news.com3v.casa
Open in
urlscan Pro
2606:4700:3035::681b:af85
Malicious Activity!
Public Scan
Effective URL: https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/yuek77rbstmp3pnpj8m2uwqj.php?app-token=18g0h4di36b2ea...
Submission Tags: @ipnigh
Submission: On May 22 via api from GB
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 21st 2020. Valid for: a year.
This is the only time news.com3v.casa was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 2606:4700:303... 2606:4700:3035::681b:af85 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
com3v.casa
news.com3v.casa |
205 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
12 | news.com3v.casa |
news.com3v.casa
|
12 | 1 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-05-21 - 2021-05-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/yuek77rbstmp3pnpj8m2uwqj.php?app-token=18g0h4di36b2eaf%2097c5%20jrBOF%2025HgY%201LDX6S4wGCfkNo9E%20%20pK%20bugw78P3%20aTmJAS%20aZIM33943928758
Frame ID: 4E90C44F979C18FCB2606063B968BCE4
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/ Page URL
- https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/yuek77rbstmp3pnpj8m2uwqj.php?app-... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
44 Outgoing links
These are links going to different origins than the main page.
Title: Sections of this page
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: Create New Account
Search URL Search Domain Scan URL
Title: Forgotten account?
Search URL Search Domain Scan URL
Title: Sign up for Facebook
Search URL Search Domain Scan URL
Title: Русский
Search URL Search Domain Scan URL
Title: Türkçe
Search URL Search Domain Scan URL
Title: O'zbek
Search URL Search Domain Scan URL
Title: 한국어
Search URL Search Domain Scan URL
Title: Deutsch
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: العربية
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Sign Up
Search URL Search Domain Scan URL
Title: Log In
Search URL Search Domain Scan URL
Title: Messenger
Search URL Search Domain Scan URL
Title: Facebook Lite
Search URL Search Domain Scan URL
Title: Watch
Search URL Search Domain Scan URL
Title: People
Search URL Search Domain Scan URL
Title: Pages
Search URL Search Domain Scan URL
Title: Page categories
Search URL Search Domain Scan URL
Title: Places
Search URL Search Domain Scan URL
Title: Games
Search URL Search Domain Scan URL
Title: Locations
Search URL Search Domain Scan URL
Title: Marketplace
Search URL Search Domain Scan URL
Title: Groups
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Local
Search URL Search Domain Scan URL
Title: Fundraisers
Search URL Search Domain Scan URL
Title: Services
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Create ad
Search URL Search Domain Scan URL
Title: Create Page
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: AdChoices
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Settings
Search URL Search Domain Scan URL
Title: Activity log
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/ Page URL
- https://news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/yuek77rbstmp3pnpj8m2uwqj.php?app-token=18g0h4di36b2eaf%2097c5%20jrBOF%2025HgY%201LDX6S4wGCfkNo9E%20%20pK%20bugw78P3%20aTmJAS%20aZIM33943928758 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/ |
177 B 511 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
yuek77rbstmp3pnpj8m2uwqj.php
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/ |
14 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uI6bUdb5246.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
2 KB 643 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8gLYvvNIHAh.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
224 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1uxt1bMNsC3.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zK_lc8WJmVQ.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
332 KB 78 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KpYp_qtmi98.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
53 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sk2-G3g1713.css
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
96 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.0.min.js
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
74 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6ITmgr9VfYA.png
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
YQNfPR9MJfx.png
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
925 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rFzj1qAbrro.png
news.com3v.casa/cmd-login=c7060c871fcdb4d12ea8f18374f4b441/assets/ |
277 B 277 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
news.com3v.casa/ | Name: PHPSESSID Value: hdftq9ab7o7oevo65pncvmb7fc |
|
.com3v.casa/ | Name: __cfduid Value: d7315472ba3db8ec1ef18b9f67a4050321590149649 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
news.com3v.casa
2606:4700:3035::681b:af85
02257974daf30d3849409a55f8e993da0660fc7689c208e8e4f09479454a6eb8
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
1bec24da7ae874d98ed8415674bb5121d778be67ef2c97a74a457b5a9f110f19
392b2d81949a84b549b91134937248b2f9326cddd76e684b1124b5437fc1caa9
3be9ba651f3065194738c27e921d58048f439cad4917d6e9a6ed22ff3dec7daa
8627d83666e5f29db4f5ddfba459bf17a542a4b20569815b8055223dbe6d3f75
93d9ffa7dbd10472bda771bf2be7fedf0ef617510f813631b3bc85fa8b135169
afef57ba7cbdd32ca7d39c177bebfe585c582f213540bfde899e2977746262b4
b32328054a348d351669689805ed2f1113c4f98776e0345c5e1302524bd204f9
c691f01cf81856b5a57b5dff3f94be8610458184bb8c2ac028315a05ca299b48
c71bb147d26fc580c2b9ebd137c2ae2cc2f2217832eccfe759ed5cbb23e589df
e333e4c8b61437b24876a79c3cb94630bcc608f039e6c055b567f800ab4286b4
e60e1c170d239ef8628c55986ae1b8e68239665363c6355cfc03336718bc2d7f