facebookcopyrightviolations.com

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 6 HTTP transactions. The main IP is 193.31.119.131, located in Turkey and belongs to ONLINENET, TR. The main domain is facebookcopyrightviolations.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 20th 2020. Valid for: 3 months.

This is the only time facebookcopyrightviolations.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	193.31.119.131 193.31.119.131	202505 (ONLINENET) (ONLINENET)
1	2606:4700:303... 2606:4700:3035::6818:6e7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	213.159.7.92 213.159.7.92	42807 (AEROTEK-AS) (AEROTEK-AS)
1	89.252.181.178 89.252.181.178	51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2606:4700:10:... 2606:4700:10::6816:808	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	6

1 193.31.119.131 (Turkey)

ASN202505 (ONLINENET, TR)
PTR: 193.31.119.131

facebookcopyrightviolations.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6818:6e7f (United States)

ASN13335 (CLOUDFLARENET, US)

resimag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.159.7.92 (Turkey)

ASN42807 (AEROTEK-AS, TR)
PTR: srv.pazarlamasyon.com

pazarlamasyon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.252.181.178 (Turkey)

ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)
PTR: 1789thgow.guzel.net.tr

www.lgdestek.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:808 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.reamaze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	reamaze.com cdn.reamaze.com	7 KB
1	wikimedia.org upload.wikimedia.org	62 KB
1	lgdestek.net www.lgdestek.net	71 KB
1	pazarlamasyon.com pazarlamasyon.com	511 KB
1	resimag.com resimag.com	12 KB
1	facebookcopyrightviolations.com facebookcopyrightviolations.com	2 KB
6	6

	Domain	Requested by
1	cdn.reamaze.com	facebookcopyrightviolations.com
1	upload.wikimedia.org	facebookcopyrightviolations.com
1	www.lgdestek.net	facebookcopyrightviolations.com
1	pazarlamasyon.com	facebookcopyrightviolations.com
1	resimag.com	facebookcopyrightviolations.com
1	facebookcopyrightviolations.com
6	6

This site contains links to these domains. Also see Links.

Domain
instagram.com
help.instagram.com

Subject Issuer	Validity	Valid
facebookcopyrightviolations.com Let's Encrypt Authority X3	`2020-10-20` - `2021-01-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-07` - `2021-07-07`	a year	crt.sh
mail.pazarlamasyon.com Let's Encrypt Authority X3	`2020-09-02` - `2020-12-01`	3 months	crt.sh
*.lgdestek.net Let's Encrypt Authority X3	`2020-09-04` - `2020-12-03`	3 months	crt.sh
*.wikipedia.org Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.reamaze.com Go Daddy Secure Certificate Authority - G2	`2019-06-16` - `2021-08-15`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://facebookcopyrightviolations.com/
Frame ID: 9B81E661A5B2CFD0EAFB02C35926D9AF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

666 kB
Transfer

902 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://instagram.com/about/us/
Title: About us

Search URL Search Domain Scan URL

URL: https://help.instagram.com/
Title: Help

Search URL Search Domain Scan URL

URL: https://instagram.com/developers/
Title: API

Search URL Search Domain Scan URL

URL: https://instagram.com/about/jobs/
Title: Jobs

Search URL Search Domain Scan URL

URL: https://instagram.com/legal/terms/
Title: Terms

Search URL Search Domain Scan URL

URL: https://instagram.com/legal/privacy/
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
facebookcopyrightviolations.com/ 5 KB
2 KB 386ms
82ms Document
text/html 193.31.119.131
ONLINENET

General

Check archive.org

Show headers Download Go to

Full URL: https://facebookcopyrightviolations.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 193.31.119.131 , Turkey, ASN202505 (ONLINENET, TR),
Reverse DNS: 193.31.119.131
Software: nginx / PHP/7.4.11 PleskLin
Resource Hash: b87e213d8185e188f83b79b56e7c76f039c0bfa87f5a0ca3ed9b0f3532ff54ed

Request headers

:method: GET
:authority: facebookcopyrightviolations.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 20 Oct 2020 16:56:21 GMT
content-type: text/html; charset=UTF-8
content-length: 1825
x-powered-by: PHP/7.4.11 PleskLin
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 819f2f28aae.png
resimag.com/p1/ 12 KB
12 KB 87ms
59ms Image
image/png 2606:4700:3035::6818:6e7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resimag.com/p1/819f2f28aae.png
Requested by: Host: facebookcopyrightviolations.com
URL: https://facebookcopyrightviolations.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:6e7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 4fa2ab8d30839e0bcf39b86ab9baadb042446e3a545df968c20f92dae851097e

Request headers

Referer: https://facebookcopyrightviolations.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 16:56:21 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
status: 200
content-length: 11984
cf-request-id: 05e889ccbd00002b4d9984a000000001
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603212981"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
cf-ray: 5e54458dfc6f2b4d-FRA
expires: Mon, 10 Apr 1972 00:00:00 GMT

GET
H2 200 facebook_wordmark.gif
pazarlamasyon.com/wp-content/uploads/2019/11/ 747 KB
511 KB 227ms
70ms Image
image/gif 213.159.7.92
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pazarlamasyon.com/wp-content/uploads/2019/11/facebook_wordmark.gif
Requested by: Host: facebookcopyrightviolations.com
URL: https://facebookcopyrightviolations.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.159.7.92 , Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS: srv.pazarlamasyon.com
Software: LiteSpeed /
Resource Hash: 4219fda6230b2e999d5b51e25805fe69ce85b172197bbda7eaa8b8879a33b54b

Request headers

Referer: https://facebookcopyrightviolations.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 16:56:21 GMT
content-encoding: br
last-modified: Tue, 05 Nov 2019 10:04:55 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length: 523215
expires: Tue, 27 Oct 2020 16:56:21 GMT

GET
H/1.1 200
OK facebook-696x201.png
www.lgdestek.net/wp-content/uploads/2017/04/ 71 KB
71 KB 299ms
90ms Image
image/png 89.252.181.178
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lgdestek.net/wp-content/uploads/2017/04/facebook-696x201.png
Requested by: Host: facebookcopyrightviolations.com
URL: https://facebookcopyrightviolations.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 89.252.181.178 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: 1789thgow.guzel.net.tr
Software: Apache /
Resource Hash: 9624ecca26675389335bc5532bd83a6ba97643f0e91d4eee634008b00bb7d0ae

Request headers

Referer: https://facebookcopyrightviolations.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 20 Oct 2020 16:56:21 GMT
Last-Modified: Thu, 27 Apr 2017 14:08:48 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=2592000, public
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 72367
Expires: max-age=2592000, public

GET
H2 200 1200px-Instagram_new.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/ 62 KB
62 KB 54ms
25ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/1200px-Instagram_new.svg.png

Requested by

Host: facebookcopyrightviolations.com
URL: https://facebookcopyrightviolations.com/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

Referer: https://facebookcopyrightviolations.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 14:56:55 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 7166
x-cache-status: hit-front
x-cache: cp3055 hit, cp3061 hit/5
status: 200
server-timing: cache;desc="hit-front"
content-length: 63143
x-client-ip: 2a01:4f8:192:5414::2
last-modified: Sun, 24 Dec 2017 17:19:39 GMT
server: ATS/8.0.8
etag: 24ae7140ef6bb03a33a8ea6e36a55775
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
x-timestamp: 1514135978.13911
accept-ranges: bytes
timing-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

GET
H2 200 facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.png
cdn.reamaze.com/assets/site/integrations/ 6 KB
7 KB 46ms
20ms Image
image/webp 2606:4700:10::6816:808
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.reamaze.com/assets/site/integrations/facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.png
Requested by: Host: facebookcopyrightviolations.com
URL: https://facebookcopyrightviolations.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:808 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 702caf42f0bd2dcce73d18d6109dd14d7b3f2d8a07fd830566d7f743d3205fde

Request headers

Referer: https://facebookcopyrightviolations.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 16:56:21 GMT
cf-cache-status: HIT
age: 153303
cf-polished: origFmt=png, origSize=7669
status: 200
content-disposition: inline; filename="facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.webp"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6454
cf-request-id: 05e889ccbc00002c22c908e000000001
last-modified: Thu, 03 Oct 2019 18:16:42 GMT
server: cloudflare
etag: "1df5-59405965d5680"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: max-age=604800, public
accept-ranges: bytes
cf-ray: 5e54458dfda42c22-FRA
cf-bgj: imgq:100,h2pri

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.reamaze.com
facebookcopyrightviolations.com
pazarlamasyon.com
resimag.com
upload.wikimedia.org
www.lgdestek.net
193.31.119.131
213.159.7.92
2606:4700:10::6816:808
2606:4700:3035::6818:6e7f
2620:0:862:ed1a::2:b
89.252.181.178
4219fda6230b2e999d5b51e25805fe69ce85b172197bbda7eaa8b8879a33b54b
4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497
4fa2ab8d30839e0bcf39b86ab9baadb042446e3a545df968c20f92dae851097e
702caf42f0bd2dcce73d18d6109dd14d7b3f2d8a07fd830566d7f743d3205fde
9624ecca26675389335bc5532bd83a6ba97643f0e91d4eee634008b00bb7d0ae
b87e213d8185e188f83b79b56e7c76f039c0bfa87f5a0ca3ed9b0f3532ff54ed

facebookcopyrightviolations.com Open in urlscan Pro 193.31.119.131 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

666 kBTransfer

902 kBSize

0 Cookies

6 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

facebookcopyrightviolations.com Open in urlscan Pro
193.31.119.131 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

666 kB
Transfer

902 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!