urlscan.io logo urlscan.io
SecurityTrails logo

s-facebook.ramurai.com Open in urlscan Pro
192.185.48.237  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://s-facebook.ramurai.com/
Submission: On June 26 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 14 HTTP transactions. The main IP is 192.185.48.237, located in United States and belongs to OIS1, US. The main domain is s-facebook.ramurai.com.
TLS certificate: Issued by R3 on June 11th 2021. Valid for: 3 months.
This is the only time s-facebook.ramurai.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

1    192.185.48.237 (United States)

ASN26337 (OIS1, US)
PTR: ragopersonnel.com
s-facebook.ramurai.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net
connect.facebook.net
3    2001:559:800c:1903:face:b00c:0:a7 (Washington, United States)

ASN7922 (COMCAST-7922, US)
scontent.fhou1-1.fna.fbcdn.net
3    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
facebook.com
fbcdn.net
fbsbx.com
Domain Requested by
3 scontent.fhou1-1.fna.fbcdn.net s-facebook.ramurai.com
2 static.xx.fbcdn.net s-facebook.ramurai.com
1 connect.facebook.net s-facebook.ramurai.com
1 fbsbx.com 1 redirects
1 fbcdn.net 1 redirects
1 facebook.com 1 redirects
1 s-facebook.ramurai.com
14 7
Subject Issuer Validity Valid
www.ramosvera.ramurai.com
R3		 2021-06-11 -
2021-09-09		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-05-26 -
2021-08-24		 3 months crt.sh
*.fhou1-1.fna.fbcdn.net
DigiCert SHA2 High Assurance Server CA		 2021-05-13 -
2021-08-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://s-facebook.ramurai.com/
Frame ID: 26C65DB7E7439EFBF16F4B5F119E42A6
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

50 %
HTTPS

75 %
IPv6

5
Domains

7
Subdomains

4
IPs

2
Countries

151 kB
Transfer

409 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14
  • https://facebook.com/security/hsts-pixel.gif?c=3.2.5 HTTP 302
  • https://fbcdn.net/security/hsts-pixel.gif?c=2.5 HTTP 302
  • https://fbsbx.com/security/hsts-pixel.gif?c=5 HTTP 302
  • https://connect.facebook.net/security/hsts-pixel.gif

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
s-facebook.ramurai.com/ 		339 KB
95 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.48.237 , United States, ASN26337 (OIS1, US),
Reverse DNS
ragopersonnel.com
Software
Apache /
Resource Hash
a98c47c4858d51480b93772e422b91c56878dc4f6606f486d95bc591dda86bf0

Request headers

:method
GET
:authority
s-facebook.ramurai.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 26 Jun 2021 13:19:47 GMT
server
Apache
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html; charset=UTF-8
j-S2lJ1EIBn.css
static.xx.fbcdn.net/rsrc.php/v3/yz/l/0,cross/ 		0
0
5_A59j0V9mP.css
static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/ 		0
0
Wwyx-jMImRK.css
static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/ 		0
0
XtUOiMjA_C9.css
static.xx.fbcdn.net/rsrc.php/v3/yI/l/0,cross/ 		0
0
HbRvWLo2Xj2.css
static.xx.fbcdn.net/rsrc.php/v3/yn/l/0,cross/ 		0
0
DvYv2gza1Ql.css
static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/ 		0
0
lZ86cv9aR90.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ 		40 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/lZ86cv9aR90.css
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1439c1be01bb64ee1637aa31db97be05ca4b34c415750168aa44b3a0c30965ea
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://s-facebook.ramurai.com
Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 26 Jun 2021 13:19:48 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
7wy0Q6fd+RfBVOOTm5N2jg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
26000
x-fb-rlafr
0
x-fb-debug
owde+/2q6xhfbTTg6uw6DAXvvhxQfRlmPDMPkND6s7KwXr2LCZVRlZaPhV/J5CSPGMdlvTiH0HeNwaghxf/N+w==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Fri, 17 Jun 2022 01:54:20 GMT
2kGEHwT_lZu.js
static.xx.fbcdn.net/rsrc.php/v3/yd/r/ 		0
0
851565_602269956474188_918638970_n.png
scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/ 		21 B
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/851565_602269956474188_918638970_n.png?oh=6f3dd15f3b723df9818b66d8e567aa70&oe=5AFD68F5
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:559:800c:1903:face:b00c:0:a7 Washington, United States, ASN7922 (COMCAST-7922, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
16366d2552aa8349747c1168a3ef03665652b08d80385b6664c4cbf6a5b2f932

Request headers

Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 26 Jun 2021 13:19:48 GMT
server
proxygen-bolt
content-length
21
content-type
text/plain
851585_216271631855613_2121533625_n.png
scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/ 		21 B
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/851585_216271631855613_2121533625_n.png?oh=7a437b0bae2ba8efc157cf6564ce1440&oe=5ADC6020
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:559:800c:1903:face:b00c:0:a7 Washington, United States, ASN7922 (COMCAST-7922, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
16366d2552aa8349747c1168a3ef03665652b08d80385b6664c4cbf6a5b2f932

Request headers

Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 26 Jun 2021 13:19:48 GMT
server
proxygen-bolt
content-length
21
content-type
text/plain
851558_160351450817973_1678868765_n.png
scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/ 		21 B
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://scontent.fhou1-1.fna.fbcdn.net/v/t39.2365-6/851558_160351450817973_1678868765_n.png?oh=99b4fea69ea83da0ec9b931409452d6f&oe=5AE536D8
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:559:800c:1903:face:b00c:0:a7 Washington, United States, ASN7922 (COMCAST-7922, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
16366d2552aa8349747c1168a3ef03665652b08d80385b6664c4cbf6a5b2f932

Request headers

Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 26 Jun 2021 13:19:48 GMT
server
proxygen-bolt
content-length
21
content-type
text/plain
truncated
/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773

Request headers

Origin
https://s-facebook.ramurai.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
font/opentype
truncated
/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2d6c37860b6e4a1610879d5b3d4a80310eaa63e533641d77e2903e48e2e5dc87

Request headers

Origin
https://s-facebook.ramurai.com
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
font/opentype
GsNJNwuI-UM.gif
static.xx.fbcdn.net/rsrc.php/v3/yb/r/ 		522 B
572 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/GsNJNwuI-UM.gif
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7f4fbb61e5a1226b421109d4bfeb68b371b240bb6a0131c54581b777cb649908
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug
4TFwLLkpseFv57D7y1VZpoatR0hSFkud1Gi+ooMy4X+5tIBckIG7JTpcrOl2+kMACLIuzS1XzX2ze/fY7xFNfQ==
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
cH2zTAVPHVXw/aQfDhS/Bg==
date
Sat, 26 Jun 2021 13:19:48 GMT
content-type
image/gif
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
content-length
522
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
x-fb-rlafr
0
expires
Wed, 15 Jun 2022 04:08:19 GMT
hsts-pixel.gif
connect.facebook.net/security/
Redirect Chain
  • https://facebook.com/security/hsts-pixel.gif?c=3.2.5
  • https://fbcdn.net/security/hsts-pixel.gif?c=2.5
  • https://fbsbx.com/security/hsts-pixel.gif?c=5
  • https://connect.facebook.net/security/hsts-pixel.gif
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://connect.facebook.net/security/hsts-pixel.gif
Requested by
Host: s-facebook.ramurai.com
URL: https://s-facebook.ramurai.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://s-facebook.ramurai.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
57
x-xss-protection
0
pragma
no-cache
x-fb-debug
VrVjmLECAhgvJqrxfht7hlkOLV9cC7p8knSXKAP2K6KxtvUw2geHgYsDcUFBipS2KvuQsjLPLLSDnPXo3FBulg==
x-fb-trip-id
686109401
x-frame-options
DENY
date
Sat, 26 Jun 2021 13:19:48 GMT
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

x-fb-debug
bac5luxoFIsJUyAXEaUexY4rS47VJTxSVzk4WHmtPYvK3Jbn/08yC++cWy2JcmnxOK9BigI85h6ZYCnh6pVeFQ==
location
https://connect.facebook.net/security/hsts-pixel.gif
date
Sat, 26 Jun 2021 13:19:48 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
text/html; charset="utf-8"
access-control-allow-origin
*
priority
u=3,i
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yz/l/0,cross/j-S2lJ1EIBn.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/5_A59j0V9mP.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/Wwyx-jMImRK.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yI/l/0,cross/XtUOiMjA_C9.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yn/l/0,cross/HbRvWLo2Xj2.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/DvYv2gza1Ql.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/2kGEHwT_lZu.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| _cstart function| envFlush object| Env number| __DEV__ function| CavalryLogger undefined| bigPipe

0 Cookies