urlscan.io logo urlscan.io
SecurityTrails logo

wildcard.asayel.ps Open in urlscan Pro
198.204.235.10  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Submission: On October 21 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 198.204.235.10, located in Kansas City, United States and belongs to NOCIX, US. The main domain is wildcard.asayel.ps.
This is the only time wildcard.asayel.ps was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 198.204.235.10 33387 (NOCIX)
6 2a03:2880:f01... 32934 (FACEBOOK)
2 3 2a03:2880:f11... 32934 (FACEBOOK)
9 3
Apex Domain
Subdomains		 Transfer
7 fbcdn.net
static.xx.fbcdn.net
fbcdn.net
48 KB
2 asayel.ps
wildcard.asayel.ps
102 KB
1 fbsbx.com
fbsbx.com
648 B
1 facebook.com
facebook.com
364 B
9 4
Domain Requested by
6 static.xx.fbcdn.net wildcard.asayel.ps
static.xx.fbcdn.net
2 wildcard.asayel.ps wildcard.asayel.ps
1 fbsbx.com wildcard.asayel.ps
1 fbcdn.net 1 redirects
1 facebook.com 1 redirects
9 5

This site contains links to these domains. Also see Links.

Domain
m.facebook.com
facebook.com
www.oculus.com
portal.facebook.com
pay.facebook.com
Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-09-11 -
2020-12-10		 3 months crt.sh
fbcdn.net
DigiCert SHA2 High Assurance Server CA		 2020-08-18 -
2020-11-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Frame ID: 8F8523063A8D44E96FF095BE59AA657A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

78 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

150 kB
Transfer

232 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://facebook.com/security/hsts-pixel.gif?c=3.2 HTTP 302
  • https://fbcdn.net/security/hsts-pixel.gif?c=2 HTTP 302
  • https://fbsbx.com/security/hsts-pixel.gif

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request gate.html
wildcard.asayel.ps/ 		60 B
301 B 		Document
General
Check archive.org
Download Go to
Full URL
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Protocol
HTTP/1.1
Server
198.204.235.10 Kansas City, United States, ASN33387 (NOCIX, US),
Reverse DNS
Software
Apache /
Resource Hash
4c8875aaa67ca65c188527d4e6d6313eb32654931b8c6d01a1712bb66462cfde

Request headers

Host
wildcard.asayel.ps
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 21 Oct 2020 13:50:31 GMT
Server
Apache
Last-Modified
Fri, 16 Oct 2020 06:17:08 GMT
Accept-Ranges
bytes
Content-Length
60
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
myscr908173.js
wildcard.asayel.ps/ 		101 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://wildcard.asayel.ps/myscr908173.js
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Protocol
HTTP/1.1
Server
198.204.235.10 Kansas City, United States, ASN33387 (NOCIX, US),
Reverse DNS
Software
Apache /
Resource Hash
75d3c6d209ba05b5769f044544665173d57a7be5426d5ce9982173231aa74e37

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 21 Oct 2020 13:50:31 GMT
Last-Modified
Fri, 16 Oct 2020 06:17:04 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
103682
s0XShOAXyWC.css
static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/ 		89 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/s0XShOAXyWC.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/myscr908173.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
91d2477807498e356914242db913f113823a28da7c1bb53ef5f7092626f05cb1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:50:32 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
xjC7FKHqi6ulK/A0N4X57A==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
19819
x-ua-compatible
IE=edge
x-fb-debug
7JdgRVO5w/hlD0Kp1KOHgUbjf414cwaKjs3tFhyNVLgMdL/AinHiMV578ilIGsbdsbrupWcsIVPYoCpvs+0QZQ==
x-fb-trip-id
664085054
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Sun, 10 Oct 2021 04:15:08 GMT
h43SCKgbNeg.css
static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/ 		17 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/h43SCKgbNeg.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/myscr908173.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5cf6803b140baf8787a91e50c401cf599c08d1d01f20f1a22342e8f961a7765e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:50:32 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
ffAjQW+DHJ9b70EF1SrS1g==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
4002
x-fb-debug
RsfuIPF3QvUSE8vwGP4MwYN+dgBgqm4DVSnDDuDfaN7KtMTHWInw7/5yyrWwkAUp5pyTebj1YeSI83fJP1VaiA==
x-fb-trip-id
664085054
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Sun, 10 Oct 2021 03:15:15 GMT
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
Content-Security-Policy default-src fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.xx.facebook.com/csp/reporting/?m=c;
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.xx.facebook.com/csp/reporting/?m=c;
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1027
x-xss-protection
0
x-fb-debug
iPFTiYlyskwCMB8SZxTETmkBPOw90XjU89QaKCSccgD6sa0LxGHkujk4zQNdjMK76AK7iouTOaIkKFHGgSfy8A==
x-fb-trip-id
664085054
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
date
Wed, 21 Oct 2020 13:50:32 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 14 Oct 2021 08:59:58 GMT
hsts-pixel.gif
fbsbx.com/security/
Redirect Chain
  • https://facebook.com/security/hsts-pixel.gif?c=3.2
  • https://fbcdn.net/security/hsts-pixel.gif?c=2
  • https://fbsbx.com/security/hsts-pixel.gif
43 B
648 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fbsbx.com/security/hsts-pixel.gif
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Content-Security-Policy default-src fbsbx.com *.fbsbx.com fbcdn.net *.fbcdn.net data: blob:;script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbsbx.com *.fbsbx.com fbcdn.net *.fbcdn.net;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
no-cache
x-fb-debug
ONqveYi8lfqLR1jHHloZVDqPZu6UQk3X7lTcB0QX0EIKQM1/4O1DGP8ef9Jq1Gfinwp5b5Edu6RKLBghC0Fy4g==
date
Wed, 21 Oct 2020 13:50:32 GMT
x-frame-options
DENY
content-type
image/gif
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src fbsbx.com *.fbsbx.com fbcdn.net *.fbcdn.net data: blob:;script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbsbx.com *.fbsbx.com fbcdn.net *.fbcdn.net;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires
Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

x-fb-debug
WEGHHofUBYsqAKjonl1fZJv4qDaMpAt0TuGiLS2Bmf56lzfJcL3v7Mo3Mzo4/Np+F+Z/wGYTtoyuABxuJRBZoQ==
status
302
date
Wed, 21 Oct 2020 13:50:32 GMT
location
https://fbsbx.com/security/hsts-pixel.gif
content-type
text/html; charset="utf-8"
access-control-allow-origin
*
strict-transport-security
max-age=31536000; preload; includeSubDomains
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
JJsC9S33ata.png
static.xx.fbcdn.net/rsrc.php/v3/yP/r/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yP/r/JJsC9S33ata.png
Requested by
Host: wildcard.asayel.ps
URL: http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
39851cf509d8e6142c7e77cc2ee475c50ad358ca3be899954bf17c2155ae49ca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://wildcard.asayel.ps/gate.html?location=8749f1d62baa9c8ff280606b00153aca
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug
aTmGxDI9/qpWtzG1mEiKMEPYh2weQFltw85GK5REK6q/ugxSqknRtGQG2AQF6vD5NycYGkhL0y5Myv4FrlFcZA==
x-fb-trip-id
664085054
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
5bLIZb0mh/ooqLt48dFV7Q==
date
Wed, 21 Oct 2020 13:50:32 GMT
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
2325
expires
Wed, 13 Oct 2021 18:04:00 GMT
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/5NR43BsYs8o.png
Requested by
Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/s0XShOAXyWC.css?_nc_x=Ij3Wp8lg5Kz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/s0XShOAXyWC.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug
ZZRqO8iKzWa0YRFx/r/Dokusu2GEadFT3naxWKSSuEG1+gwn4FxMBqlmZ0l7V5y3oi8Ye7TY4vva31WxuaiEGQ==
x-fb-trip-id
664085054
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
zS7nNbuF+qoavNDFbgWDdA==
date
Wed, 21 Oct 2020 13:50:32 GMT
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1307
expires
Wed, 13 Oct 2021 16:37:27 GMT
EjzW2F-_k3z.png
static.xx.fbcdn.net/rsrc.php/v3/yg/r/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yg/r/EjzW2F-_k3z.png
Requested by
Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/s0XShOAXyWC.css?_nc_x=Ij3Wp8lg5Kz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
32338b3a796b0ee8df97dbe07f7223448831ea3f115ccf52348961a0d0d2a318
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/s0XShOAXyWC.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:50:32 GMT
x-content-type-options
nosniff
content-md5
wnQC5Ik3YZI01rCDSxKoXA==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
18421
x-ua-compatible
IE=edge
x-fb-debug
q7UI2ZL1LHni5CG6qqxxQmpElGhfQFpNVaLlG/Aq+Bh6PZqJV5K5bhUT27dU74hTILjyqJpmv5LZQ81W1B3FDw==
x-fb-trip-id
664085054
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Sat, 09 Oct 2021 23:41:43 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| erp string| em number| tmp function| __updateOrientation

0 Cookies