facebook.help-2020656812201647901.com Open in urlscan Pro
192.236.209.91 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://facebook.help-2020656812201647901.com/
Effective URL:
https://facebook.help-2020656812201647901.com/
Submission: On July 07 via automatic, source openphish (July 7th 2022, 12:24:30 am UTC) — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 192.236.209.91, located in United States and belongs to HOSTWINDS, US. The main domain is facebook.help-2020656812201647901.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 6th 2022. Valid for: 3 months.

This is the only time facebook.help-2020656812201647901.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 13	192.236.209.91 192.236.209.91	54290 (HOSTWINDS) (HOSTWINDS)
2	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
17	5

13 192.236.209.91 (United States) 1 redirects

ASN54290 (HOSTWINDS, US)
PTR: client-192-236-209-91.hostwindsdns.com

facebook.help-2020656812201647901.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	help-2020656812201647901.com 1 redirects facebook.help-2020656812201647901.com	237 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 429	402 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 71	1 KB
17	4

	Domain	Requested by
13	facebook.help-2020656812201647901.com	1 redirects facebook.help-2020656812201647901.com
2	fonts.gstatic.com	fonts.googleapis.com
2	cdn.jsdelivr.net	facebook.help-2020656812201647901.com cdn.jsdelivr.net
1	fonts.googleapis.com	facebook.help-2020656812201647901.com
17	4

This site contains no links.

Subject Issuer	Validity	Valid
facebook.help-2020656812201647901.com cPanel, Inc. Certification Authority	`2022-07-06` - `2022-10-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://facebook.help-2020656812201647901.com/
Frame ID: 2194140F81F935955C7EA8FACF7FD617
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pages | Facebook Help Centre

Page URL History Show full URLs

http://facebook.help-2020656812201647901.com/ HTTP 301
https://facebook.help-2020656812201647901.com/ Page URL

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

672 kB
Transfer

1244 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://facebook.help-2020656812201647901.com/ HTTP 301
https://facebook.help-2020656812201647901.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
facebook.help-2020656812201647901.com/
Redirect Chain

http://facebook.help-2020656812201647901.com/
https://facebook.help-2020656812201647901.com/

1 KB
538 B

84ms
16ms

Document
text/html

192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help-2020656812201647901.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: ec6239ecee4cbb1a3b5d90273389068d6a4017c2c246301f428cdf45f9dc28e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 423
content-type: text/html
date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Wed, 18 May 2022 00:57:42 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 254
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 07 Jul 2022 00:24:26 GMT
Keep-Alive: timeout=5, max=10000
Location: https://facebook.help-2020656812201647901.com/
Server: Apache

GET
H2 200 materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/ 298 KB
49 KB 64ms
27ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css

Requested by

Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9298766
x-jsd-version: 6.5.95
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19146-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"4a77e-zA2GoL0mTEDvUuLc3XyUhUKPyv0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tZeviwP2o43CeLEcMuUyXLn2C22p3kBkSmzaoTbaxZNXEQBsgEElsDwwaFL4FJ98GtPIESQRzsBYe0vc%2FnyDfT4ZJgubkI0RutlSNjU%2BUhKHe8uCldhAnOzMn4ed%2Fkm1dTv%2BBO2BsIRrDQkMk90%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 726c6fed183acc56-ZRH

GET
H2 200 style.css
facebook.help-2020656812201647901.com/assets/css/ 13 KB
4 KB 17ms
17ms Stylesheet
text/css 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help-2020656812201647901.com/assets/css/style.css
Requested by: Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 2eb8baf5757586cd96b33e82f980dccdd96a39b3a99473c69963efc588709e43

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
content-encoding: br
last-modified: Sun, 15 May 2022 15:34:58 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 3545

GET
H2 200 mobile.css
facebook.help-2020656812201647901.com/assets/css/ 5 KB
1 KB 16ms
15ms Stylesheet
text/css 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help-2020656812201647901.com/assets/css/mobile.css
Requested by: Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 18bc1f0ad62ef2fc55fa2b8ee835c50b85a8b6dbf4719a23c4cea7e72db0460c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
content-encoding: br
last-modified: Sun, 15 May 2022 15:35:02 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1232

GET
H2 200 main.aeb53a55.js Show response
facebook.help-2020656812201647901.com/static/js/ 423 KB
119 KB 70ms
69ms Script
application/javascript 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook.help-2020656812201647901.com/static/js/main.aeb53a55.js
Requested by: Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: bb4033992ec73dd6c61b14e53608ac618852576003019692ee9ac99c62643fbe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
content-encoding: br
last-modified: Wed, 18 May 2022 00:57:42 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 121330

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 38ms
16ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Requested by

Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4904f9e17645f3b0ad5eaee1896f35715c37653b82b1ae20fc4f65404b39d613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 06 Jul 2022 22:58:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 07 Jul 2022 00:24:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 07 Jul 2022 00:24:26 GMT

GET
H2 200 logo.png
facebook.help-2020656812201647901.com/assets/images/ 33 KB
34 KB 16ms
15ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/logo.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 28853c473e0f6e00721af9e3def3d287982e0ac0db41a9cee9d51ab4ac12430e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Sun, 13 Feb 2022 20:58:52 GMT
server: Apache
accept-ranges: bytes
content-length: 34097
content-type: image/png

GET
H2 200 search.svg
facebook.help-2020656812201647901.com/assets/images/ 287 B
248 B 17ms
15ms Image
image/svg+xml 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/search.svg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: fabbf2a7fd35f0c06a52e20d04a1fcc2b157764806c95af60827dcbb2822a232

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
content-encoding: br
last-modified: Sun, 13 Feb 2022 21:22:16 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 182

GET
H2 200 banner-mob.png
facebook.help-2020656812201647901.com/assets/images/ 12 KB
12 KB 16ms
15ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/banner-mob.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: ae4bc2c1cd8f96181719904875ff91a14e3052599b52a59d03976ae19b40e957

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Thu, 28 Apr 2022 00:37:50 GMT
server: Apache
accept-ranges: bytes
content-length: 12495
content-type: image/png

GET
H2 200 pg1.png
facebook.help-2020656812201647901.com/assets/images/ 15 KB
15 KB 17ms
16ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/pg1.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Mon, 14 Feb 2022 15:53:34 GMT
server: Apache
accept-ranges: bytes
content-length: 15685
content-type: image/png

GET
H2 200 pg2.png
facebook.help-2020656812201647901.com/assets/images/ 4 KB
4 KB 17ms
16ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/pg2.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 4e7707fadcf9e2b0dd69ac76362f94098d70f6182eebf94d4f1e1aa451558056

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Mon, 14 Feb 2022 15:53:54 GMT
server: Apache
accept-ranges: bytes
content-length: 4269
content-type: image/png

GET
H2 200 pg3.png
facebook.help-2020656812201647901.com/assets/images/ 5 KB
5 KB 17ms
16ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/pg3.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: 6523207b31b02c40fd0364d902630cdd595aa25765e4ae47df7d94460ec3f4e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Mon, 14 Feb 2022 15:54:08 GMT
server: Apache
accept-ranges: bytes
content-length: 5460
content-type: image/png

GET
H2 200 logo2.png
facebook.help-2020656812201647901.com/assets/images/ 14 KB
14 KB 17ms
16ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/logo2.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Mon, 14 Feb 2022 16:47:46 GMT
server: Apache
accept-ranges: bytes
content-length: 14311
content-type: image/png

GET
DATA 200
OK truncated
/ 241 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9668b153f3169d94dc4d713cb95638f7b10409d12ba334881c968aa62b113402

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 banner.png
facebook.help-2020656812201647901.com/assets/images/ 27 KB
27 KB 14ms
14ms Image
image/png 192.236.209.91
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook.help-2020656812201647901.com/assets/images/banner.png
Requested by: Host: facebook.help-2020656812201647901.com
URL: https://facebook.help-2020656812201647901.com/assets/css/style.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.236.209.91 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-236-209-91.hostwindsdns.com
Software: Apache /
Resource Hash: ebbf32461fde0ffe50c2454e58bbeb38b6f94ab9c0dc8cfe32eca56c6fca35a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://facebook.help-2020656812201647901.com/assets/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
last-modified: Wed, 27 Apr 2022 23:00:02 GMT
server: Apache
accept-ranges: bytes
content-length: 27241
content-type: image/png

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://facebook.help-2020656812201647901.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:07:55 GMT
x-content-type-options: nosniff
age: 191791
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Jul 2023 19:07:55 GMT

GET
H3 200 materialdesignicons-webfont.woff2
cdn.jsdelivr.net/npm/@mdi/font@6.5.95/fonts/ 353 KB
354 KB 34ms
18ms Font
font/woff2 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/fonts/materialdesignicons-webfont.woff2?v=6.5.95

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11e3d4caeceb6a9d4be5144f349b5abbb8e586f1568d58a24794331023249733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/@mdi/font@6.5.95/css/materialdesignicons.min.css
Origin: https://facebook.help-2020656812201647901.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 07 Jul 2022 00:24:26 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 9298764
x-jsd-version: 6.5.95
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 361384
x-served-by: cache-fra19134-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"583a8-B9VpeWogWvpubHiiAGMvQ5DcXIs"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AeHvcplA7XXJfLLVU8%2BGxovYfMP6EN108QsT2Pp%2BAP3aKJ5eNqGxotmMX50rtjbqJSBfKvz%2BV9MkHIE1lJJEy2loph3PRuRwe%2FRXe%2BH1gz142rqTn9lynIHSdQlpYuZGWv2mT9rgwyiJD3JRZv0%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
cf-ray: 726c6fee2d4801fc-ZRH

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 30ms
9ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://facebook.help-2020656812201647901.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Tue, 05 Jul 2022 08:45:42 GMT
x-content-type-options: nosniff
age: 142724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Jul 2023 08:45:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
facebook.help-2020656812201647901.com
fonts.googleapis.com
fonts.gstatic.com
192.236.209.91
2606:4700::6810:5814
2a00:1450:4001:80b::2003
2a00:1450:4001:828::200a
11e3d4caeceb6a9d4be5144f349b5abbb8e586f1568d58a24794331023249733
18bc1f0ad62ef2fc55fa2b8ee835c50b85a8b6dbf4719a23c4cea7e72db0460c
28853c473e0f6e00721af9e3def3d287982e0ac0db41a9cee9d51ab4ac12430e
2eb8baf5757586cd96b33e82f980dccdd96a39b3a99473c69963efc588709e43
4904f9e17645f3b0ad5eaee1896f35715c37653b82b1ae20fc4f65404b39d613
4e7707fadcf9e2b0dd69ac76362f94098d70f6182eebf94d4f1e1aa451558056
50271f9d1fb53bfd2074827218441de193a0f5bdb94f6a20b3e76d1fa91b41b7
6523207b31b02c40fd0364d902630cdd595aa25765e4ae47df7d94460ec3f4e5
84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6
9668b153f3169d94dc4d713cb95638f7b10409d12ba334881c968aa62b113402
ae4bc2c1cd8f96181719904875ff91a14e3052599b52a59d03976ae19b40e957
bb4033992ec73dd6c61b14e53608ac618852576003019692ee9ac99c62643fbe
ebbf32461fde0ffe50c2454e58bbeb38b6f94ab9c0dc8cfe32eca56c6fca35a6
ec6239ecee4cbb1a3b5d90273389068d6a4017c2c246301f428cdf45f9dc28e0
ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fabbf2a7fd35f0c06a52e20d04a1fcc2b157764806c95af60827dcbb2822a232

facebook.help-2020656812201647901.com Open in urlscan Pro 192.236.209.91 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

672 kBTransfer

1244 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

facebook.help-2020656812201647901.com Open in urlscan Pro
192.236.209.91 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

672 kB
Transfer

1244 kB
Size

0
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!