facebook.login.inferarchitecture.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 199.116.117.210, located in Atlanta, United States and belongs to PERFORMIVE, US. The main domain is facebook.login.inferarchitecture.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 10th 2020. Valid for: 3 months.

This is the only time facebook.login.inferarchitecture.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 5	199.116.117.210 199.116.117.210	46562 (PERFORMIVE) (PERFORMIVE)
1	151.101.12.193 151.101.12.193	54113 (FASTLY) (FASTLY)
5	2

5 199.116.117.210 (Atlanta, United States) 1 redirects

ASN46562 (PERFORMIVE, US)
PTR: server1.hostdazzle.us

facebook.login.inferarchitecture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	inferarchitecture.com 1 redirects facebook.login.inferarchitecture.com	65 KB
1	imgur.com i.imgur.com	1 KB
5	2

	Domain	Requested by
5	facebook.login.inferarchitecture.com	1 redirects facebook.login.inferarchitecture.com
1	i.imgur.com	facebook.login.inferarchitecture.com
5	2

This site contains no links.

Subject Issuer	Validity	Valid
facebook.login.inferarchitecture.com cPanel, Inc. Certification Authority	`2020-10-10` - `2021-01-08`	3 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://facebook.login.inferarchitecture.com/
Frame ID: A7B7648C32536584EAA726CEFCCFE3C4
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://facebook.login.inferarchitecture.com/ HTTP 301
https://facebook.login.inferarchitecture.com/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

65 kB
Transfer

64 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://facebook.login.inferarchitecture.com/ HTTP 301
https://facebook.login.inferarchitecture.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
facebook.login.inferarchitecture.com/
Redirect Chain

http://facebook.login.inferarchitecture.com/
https://facebook.login.inferarchitecture.com/

3 KB
3 KB

402ms
147ms

Document
text/html

199.116.117.210
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.login.inferarchitecture.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.116.117.210 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server1.hostdazzle.us
Software: Apache /
Resource Hash: a8abbaf503b9f4011c0b174eade3f54d4fce993b69fc4ad7d877b1154c5cdf14

Request headers

Host: facebook.login.inferarchitecture.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 12 Oct 2020 01:26:41 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=6e092i0tdeukb1j4fn38nd7et4; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 12 Oct 2020 01:26:41 GMT
Server: Apache
Location: https://facebook.login.inferarchitecture.com/
Content-Length: 253
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK sflZM3vcKTF.css
facebook.login.inferarchitecture.com/login_files/ 21 KB
21 KB 128ms
127ms Stylesheet
text/css 199.116.117.210
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.login.inferarchitecture.com/login_files/sflZM3vcKTF.css
Requested by: Host: facebook.login.inferarchitecture.com
URL: https://facebook.login.inferarchitecture.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.116.117.210 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server1.hostdazzle.us
Software: Apache /
Resource Hash: d9a6491cfdba96f5d9e3c49af9091f6a2dbd9fd019b68356a96d4b3fd96eea96

Request headers

Referer: https://facebook.login.inferarchitecture.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 12 Oct 2020 01:26:41 GMT
Last-Modified: Sat, 10 Oct 2020 15:21:26 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 21681

GET
H/1.1 200
OK SrSKncNeeYJ.css
facebook.login.inferarchitecture.com/login_files/ 32 KB
32 KB 369ms
131ms Stylesheet
text/css 199.116.117.210
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.login.inferarchitecture.com/login_files/SrSKncNeeYJ.css
Requested by: Host: facebook.login.inferarchitecture.com
URL: https://facebook.login.inferarchitecture.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.116.117.210 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server1.hostdazzle.us
Software: Apache /
Resource Hash: 7c879303914b53a6bed2b1f544516b5dc28c12587e226da79bbec40ec0ce35ba

Request headers

Referer: https://facebook.login.inferarchitecture.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 12 Oct 2020 01:26:41 GMT
Last-Modified: Sat, 10 Oct 2020 15:21:26 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 32912

GET
H/1.1 200
OK pF-8UwpBzdj.css
facebook.login.inferarchitecture.com/login_files/ 7 KB
7 KB 389ms
130ms Stylesheet
text/css 199.116.117.210
PERFORMIVE

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.login.inferarchitecture.com/login_files/pF-8UwpBzdj.css
Requested by: Host: facebook.login.inferarchitecture.com
URL: https://facebook.login.inferarchitecture.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.116.117.210 Atlanta, United States, ASN46562 (PERFORMIVE, US),
Reverse DNS: server1.hostdazzle.us
Software: Apache /
Resource Hash: a2d0c1f00c92bf8636e48e112fb5c8a2f0b8b5dcdf713a5559a7155c4de55738

Request headers

Referer: https://facebook.login.inferarchitecture.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 12 Oct 2020 01:26:41 GMT
Last-Modified: Sat, 10 Oct 2020 15:21:26 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7199

GET
H2 200 fQmX3UF.png
i.imgur.com/ 809 B
1 KB 94ms
31ms Image
image/png 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/fQmX3UF.png

Requested by

Host: facebook.login.inferarchitecture.com
URL: https://facebook.login.inferarchitecture.com/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://facebook.login.inferarchitecture.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 12 Oct 2020 01:26:41 GMT
x-content-type-options: nosniff
age: 121254
x-cache: HIT, HIT
status: 200
content-length: 809
x-served-by: cache-bwi5124-BWI, cache-fra19151-FRA
last-modified: Sat, 10 Oct 2020 15:45:48 GMT
server: cat factory 1.0
x-timer: S1602466002.705012,VS0,VE1
etag: "65f2f1eb5798b53c504ed8de3d90c958"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			facebook.login.inferarchitecture.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6e092i0tdeukb1j4fn38nd7et4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook.login.inferarchitecture.com
i.imgur.com
151.101.12.193
199.116.117.210
7c879303914b53a6bed2b1f544516b5dc28c12587e226da79bbec40ec0ce35ba
a2d0c1f00c92bf8636e48e112fb5c8a2f0b8b5dcdf713a5559a7155c4de55738
a8abbaf503b9f4011c0b174eade3f54d4fce993b69fc4ad7d877b1154c5cdf14
d9a6491cfdba96f5d9e3c49af9091f6a2dbd9fd019b68356a96d4b3fd96eea96
e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae

facebook.login.inferarchitecture.com Open in urlscan Pro 199.116.117.210 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

65 kBTransfer

64 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

facebook.login.inferarchitecture.com Open in urlscan Pro
199.116.117.210 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

65 kB
Transfer

64 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!