help2712.facebook-safe.com Open in urlscan Pro
172.67.172.153  Malicious Activity! Public Scan

Submitted URL: https://help2712.facebook-safe.com/
Effective URL: https://help2712.facebook-safe.com/review
Submission Tags: @phishunt_io
Submission: On July 15 via api from DE — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 172.67.172.153, located in United States and belongs to CLOUDFLARENET, US. The main domain is help2712.facebook-safe.com.
TLS certificate: Issued by WE1 on June 30th 2024. Valid for: 3 months.
This is the only time help2712.facebook-safe.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 2 172.67.172.153 13335 (CLOUDFLAR...)
13 209.38.140.128 14061 (DIGITALOC...)
14 2
Apex Domain
Subdomains
Transfer
13 jefanyastore.biz.id
bb.jefanyastore.biz.id
634 KB
2 facebook-safe.com
help2712.facebook-safe.com
3 KB
14 2
Domain Requested by
13 bb.jefanyastore.biz.id help2712.facebook-safe.com
2 help2712.facebook-safe.com 1 redirects
14 2

This site contains links to these domains. Also see Links.

Domain
help4979.facebook-guidelines.com
Subject Issuer Validity Valid
facebook-safe.com
WE1
2024-06-30 -
2024-09-28
3 months crt.sh
bb.jefanyastore.biz.id
R11
2024-07-15 -
2024-10-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://help2712.facebook-safe.com/review
Frame ID: CDF3C76EED45B55511892DA926E71451
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Facebook Restricted

Page URL History Show full URLs

  1. https://help2712.facebook-safe.com/ HTTP 302
    https://help2712.facebook-safe.com/review Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

637 kB
Transfer

1917 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://help2712.facebook-safe.com/ HTTP 302
    https://help2712.facebook-safe.com/review Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request review
help2712.facebook-safe.com/
Redirect Chain
  • https://help2712.facebook-safe.com/
  • https://help2712.facebook-safe.com/review
9 KB
3 KB
Document
General
Full URL
https://help2712.facebook-safe.com/review
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.172.153 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5968d79fe67541efb574b6953c4861c3a294be13d237542e70e9cfa20ba57de8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
7200
alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8a378f6a5b407c25-DEN
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 15 Jul 2024 06:05:20 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nxxF%2FrvR%2B12BQMU%2BbydU8ki2JZOaANvj0o0OXJq26L9OnAeNqTqHhE7rRKUfFe%2BBZhyMLS0rCJmq3XI44kITml%2BL2ioFPL%2BT27KZrplXs0dF36sdhKBP4wTdOEcBGTAu%2BEUCJvD6V199IRxO9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
8a378f6919fb7c25-DEN
content-type
text/html; charset=UTF-8
date
Mon, 15 Jul 2024 06:05:20 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://help2712.facebook-safe.com/review
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=39Lxk%2FyA%2B69ncl0dAtVRxrCjLvjJ86BjGhvUsaPmm5MhGyu4X0lM4go4AWfmkc%2F623UUVc4geZqqy%2Fj2nXd062Aa83GNBuVm2%2Bcjcan0RxdiVE3f%2FtkdJRWHwOa%2B%2BrElNeoO9cJ%2FVkgss9%2FetQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-turbo-charged-by
LiteSpeed
bootstrap.min.css
bb.jefanyastore.biz.id/themes/altum/assets/css/
216 KB
28 KB
Stylesheet
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/css/bootstrap.min.css?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
94e9ffa4a36db6513b07a056e7f9939a90f5dd927a4c5ca6fbd8bb253874861a

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Tue, 09 Jan 2024 20:28:16 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
28464
expires
Mon, 22 Jul 2024 06:05:20 GMT
custom.css
bb.jefanyastore.biz.id/themes/altum/assets/css/
24 KB
6 KB
Stylesheet
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/css/custom.css?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
be6d55c98d308495cb445594f228fa240cec73f8e89a7a5174e7dd1cf4f92aad

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Wed, 24 Jan 2024 20:43:28 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
5392
expires
Mon, 22 Jul 2024 06:05:20 GMT
link-custom.css
bb.jefanyastore.biz.id/themes/altum/assets/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/css/link-custom.css?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
9bb2765c88af42eb266dfdf582b449a1a5e690b03c6ed22d85b6a26cebac1961

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Mon, 20 Nov 2023 17:04:10 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
1118
expires
Mon, 22 Jul 2024 06:05:20 GMT
animate.min.css
bb.jefanyastore.biz.id/themes/altum/assets/css/
70 KB
5 KB
Stylesheet
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/css/animate.min.css?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
721fd25fad2ceea766b483f7692fc840097de75bb54185273920adf62da63e15

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Wed, 02 Dec 2020 16:46:06 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
4830
expires
Mon, 22 Jul 2024 06:05:20 GMT
jquery.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
85 KB
29 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/jquery.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Tue, 12 Sep 2023 15:54:10 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
29739
popper.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
21 KB
7 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/popper.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
b4ef79d3c83a6b1166c2b95c6aee7c66d5aae727d1d70ba7a52478ea13f81baf

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Fri, 15 Dec 2023 14:04:38 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
7191
bootstrap.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
61 KB
14 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/bootstrap.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8c1dea3ffbb8a0974366fc2c7748d4db4f7ff15e0d6d1dc9f18e7d52a366414b

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Wed, 29 Nov 2023 19:33:26 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
14687
custom.js
bb.jefanyastore.biz.id/themes/altum/assets/js/
31 KB
7 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/custom.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
5e692e8f04c50b3c0b53c77f902678d939897e6269cf330f1ec009697507ca45

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Tue, 09 Jan 2024 20:28:10 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
7267
fontawesome.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
56 KB
15 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/fontawesome.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
9d86a276aee130232fa0ef2134c750628acac1072a31e35eb7d65624652f549d

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Tue, 01 Aug 2023 10:27:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
15372
fontawesome-solid.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
807 KB
256 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/fontawesome-solid.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
f9442a526f76a4fad3bc9c7b8e7e7a9041f507649c9c8ca653f8ab4ce0d3dc02

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Tue, 01 Aug 2023 10:27:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
261630
fontawesome-brands.min.js
bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/
465 KB
198 KB
Script
General
Full URL
https://bb.jefanyastore.biz.id/themes/altum/assets/js/libraries/fontawesome-brands.min.js?v=4400
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
a53e31edb30f99af3ca1057b04b78ffd82306614059042531adea8ee830a25e3

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:20 GMT
content-encoding
br
last-modified
Wed, 16 Aug 2023 08:02:58 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
203054
5d7b00c06460b78bfdd4ae79914daba7.png
bb.jefanyastore.biz.id/uploads/block_images/
2 KB
2 KB
Image
General
Full URL
https://bb.jefanyastore.biz.id/uploads/block_images/5d7b00c06460b78bfdd4ae79914daba7.png
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
6806cc93a0f68f0abca63d8969b2dd79af014235ac35b230ac4a7d5a2fa69a6f

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:21 GMT
last-modified
Sun, 30 Jun 2024 07:25:47 GMT
server
LiteSpeed
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
2427
expires
Mon, 22 Jul 2024 06:05:21 GMT
8b4213bb0d8884fcfd69966764701377.png
bb.jefanyastore.biz.id/uploads/block_images/
65 KB
66 KB
Image
General
Full URL
https://bb.jefanyastore.biz.id/uploads/block_images/8b4213bb0d8884fcfd69966764701377.png
Requested by
Host: help2712.facebook-safe.com
URL: https://help2712.facebook-safe.com/review
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.38.140.128 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
579688068d5233880af95e437cd2761356187ca24b446fc02f2719eff5741382

Request headers

Referer
https://help2712.facebook-safe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 15 Jul 2024 06:05:21 GMT
last-modified
Sun, 30 Jun 2024 07:25:47 GMT
server
LiteSpeed
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
67059
expires
Mon, 22 Jul 2024 06:05:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| altum function| $ function| jQuery function| Popper object| bootstrap object| FontAwesomeConfig object| ___FONT_AWESOME___ object| FontAwesome

2 Cookies

Domain/Path Name / Value
help2712.facebook-safe.com/ Name: PHPSESSID
Value: 98e98e87cadc618621b33913da6ee51e
help2712.facebook-safe.com/ Name: s_statistics_23
Value: 0