urlscan.io logo urlscan.io
SecurityTrails logo

rsctrccheckpoint-001-site1.htempurl.com Open in urlscan Pro
205.144.171.114  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
Submission: On January 09 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 205.144.171.114, located in United States and belongs to WEBWEB-HK International Trade Centre, HK. The main domain is rsctrccheckpoint-001-site1.htempurl.com.
This is the only time rsctrccheckpoint-001-site1.htempurl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
3 205.144.171.114 55778 (WEBWEB-HK...)
1 2a03:2880:f01... 32934 (FACEBOOK)
4 3
Apex Domain
Subdomains		 Transfer
3 htempurl.com
rsctrccheckpoint-001-site1.htempurl.com
177 KB
1 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 770
10 KB
4 2
Domain Requested by
3 rsctrccheckpoint-001-site1.htempurl.com rsctrccheckpoint-001-site1.htempurl.com
1 static.xx.fbcdn.net
4 2

This site contains no links.

Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-10-19 -
2024-01-17		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
Frame ID: ACF0C1BB83C5DF8B43CB26EC127A3DEB
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Community Standard

Page Statistics

4
Requests

25 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

187 kB
Transfer

609 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request verify.html
rsctrccheckpoint-001-site1.htempurl.com/ 		27 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
Protocol
HTTP/1.1
Server
205.144.171.114 , United States, ASN55778 (WEBWEB-HK International Trade Centre, HK),
Reverse DNS
205-144-171-114.alchemy.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
38d1e576b4cacfb31bddbecdac81f8316bb913bb956a060548b8215dc20812d2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,max-age=31536000
Content-Encoding
gzip
Content-Length
5069
Content-Type
text/html
Date
Tue, 09 Jan 2024 19:15:45 GMT
ETag
"0f060d94937da1:0"
Last-Modified
Mon, 25 Dec 2023 15:48:48 GMT
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-Powered-By
ASP.NET
hidden.css
rsctrccheckpoint-001-site1.htempurl.com/css/cross/ 		12 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://rsctrccheckpoint-001-site1.htempurl.com/css/cross/hidden.css
Requested by
Host: rsctrccheckpoint-001-site1.htempurl.com
URL: http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
Protocol
HTTP/1.1
Server
205.144.171.114 , United States, ASN55778 (WEBWEB-HK International Trade Centre, HK),
Reverse DNS
205-144-171-114.alchemy.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
bfe5cd76647e20b420da958c1a6d56eaa9d452584a76981ce897aea8a0d163b4

Request headers

accept-language
en-US,en;q=0.9
Referer
http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Tue, 09 Jan 2024 19:15:46 GMT
Content-Encoding
gzip
Last-Modified
Sat, 07 Oct 2023 09:14:42 GMT
Server
Microsoft-IIS/10.0
ETag
"06da1b4fef8d91:0"
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
no-cache,max-age=31536000
Accept-Ranges
bytes
Content-Length
3356
hidden_2.css
rsctrccheckpoint-001-site1.htempurl.com/css/cross/ 		560 KB
168 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://rsctrccheckpoint-001-site1.htempurl.com/css/cross/hidden_2.css
Requested by
Host: rsctrccheckpoint-001-site1.htempurl.com
URL: http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
Protocol
HTTP/1.1
Server
205.144.171.114 , United States, ASN55778 (WEBWEB-HK International Trade Centre, HK),
Reverse DNS
205-144-171-114.alchemy.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
84ac2481a5e38d5a974ce16f8d55dc322d38f6e021e4a45a9580091fb0aa6bd3

Request headers

accept-language
en-US,en;q=0.9
Referer
http://rsctrccheckpoint-001-site1.htempurl.com/verify.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Tue, 09 Jan 2024 19:15:46 GMT
Content-Encoding
gzip
Last-Modified
Sat, 07 Oct 2023 09:14:34 GMT
Server
Microsoft-IIS/10.0
ETag
"0b9dcaffef8d91:0"
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
no-cache,max-age=31536000
Accept-Ranges
bytes
truncated
/ 		135 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2128b5b8a9ea02f0830a3b22c37023dae3f287e7ef5d91fbb4ff535c6b30675

Request headers

accept-language
en-US,en;q=0.9
Referer
http://rsctrccheckpoint-001-site1.htempurl.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/png
AFgIDquDCzO.png
static.xx.fbcdn.net/rsrc.php/v3/yW/r/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/AFgIDquDCzO.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
75f3b8678d645bcc0a408b36b9c7431d5143b69319eb66323e56cece40c5f136
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
http://rsctrccheckpoint-001-site1.htempurl.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
date
Tue, 09 Jan 2024 19:15:46 GMT
x-content-type-options
nosniff
content-md5
wwDJTBESOcMjOc9rqWHhag==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
9374
reporting-endpoints
x-fb-debug
pfVx12ktzXBEYSi3ryj6fXlEtj75dBszv9/Zfh+csaqaouEcFuufXuQ6c6APUQqR/BJSbAxUkVaaqpTUhjQH1w==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Mon, 30 Dec 2024 22:04:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies