fb.hlpsspprtinfrmtnpgscntrs04.xyz
Open in
urlscan Pro
13.67.9.0
Malicious Activity!
Public Scan
URL:
https://fb.hlpsspprtinfrmtnpgscntrs04.xyz/confirm-account/
Submission: On October 01 via automatic, source phishtank
Submission: On October 01 via automatic, source phishtank
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 8 HTTP transactions.
The main IP is 13.67.9.0, located in
Singapore, Singapore and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is fb.hlpsspprtinfrmtnpgscntrs04.xyz.
TLS certificate: Issued by GeoTrust TLS DV RSA Mixed SHA256 2020... on October 1st 2020. Valid for: 6 months.
This is the only time fb.hlpsspprtinfrmtnpgscntrs04.xyz was scanned on urlscan.io!
TLS certificate: Issued by GeoTrust TLS DV RSA Mixed SHA256 2020... on October 1st 2020. Valid for: 6 months.
This is the only time fb.hlpsspprtinfrmtnpgscntrs04.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 13.67.9.0 13.67.9.0 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 3 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 1 | 2a04:4e42:3::621 2a04:4e42:3::621 | 54113 (FASTLY) (FASTLY) | |
| 8 | 4 |
3
13.67.9.0
(Singapore, Singapore)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| fb.hlpsspprtinfrmtnpgscntrs04.xyz |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
46 KB |
| 3 |
hlpsspprtinfrmtnpgscntrs04.xyz
fb.hlpsspprtinfrmtnpgscntrs04.xyz |
11 KB |
| 1 |
jsdelivr.net
cdn.jsdelivr.net |
8 KB |
| 1 |
jquery.com
code.jquery.com |
24 KB |
| 8 | 4 |
| Domain | Requested by | |
|---|---|---|
| 3 | stackpath.bootstrapcdn.com |
fb.hlpsspprtinfrmtnpgscntrs04.xyz
|
| 3 | fb.hlpsspprtinfrmtnpgscntrs04.xyz |
fb.hlpsspprtinfrmtnpgscntrs04.xyz
|
| 1 | cdn.jsdelivr.net |
fb.hlpsspprtinfrmtnpgscntrs04.xyz
|
| 1 | code.jquery.com |
fb.hlpsspprtinfrmtnpgscntrs04.xyz
|
| 8 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| fb.hlpsspprtinfrmtnpgscntrs04.xyz GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-10-01 - 2021-04-01 |
6 months | crt.sh |
| *.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
| jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
| f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-09-21 - 2021-04-17 |
7 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fb.hlpsspprtinfrmtnpgscntrs04.xyz/confirm-account/
Frame ID: 2DC60BEB8D86F2580157D48707A9C274
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
fb.hlpsspprtinfrmtnpgscntrs04.xyz/confirm-account/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ |
156 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
fb.hlpsspprtinfrmtnpgscntrs04.xyz/confirm-account/css/ |
2 KB 895 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon.png
fb.hlpsspprtinfrmtnpgscntrs04.xyz/confirm-account/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.4.1.slim.min.js
code.jquery.com/ |
69 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ |
59 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery function| Popper object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
fb.hlpsspprtinfrmtnpgscntrs04.xyz
stackpath.bootstrapcdn.com
13.67.9.0
2001:4de0:ac19::1:b:1a
2001:4de0:ac19::1:b:1b
2a04:4e42:3::621
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a33df20f249e466a9d4f87c11476478717edebc8ddf15cc37d4d04b6a49a45f2
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
efacd55d0f11a09a15959c53844c63f83ae10111d49ebfb0830eea0362a7854a
fa1129a2f56ad50001e2869e1fdf01916364221cb8108cf0b5d0fbe46d2a1d58