![](/screenshots/1ae5cc05-4934-41eb-b365-8b6f4e33ed12.png)
rep-03805122.roenneberg.com
Open in
urlscan Pro
143.95.108.234
Malicious Activity!
Public Scan
Submission: On October 28 via automatic, source openphish
Summary
This is the only time rep-03805122.roenneberg.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 143.95.108.234 143.95.108.234 | 62729 (ASMALLORA...) (ASMALLORANGE1) | |
6 | 2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
2 3 | 2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
9 | 3 |
ASN62729 (ASMALLORANGE1, US)
PTR: ip-143-95-108-234.iplocal
rep-03805122.roenneberg.com |
ASN32934 (FACEBOOK, US)
facebook.com | |
fbcdn.net | |
fbsbx.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
fbcdn.net
1 redirects
static.xx.fbcdn.net fbcdn.net |
48 KB |
2 |
roenneberg.com
rep-03805122.roenneberg.com |
31 KB |
1 |
fbsbx.com
fbsbx.com |
681 B |
1 |
facebook.com
1 redirects
facebook.com |
366 B |
9 | 4 |
Domain | Requested by | |
---|---|---|
6 | static.xx.fbcdn.net |
rep-03805122.roenneberg.com
static.xx.fbcdn.net |
2 | rep-03805122.roenneberg.com |
rep-03805122.roenneberg.com
|
1 | fbsbx.com |
rep-03805122.roenneberg.com
|
1 | fbcdn.net | 1 redirects |
1 | facebook.com | 1 redirects |
9 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
m.facebook.com |
facebook.com |
www.oculus.com |
portal.facebook.com |
pay.facebook.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-09-11 - 2020-12-10 |
3 months | crt.sh |
fbcdn.net DigiCert SHA2 High Assurance Server CA |
2020-10-16 - 2021-01-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://rep-03805122.roenneberg.com/gate.html?location=26a68b469a5928588b196df009974b4b
Frame ID: CB88EACB358A01ABDBA24BA2712CA6B5
Requests: 9 HTTP requests in this frame
25 Outgoing links
These are links going to different origins than the main page.
Title: Important notice! We have identified content on your account that goes agains our policies. Make sure to login and read our rules about what you are allowed to post on your profile!
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: HIDESHOW
Search URL Search Domain Scan URL
Title: Create New Account
Search URL Search Domain Scan URL
Title: Forgot Password?
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: ä¸æ(ç®ä½)
Search URL Search Domain Scan URL
Title: Deutsch
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Pages
Search URL Search Domain Scan URL
Title: Locations
Search URL Search Domain Scan URL
Title: People
Search URL Search Domain Scan URL
Title: Groups
Search URL Search Domain Scan URL
Title: Page Categories
Search URL Search Domain Scan URL
Title: Places
Search URL Search Domain Scan URL
Title: Oculus
Search URL Search Domain Scan URL
Title: Portal
Search URL Search Domain Scan URL
Title: Marketplace
Search URL Search Domain Scan URL
Title: Facebook Pay
Search URL Search Domain Scan URL
Title: Fundraisers
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://facebook.com/security/hsts-pixel.gif?c=3.2 HTTP 302
- https://fbcdn.net/security/hsts-pixel.gif?c=2 HTTP 302
- https://fbsbx.com/security/hsts-pixel.gif
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
gate.html
rep-03805122.roenneberg.com/ |
60 B 318 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myscr908173.js
rep-03805122.roenneberg.com/ |
101 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s0XShOAXyWC.css
static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/ |
89 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
h43SCKgbNeg.css
static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hsts-pixel.gif
fbsbx.com/security/ Redirect Chain
|
43 B 681 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JJsC9S33ata.png
static.xx.fbcdn.net/rsrc.php/v3/yP/r/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EjzW2F-_k3z.png
static.xx.fbcdn.net/rsrc.php/v3/yg/r/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| erp string| em number| tmp function| __updateOrientation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebook.com
fbcdn.net
fbsbx.com
rep-03805122.roenneberg.com
static.xx.fbcdn.net
143.95.108.234
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
32338b3a796b0ee8df97dbe07f7223448831ea3f115ccf52348961a0d0d2a318
39851cf509d8e6142c7e77cc2ee475c50ad358ca3be899954bf17c2155ae49ca
4c8875aaa67ca65c188527d4e6d6313eb32654931b8c6d01a1712bb66462cfde
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5cf6803b140baf8787a91e50c401cf599c08d1d01f20f1a22342e8f961a7765e
75d3c6d209ba05b5769f044544665173d57a7be5426d5ce9982173231aa74e37
91d2477807498e356914242db913f113823a28da7c1bb53ef5f7092626f05cb1
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404