facebook-security.derecoverfb.ml
Open in
urlscan Pro
45.63.43.190
Malicious Activity!
Public Scan
Submission Tags: @phishunt_io
Submission: On January 27 via api from ES
Summary
TLS certificate: Issued by R3 on January 26th 2021. Valid for: 3 months.
This is the only time facebook-security.derecoverfb.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 45.63.43.190 45.63.43.190 | 20473 (AS-CHOOPA) (AS-CHOOPA) | |
3 | 2620:100:6021... 2620:100:6021:15::a27d:410f | 19679 (DROPBOX) (DROPBOX) | |
8 | 2 |
ASN20473 (AS-CHOOPA, US)
PTR: 45.63.43.190.vultr.com
facebook-security.derecoverfb.ml |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
derecoverfb.ml
facebook-security.derecoverfb.ml |
95 KB |
3 |
dropboxusercontent.com
dl.dropboxusercontent.com |
4 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
5 | facebook-security.derecoverfb.ml |
facebook-security.derecoverfb.ml
|
3 | dl.dropboxusercontent.com |
facebook-security.derecoverfb.ml
dl.dropboxusercontent.com |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
facebook-security.derecoverfb.ml R3 |
2021-01-26 - 2021-04-26 |
3 months | crt.sh |
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-01-19 - 2022-02-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://facebook-security.derecoverfb.ml/verification-login.html
Frame ID: 8787AC19B3455706F8FBBA7C063FE482
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
UNIX (Operating Systems) ExpandDetected patterns
- headers server /Unix/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
verification-login.html
facebook-security.derecoverfb.ml/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
internationalFB.css
dl.dropboxusercontent.com/s/8t1baw55x0gac9q/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
responsiveFB.css
dl.dropboxusercontent.com/s/nb32s7l135g96dd/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
security.png
facebook-security.derecoverfb.ml/img/ |
76 KB 76 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icoacc.png
facebook-security.derecoverfb.ml/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icoemail.png
facebook-security.derecoverfb.ml/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icopass.png
facebook-security.derecoverfb.ml/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_gold.png
dl.dropboxusercontent.com/u/264508472/fb-img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| mousedwn0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dl.dropboxusercontent.com
facebook-security.derecoverfb.ml
2620:100:6021:15::a27d:410f
45.63.43.190
0ac13aa673c18427731f09e7a900cf0f56412f33f4d0c47503d7a71c0388ea15
68d3b61b622735e303f413c81a04ca7893bb33f27cba7c30ff27b64e18ee36ab
79582839a6395af914e3765d5e06f25b2ee338359e1098651316cff341b29e72
7cf13e6a600acbc20d86aeffa2a33ab15b34a131d5bcfc1f9417ffb383af17d3
c13aae5de1f6df57c1a22983589ae139e58f622bc143f3e4bed36451dc1de533
cb93648d77c73dc5eb0dd576bc21dfba41d04bdd93a91fd3b0103220f1d8039d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcc7ebe9ed903253612b02b94a68102296ca0d821505fd2118cdd7d044e1487b