
fauth.salivirt.tk/to/templates/temp/fb/img/ 3 KB
3 KB 7ms
7ms Image
image/png 2400:cb00:2048:1::681c:1d9f
CloudFlare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://fauth.salivirt.tk/to/templates/temp/fb/img/ZVyMWStefv_.png
Requested by: Host: fauth.salivirt.tk
URL: http://fauth.salivirt.tk/?snr=419
Protocol: HTTP/1.1
Server: 2400:cb00:2048:1::681c:1d9f , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 722190daf943be83452ae519a262c9a3f87a067dcc78c7839ffa679de79cbcf3

Request headers

Referer: http://fauth.salivirt.tk/to/templates/temp/fb/index_files/CC8icygeyKA.css?i=1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.104 Safari/537.36

Response headers

Date: Thu, 22 Jun 2017 08:10:58 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 05 Jan 2017 11:44:00 GMT
Server: cloudflare-nginx
ETag: "40a2f-dd2-545576ad0bba7"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 372dbbf52427650b-FRA
Content-Length: 3538
Expires: Mon, 21 Aug 2017 08:10:58 GMT

GET
DATA 200
OK truncated
/ 77 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6473842217d714b2a956941339a90132c43e45f9af637545f015d4838dfa55d2

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fauth.salivirt.tk/	1970-01-01 00:00:00	Name: PHPSESSID Value: boebiq3n4sb8e2bf96dvm44cq6
			.salivirt.tk/	2018-06-22 08:10:58	Name: __cfduid Value: d82e90aec81ff1a81952d88e0e2d2b9cb1498119058

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fauth.salivirt.tk
2400:cb00:2048:1::681c:1c9f
2400:cb00:2048:1::681c:1d9f
2a00:1450:4001:824::200a
0e0b0b74b65b34ba43f04d5e39b8a0f7a69fb7c134b1c158fdb407280f3e5673
556d6f312fc9263007a328683ae62ceedf64878dea7618d71725044c19a9e144
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
6473842217d714b2a956941339a90132c43e45f9af637545f015d4838dfa55d2
66507cc31daf8f5492aaa821419d2da558d97078e3d4822a547ec632b80284ca
722190daf943be83452ae519a262c9a3f87a067dcc78c7839ffa679de79cbcf3
787cea6938a0d8e476d3f483eb1089a8083486552958ee5d07b96a6dceb83fbb
814c5b4708cf5655d909f5867a92b52ed9ee295ecb1eff97e70ae71ac25c1e68
f6e6ec3f72235bc5ab75fccf0ca8cafe5f9f991ecea77b0721ab42994f51bd98

fauth.salivirt.tk Open in urlscan Pro 2400:cb00:2048:1::681c:1d9f Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

0 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

4 IPs

2 Countries

75 kBTransfer

264 kBSize

2 Cookies

40 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

fauth.salivirt.tk Open in urlscan Pro
2400:cb00:2048:1::681c:1d9f Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

75 kB
Transfer

264 kB
Size

2
Cookies

7 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!