favaey.com Open in urlscan Pro
45.133.200.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://favaey.com/citizen_bank/darkx/ms/index.php
Effective URL:
http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
Submission: On November 27 via automatic, source openphish (November 27th 2022, 1:17:08 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 45.133.200.3, located in Virgin Islands (British) and belongs to INTERNET-IT, VG. The main domain is favaey.com.

This is the only time favaey.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 9	45.133.200.3 45.133.200.3		200313 (INTERNET-IT) (INTERNET-IT)
8	1

9 45.133.200.3 (Virgin Islands (British)) 1 redirects

ASN200313 (INTERNET-IT, VG)
PTR: cpanel-host.prohoster.info

favaey.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	favaey.com 1 redirects favaey.com	310 KB
8	1

	Domain	Requested by
9	favaey.com	1 redirects favaey.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
Frame ID: F154A94CCA81890CC9474C6F550CE710
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft-account

Page URL History Show full URLs

http://favaey.com/citizen_bank/darkx/ms/index.php HTTP 302
http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

310 kB
Transfer

407 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://favaey.com/citizen_bank/darkx/ms/index.php HTTP 302
http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request password.php Show response
favaey.com/citizen_bank/darkx/ms/
Redirect Chain

http://favaey.com/citizen_bank/darkx/ms/index.php
http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

23 KB
6 KB

19ms
19ms

Document
text/html

45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx / PHP/5.6.40

Resource Hash

af3695695698c7b1f48264e2fb07e70b82c6a43d5bc332ea659617d5b2e56568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Nov 2022 01:17:02 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Nginx-Upstream-Cache-Status: BYPASS
X-Powered-By: PHP/5.6.40
X-Server-Powered-By: Engintron
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Nov 2022 01:17:02 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Location: password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
Pragma: no-cache
Server: nginx
X-Content-Type-Options: nosniff
X-Nginx-Upstream-Cache-Status: MISS
X-Powered-By: PHP/5.6.40
X-Server-Powered-By: Engintron
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Converged_v21033.css
favaey.com/citizen_bank/darkx/ms/password_files/ 99 KB
19 KB 17ms
17ms Stylesheet
text/css 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/Converged_v21033.css

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

03f77cd5f17c3838db2a91f7b7899eb1e85698d3ecf6b7fa85057a9266b6d0a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Tue, 27 Dec 2022 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK microsoft_logo.svg
favaey.com/citizen_bank/darkx/ms/password_files/ 4 KB
2 KB 31ms
16ms Image
image/svg+xml 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/microsoft_logo.svg

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK arrow_left.svg
favaey.com/citizen_bank/darkx/ms/password_files/ 513 B
739 B 30ms
16ms Image
image/svg+xml 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/arrow_left.svg

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK ellipsis_white.svg
favaey.com/citizen_bank/darkx/ms/password_files/ 915 B
726 B 29ms
15ms Image
image/svg+xml 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/ellipsis_white.svg

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK ellipsis_grey.svg
favaey.com/citizen_bank/darkx/ms/password_files/ 915 B
726 B 30ms
15ms Image
image/svg+xml 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/ellipsis_grey.svg

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK 0-small.jpg
favaey.com/citizen_bank/darkx/ms/password_files/ 3 KB
3 KB 15ms
15ms Image
image/jpeg 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/0-small.jpg?x=138bcee624fa04ef9b75e86211a9fe0d

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3006
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

GET
H/1.1 200
OK 0.jpg
favaey.com/citizen_bank/darkx/ms/password_files/ 277 KB
277 KB 16ms
16ms Image
image/jpeg 45.133.200.3
INTERNET-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://favaey.com/citizen_bank/darkx/ms/password_files/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0

Requested by

Host: favaey.com
URL: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26

Protocol

HTTP/1.1

Server

45.133.200.3 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),

Reverse DNS

cpanel-host.prohoster.info

Software

nginx /

Resource Hash

211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://favaey.com/citizen_bank/darkx/ms/password.php?&sessionid=5f5587a868ef5b769381171bd9fddc88&ac=26
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Thu, 26 Jan 2023 01:17:02 GMT
Date: Sun, 27 Nov 2022 01:17:02 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Feb 2020 17:16:02 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 283351
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| empty function| change

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			favaey.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: smpj67hdmio84fruimt4vc6js7

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

favaey.com
45.133.200.3
03f77cd5f17c3838db2a91f7b7899eb1e85698d3ecf6b7fa85057a9266b6d0a8
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
af3695695698c7b1f48264e2fb07e70b82c6a43d5bc332ea659617d5b2e56568
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

favaey.com Open in urlscan Pro 45.133.200.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

310 kBTransfer

407 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

favaey.com Open in urlscan Pro
45.133.200.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

310 kB
Transfer

407 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!