![](/screenshots/35b15d30-6a15-47f0-be6c-96434c78ee1c.png)
facebookplay.com.br
Open in
urlscan Pro
191.6.202.106
Malicious Activity!
Public Scan
Effective URL: http://facebookplay.com.br/app/?lang=de&key=FA3PFIdLaVH5e3dVTsmkOCxcRQriV9EkJ3DGNYaSzBOXmmfSw4u8lP5no6OQ9p0Epd2MWdDJeW4mWdl...
Submission: On February 19 via automatic, source phishtank
Summary
This is the only time facebookplay.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 191.6.202.106 191.6.202.106 | 28299 (IPV6 Inte...) (IPV6 Internet Ltda) | |
1 | 2a00:1450:400... 2a00:1450:400f:808::200a | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
3 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 | 46.105.201.240 46.105.201.240 | 16276 (OVH ) (OVH ) | |
1 | 208.43.241.181 208.43.241.181 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
1 | 69.4.231.31 69.4.231.31 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
6 | 54.93.77.189 54.93.77.189 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 52.85.89.61 52.85.89.61 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 52.19.114.209 52.19.114.209 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 169.47.30.64 169.47.30.64 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
19 | 10 |
ASN28299 (IPV6 Internet Ltda, BR)
PTR: web1645.kinghost.net
facebookplay.com.br |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: b5.f1.2bd0.ip4.static.sl-reverse.com
s4.histats.com |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: no-rdns.ord02.hostingservicesinc.net
e.dtscout.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-93-77-189.eu-central-1.compute.amazonaws.com
ps.eyeota.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-89-61.jfk6.r.cloudfront.net
n-cdn.areyouahuman.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-19-114-209.eu-west-1.compute.amazonaws.com
bcp.crwdcntrl.net |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 40.1e.2fa9.ip4.static.sl-reverse.com
tags.bluekai.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
eyeota.net
ps.eyeota.net |
1 KB |
3 |
imgur.com
i.imgur.com |
8 KB |
3 |
facebookplay.com.br
facebookplay.com.br |
10 KB |
2 |
histats.com
s10.histats.com s4.histats.com |
4 KB |
1 |
bluekai.com
tags.bluekai.com |
62 B |
1 |
crwdcntrl.net
bcp.crwdcntrl.net |
49 B |
1 |
areyouahuman.com
n-cdn.areyouahuman.com |
45 KB |
1 |
dtscout.com
e.dtscout.com |
2 KB |
1 |
googleapis.com
ajax.googleapis.com |
33 KB |
19 | 9 |
Domain | Requested by | |
---|---|---|
6 | ps.eyeota.net |
facebookplay.com.br
|
3 | i.imgur.com |
facebookplay.com.br
|
3 | facebookplay.com.br |
facebookplay.com.br
|
1 | tags.bluekai.com |
facebookplay.com.br
|
1 | bcp.crwdcntrl.net |
facebookplay.com.br
|
1 | n-cdn.areyouahuman.com |
e.dtscout.com
|
1 | e.dtscout.com |
s4.histats.com
|
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
facebookplay.com.br
|
1 | ajax.googleapis.com |
facebookplay.com.br
|
19 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.histats.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.googleapis.com Google Internet Authority G2 |
2017-02-01 - 2017-04-26 |
3 months | crt.sh |
*.areyouahuman.com Starfield Secure Certificate Authority - G2 |
2016-05-31 - 2019-06-04 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://facebookplay.com.br/app/?lang=de&key=FA3PFIdLaVH5e3dVTsmkOCxcRQriV9EkJ3DGNYaSzBOXmmfSw4u8lP5no6OQ9p0Epd2MWdDJeW4mWdlAWn0V6rtiVrEC6phrfJ0O2cVu8yoHvQJrDsRKwmPri2FtsEwfs5A3EDiaP0qD9cCMdQO3nDJkNVB1VtCc5TKZ0W1idGEiHIQOTb2tUh3Io9bL6NGbJBrxz5P5
Frame ID: 16133.1
Requests: 19 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: try {Histats.start(1,3205176,4,0,0,0,""); Histats.track_hits();} catch(err){};
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request 8- http://ps.eyeota.net/pixel?pid=ml62m40&t=ajs&uid=1FE70445826EA9587F14DC6702DCE23B
- http://ps.eyeota.net/pixel/bounce/?pid=ml62m40&t=ajs&uid=1FE70445826EA9587F14DC6702DCE23B
- http://bcp.crwdcntrl.net/map/c=3825/tp=DTSC/tpid=1FE70445826EA9587F14DC6702DCE23B
- http://bcp.crwdcntrl.net/map/ct=y/c=3825/tp=DTSC/tpid=1FE70445826EA9587F14DC6702DCE23B
- http://tags.bluekai.com/site/27675?id=1FE70445826EA9587F14DC6702DCE23B&ret=html&phint=__bk_t%3DFacebook-Anwendung&phint=__bk_l%3Dhttp%3A%2F%2Ffacebookplay.com.br%2Fapp%2F%3Flang%3Dde%26key%3DFA3PFI...
- http://tags.bluekai.com/site/27675?dt=0&r=559760945&sig=2644227842&bkca=KJhBM1+0QM99HqXs5lDQ/EyVn/9WaHI9VZifzRY9jcQthvJI4UsZiXfzNq77UAR+humbgvg/9O3hEVEG73JiP2BkQa6YGnwQCq936ESnGVv5LYbUgnT/YV/FpRrLf...
- http://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&bid=gdo9o51&newuser=1&google_tc=
- http://ps.eyeota.net/match?bid=gdo9o51&newuser=1&google_gid=CAESEGR5H8MzurLvJPsWQQ1Doz8&google_cver=1
- http://ib.adnxs.com/bounce?%2Fgetuid%3Fhttp%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1
- http://ps.eyeota.net/match?uid=2966027626070411909&bid=2cr76e1
- http://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1
- http://ps.eyeota.net/match?uid=86616a19-c59e-4ec9-aea2-a001cb0bb3a3&bid=1e2n4ou
- http://rtd.tubemogul.com/ct/upi/pid/lons7jax?puid=15a55d7ae25-7e5d0000010f6f47&redir=http%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu&_test=3739448752472069620
- http://ps.eyeota.net/match?uid=3739448752472069620&bid=0rijhbu
- http://dmp.adform.net/serving/cookie/match/?CC=1&party=1009
- http://ps.eyeota.net/match?uid=7789611579146480797&bid=9gdtmu1
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
facebookplay.com.br/app/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
facebookplay.com.br/app/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.2/ |
93 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
E9Fn1cV.png
i.imgur.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LE87vI1.png
i.imgur.com/ |
282 B 282 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js15.js
s10.histats.com/ |
10 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() s4.histats.com/stats/ |
379 B 379 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TopNav-de.PNG
facebookplay.com.br/app/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() e.dtscout.com/e/ |
2 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
ps.eyeota.net/pixel/bounce/ Redirect Chain
|
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ZQp6LCe0OO3LeZB6ES1CZrJvMefQTtT9oZjddBS5
n-cdn.areyouahuman.com/play/ |
144 KB 45 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() bcp.crwdcntrl.net/map/ct=y/c=3825/tp=DTSC/ Redirect Chain
|
49 B 49 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() tags.bluekai.com/site/ Redirect Chain
|
62 B 62 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 70 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 70 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 70 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 70 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
match
ps.eyeota.net/ Redirect Chain
|
70 B 70 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
E9Fn1cV.png
i.imgur.com/ |
4 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
facebookplay.com.br/ | Name: HstCfa3205176 Value: 1487498882186 |
|
facebookplay.com.br/ | Name: PHPSESSID Value: df4d31de97ddd24c7683a1467cb39eb1 |
|
facebookplay.com.br/ | Name: HstCnv3205176 Value: 1 |
|
facebookplay.com.br/ | Name: HstCns3205176 Value: 1 |
|
facebookplay.com.br/ | Name: HstPn3205176 Value: 1 |
|
facebookplay.com.br/ | Name: HstCmu3205176 Value: 1487498882186 |
|
facebookplay.com.br/ | Name: HstCla3205176 Value: 1487498882186 |
|
facebookplay.com.br/ | Name: HstPt3205176 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bcp.crwdcntrl.net
e.dtscout.com
facebookplay.com.br
i.imgur.com
n-cdn.areyouahuman.com
ps.eyeota.net
s10.histats.com
s4.histats.com
tags.bluekai.com
151.101.112.193
169.47.30.64
191.6.202.106
208.43.241.181
2a00:1450:400f:808::200a
46.105.201.240
52.19.114.209
52.85.89.61
54.93.77.189
69.4.231.31
0764e8df21eb8773568f5414a777901b3c3ad882826bdf35e5ce8701974de08e
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3389805dd7c2c6506f6ff6eff63de4703d39b42287f8a2f4521fb65e8b85a1c4
4a886af24144e12a5e7867290b176b60daf7c94bc97c8a56c73ac9f9ec80cf1a
6e4e0f864cd97f68059286b1b6bb7d5c388cb16633060e6e6e73c378e2df4654
948d7d64f3dd7ed7549ceb38e785d355d854a234063732da470565016f611290
b2a9c99239fa0a487f1dc690afab1585a4ea7e79751e60d59d709f496ead4fc5
bcefb905c50005fd3ee1a9d127ab87917fe17874491a4d0ae04dfc0240f4c427
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e7395bf734878a23dc9d5ff4fb6d21e1eae6cfe9c97d6753eb17cd8825745eb1
efda031a4fd71d0bd48a3438d752b037e4b195172b46c0c7f83343f9d48cf8dd
f4616c11e8931accf9b0478e60971a6288b066bd216119f8f3f32407222411cb
f94192ccfe3550eb7b00fafa8bbc7779bc968ca03829077d3d5ea0a57cc88194