103.157.253.194 Open in urlscan Pro
103.157.253.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/
Effective URL:
http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html
Submission: On June 30 via api (June 30th 2022, 4:02:49 am UTC) from JP — Scanned from JP

Summary HTTP 12 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 103.157.253.194, located in Bangladesh and belongs to CENTURY-AS-AP CENTURY LINK NETWORK, BD. The main domain is 103.157.253.194.

This is the only time 103.157.253.194 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 2	103.157.253.194 103.157.253.194	140954 (CENTURY-A...) (CENTURY-AS-AP CENTURY LINK NETWORK)
4	2a03:2880:f00... 2a03:2880:f00f:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
3 3	2a03:2880:f10... 2a03:2880:f10f:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
12	3

2 103.157.253.194 (Bangladesh) 1 redirects

ASN140954 (CENTURY-AS-AP CENTURY LINK NETWORK, BD)

103.157.253.194	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f00f:8:face:b00c:0:1 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f10f:83:face:b00c:0:25de (Tokyo, Japan) 3 redirects

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fbsbx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 532 Failed fbcdn.net — Cisco Umbrella Rank: 128	26 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	512 B
1	fbsbx.com 1 redirects fbsbx.com — Cisco Umbrella Rank: 984	140 B
1	facebook.com 1 redirects facebook.com — Cisco Umbrella Rank: 29	258 B
12	4

	Domain	Requested by
3	static.xx.fbcdn.net	103.157.253.194
1	connect.facebook.net	103.157.253.194
1	fbsbx.com	1 redirects
1	fbcdn.net	1 redirects
1	facebook.com	1 redirects
12	5

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
ur-pk.facebook.com
ps-af.facebook.com
ar-ar.facebook.com
hi-in.facebook.com
bn-in.facebook.com
pa-in.facebook.com
fa-ir.facebook.com
gu-in.facebook.com
de-de.facebook.com
es-la.facebook.com
messenger.com
l.facebook.com
developers.facebook.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-08` - `2022-07-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html
Frame ID: 517EA144DE8C7058179040F044156629
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook – log in or sign up

Page URL History Show full URLs

http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/ HTTP 302
http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Page URL

Page Statistics

12
Requests

25 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

139 kB
Transfer

453 kB
Size

0
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/recover/initiate?lwv=110
Title: Forgotten account?

Search URL Search Domain Scan URL

URL: https://ur-pk.facebook.com/
Title: اردو

Search URL Search Domain Scan URL

URL: https://ps-af.facebook.com/
Title: پښتو

Search URL Search Domain Scan URL

URL: https://ar-ar.facebook.com/
Title: العربية

Search URL Search Domain Scan URL

URL: https://hi-in.facebook.com/
Title: हिन्दी

Search URL Search Domain Scan URL

URL: https://bn-in.facebook.com/
Title: বাংলা

Search URL Search Domain Scan URL

URL: https://pa-in.facebook.com/
Title: ਪੰਜਾਬੀ

Search URL Search Domain Scan URL

URL: https://fa-ir.facebook.com/
Title: فارسی

Search URL Search Domain Scan URL

URL: https://gu-in.facebook.com/
Title: ગુજરાતી

Search URL Search Domain Scan URL

URL: https://de-de.facebook.com/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://es-la.facebook.com/
Title: Español

Search URL Search Domain Scan URL

URL: https://messenger.com/
Title: Messenger

Search URL Search Domain Scan URL

URL: https://l.facebook.com/l.php?u=http%3A%2F%2Fmomentsapp.com%2F&h=ATNIZaN8D2tD1GFQC_BamYfY3W33toRCr6EevPtfb1eiO0lKly6B0OO7XLRitbB3CNKEQ82LefzZOrSADo_CndXXFfNikx4crbXRPbJ6iB06dbk4vOMvHp1iM3TwV9G1NVxPDg
Title: Moments

Search URL Search Domain Scan URL

URL: https://l.facebook.com/l.php?u=https%3A%2F%2Finstagram.com%2F&h=ATMiHcUgm97M7CJ6zM8XKYhsHcMAed5ol2j6KHWPJIktA-LMdpCU5FCJRvvcd--2pENk0oIHNh3eN1sIHq2GjnEW5wXIfjECw96qBFtYCLYPVavugE5BeL2ZxWd7XqqWGHi_wGTszEgqlIsO084
Title: Instagram

Search URL Search Domain Scan URL

URL: https://developers.facebook.com/?ref=pf
Title: Developers

Search URL Search Domain Scan URL

URL: https://www.facebook.com/help/568137493302217
Title: AdChoices

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/ HTTP 302
http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://facebook.com/security/hsts-pixel.gif?c=3.2.5 HTTP 302
https://fbcdn.net/security/hsts-pixel.gif?c=2.5 HTTP 302
https://fbsbx.com/security/hsts-pixel.gif?c=5 HTTP 302
https://connect.facebook.net/security/hsts-pixel.gif

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.html Show response
103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/
Redirect Chain

http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/
http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html

398 KB
97 KB

122ms
122ms

Document
text/html

103.157.253.194
CENTURY-AS-AP CEN...

General

Check archive.org

Show headers Download Go to

Full URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html
Protocol: HTTP/1.1
Server: 103.157.253.194 , Bangladesh, ASN140954 (CENTURY-AS-AP CENTURY LINK NETWORK, BD),
Reverse DNS
Software: Apache/2.4.46 (Ubuntu) /
Resource Hash: 1db4924a7408e2f5b755185a81bc3f181141e6767144089d9ece8a226ef78658

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 30 Jun 2022 04:02:45 GMT
ETag: "63901-5a2e3f51abf40-gzip"
Keep-Alive: timeout=5, max=99
Last-Modified: Thu, 09 Apr 2020 23:27:17 GMT
Server: Apache/2.4.46 (Ubuntu)
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Jun 2022 04:02:45 GMT
Keep-Alive: timeout=5, max=100
Location: login.html
Server: Apache/2.4.46 (Ubuntu)

GET n-x967WX9c1.css
static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/ 0
0

GET E8ZGvemHznZ.css
static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/ 0
0

GET pzL_2NXL9xq.css
static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/ 0
0

GET VBZRBIO9qDA.css
static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/ 0
0

GET GluiuD07pSP.css
static.xx.fbcdn.net/rsrc.php/v3/ys/l/0,cross/ 0
0

GET Ves8UuZh5kk.css
static.xx.fbcdn.net/rsrc.php/v3/yd/l/0,cross/ 0
0

GET
H2 200 lZ86cv9aR90.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ 40 KB
26 KB 13ms
6ms Stylesheet
text/css 2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/lZ86cv9aR90.css

Requested by

Host: 103.157.253.194
URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5ac13ac4530094bf65f94168b095f12321be9ee5d0b0040122fcdf50f5c68822

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://103.157.253.194/
Origin: http://103.157.253.194
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 04:02:45 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: uMXuAVCcY1sq6iyJyd098Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26015
x-fb-rlafr: 0
x-fb-debug: iAVRk8imi9OyIaO3NNGefW8aaiv/cr/qEV7mjilBvi5WSvtiZ6nifKtYhtNLIA57y8dq5jVMManNKWIcZxbdQA==
x-fb-trip-id: 382461245
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Thu, 29 Jun 2023 19:17:27 GMT

GET yOlOv-u6_Df.js
static.xx.fbcdn.net/rsrc.php/v3/yu/r/ 0
0

GET
H3 404 GwFs3_KxNjS.png
static.xx.fbcdn.net/rsrc.php/v3/yc/r/ 0
0 6ms
2ms Image
text/html 2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/GwFs3_KxNjS.png
Requested by: Host: 103.157.253.194
URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://103.157.253.194/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 GsNJNwuI-UM.gif
static.xx.fbcdn.net/rsrc.php/v3/yb/r/ 522 B
573 B 2ms
2ms Image
image/gif 2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/GsNJNwuI-UM.gif

Requested by

Host: 103.157.253.194
URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7f4fbb61e5a1226b421109d4bfeb68b371b240bb6a0131c54581b777cb649908

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://103.157.253.194/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 30 Jun 2022 04:02:45 GMT
x-content-type-options: nosniff
content-md5: cH2zTAVPHVXw/aQfDhS/Bg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 522
x-fb-rlafr: 0
x-fb-debug: ic18AdhvkIb0iGIxDDxIkjZLX52qW9ft07US1JxMss7r1pS8DCFdosps8n6YV2h5IJc4YXfVXwwdSJ8RKgsFZg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 21 Jun 2023 22:39:16 GMT

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773

Request headers

Referer
Origin: http://103.157.253.194
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: font/opentype

GET
H2

200

hsts-pixel.gif
connect.facebook.net/security/
Redirect Chain

https://facebook.com/security/hsts-pixel.gif?c=3.2.5
https://fbcdn.net/security/hsts-pixel.gif?c=2.5
https://fbsbx.com/security/hsts-pixel.gif?c=5
https://connect.facebook.net/security/hsts-pixel.gif

43 B
512 B

8ms
2ms

Image
image/gif

2a03:2880:f00f:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://connect.facebook.net/security/hsts-pixel.gif

Requested by

Host: 103.157.253.194
URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html

Protocol

Server

2a03:2880:f00f:8:face:b00c:0:1 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://103.157.253.194/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 57
x-xss-protection: 0
pragma: no-cache
x-fb-debug: mWqtw1Q/lagRkeEjhGY0O/U0tQixi6Y2r/Bso14Jl4tFQvLbEdC11inNhg2VEP6cHWKsxhqhyq8de7swnuG/2w==
x-fb-trip-id: 382461245
x-frame-options: DENY
date: Thu, 30 Jun 2022 04:02:46 GMT
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

x-fb-debug: Fcg3aCmkloutzKWfqUvTeaDqKys0zzEiauBdGo5l3hWg/twKV7zprgGHQczPhmcnJL5LP0HdPzcmEeJo+sO4Pg==
location: https://connect.facebook.net/security/hsts-pixel.gif
date: Thu, 30 Jun 2022 04:02:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: text/html; charset="utf-8"
access-control-allow-origin: *
priority: u=3,i
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/n-x967WX9c1.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/E8ZGvemHznZ.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/pzL_2NXL9xq.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/VBZRBIO9qDA.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/ys/l/0,cross/GluiuD07pSP.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yd/l/0,cross/Ves8UuZh5kk.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yu/r/yOlOv-u6_Df.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/n-x967WX9c1.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yv/l/0,cross/n-x967WX9c1.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/E8ZGvemHznZ.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/E8ZGvemHznZ.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/pzL_2NXL9xq.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/pzL_2NXL9xq.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/VBZRBIO9qDA.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0,cross/VBZRBIO9qDA.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/ys/l/0,cross/GluiuD07pSP.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/ys/l/0,cross/GluiuD07pSP.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yd/l/0,cross/Ves8UuZh5kk.css' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yd/l/0,cross/Ves8UuZh5kk.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://103.157.253.194/HYfsgdknDioasjfADhaf/SocialPhish-master/sites/facebook/login.html Message: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yu/r/yOlOv-u6_Df.js' from origin 'http://103.157.253.194' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yu/r/yOlOv-u6_Df.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/GwFs3_KxNjS.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
facebook.com
fbcdn.net
fbsbx.com
static.xx.fbcdn.net
static.xx.fbcdn.net
103.157.253.194
2a03:2880:f00f:8:face:b00c:0:1
2a03:2880:f10f:83:face:b00c:0:25de
1db4924a7408e2f5b755185a81bc3f181141e6767144089d9ece8a226ef78658
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5ac13ac4530094bf65f94168b095f12321be9ee5d0b0040122fcdf50f5c68822
7f4fbb61e5a1226b421109d4bfeb68b371b240bb6a0131c54581b777cb649908
9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

103.157.253.194 Open in urlscan Pro 103.157.253.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

25 %HTTPS

67 %IPv6

4 Domains

5 Subdomains

3 IPs

2 Countries

139 kBTransfer

453 kBSize

0 Cookies

17 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

15 Console Messages

Indicators

103.157.253.194 Open in urlscan Pro
103.157.253.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

25 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

139 kB
Transfer

453 kB
Size

0
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!