facebook-help.support Open in urlscan Pro
185.155.96.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://facebook-help.support/
Submission Tags: @phishunt_io
Submission: On April 01 via api (April 1st 2022, 5:17:18 am UTC) from DE — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 17 HTTP transactions. The main IP is 185.155.96.35, located in Estonia and belongs to FAIRYHOSTING, EE. The main domain is facebook-help.support.
TLS certificate: Issued by R3 on March 31st 2022. Valid for: 3 months.

This is the only time facebook-help.support was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
10	185.155.96.35 185.155.96.35	202759 (FAIRYHOSTING) (FAIRYHOSTING)
4	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	34.117.59.81 34.117.59.81	15169 (GOOGLE) (GOOGLE)
2	88.80.147.129 88.80.147.129	44901 (BELCLOUD) (BELCLOUD)
17	4

10 185.155.96.35 (Estonia)

ASN202759 (FAIRYHOSTING, EE)
PTR: raik.designute.com

facebook-help.support	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.80.147.129 (Sofia, Bulgaria)

ASN44901 (BELCLOUD, BG)

apifreshteam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	facebook-help.support facebook-help.support	1 MB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 99	140 KB
2	apifreshteam.com apifreshteam.com	312 B
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 6710	372 B
17	4

	Domain	Requested by
10	facebook-help.support	facebook-help.support
4	www.facebook.com	facebook-help.support
2	apifreshteam.com	facebook-help.support
1	ipinfo.io	facebook-help.support
17	4

This site contains no links.

Subject Issuer	Validity	Valid
facebook-help.support R3	`2022-03-31` - `2022-06-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-01-08` - `2022-04-08`	3 months	crt.sh
ipinfo.io GTS CA 1D4	`2022-02-24` - `2022-05-25`	3 months	crt.sh
apifreshteam.com R3	`2022-03-31` - `2022-06-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://facebook-help.support/
Frame ID: 0A8834E45E10039E421398F12BC06D84
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Help Center

Detected technologies

Ant Design (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]*class="ant-(?:btn|col|row|layout|breadcrumb|menu|pagination|steps|select|cascader|checkbox|calendar|form|input-number|input|mention|rate|radio|slider|switch|tree-select|time-picker|transfer|upload|avatar|badge|card|carousel|collapse|list|popover|tooltip|table|tabs|tag|timeline|tree|alert|modal|message|notification|progress|popconfirm|spin|anchor|back-top|divider|drawer)

Page Statistics

17
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

1672 kB
Transfer

1669 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
facebook-help.support/ 746 B
678 B 1273ms
41ms Document
text/html 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: c2435db27ddf6a45722350331f207dd2ff513ff163e93481bcdb51b6bb970f09

Request headers

Accept-Language: de-DE,de;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 01 Apr 2022 05:17:10 GMT
ETag: W/"6246559a-2ea"
Last-Modified: Fri, 01 Apr 2022 01:30:02 GMT
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H/1.1 200
OK main.b09c3a4d.js Show response
facebook-help.support/static/js/ 788 KB
788 KB 82ms
82ms Script
application/javascript 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook-help.support/static/js/main.b09c3a4d.js
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 4d6076ed3b84aaeebed013602859317f84323e382e741ceefc517cab1ad49fd2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:10 GMT
Last-Modified: Fri, 01 Apr 2022 01:30:02 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246559a-c4e39"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 806457

GET
H/1.1 200
OK main.f82ce72a.css
facebook-help.support/static/css/ 585 KB
586 KB 166ms
83ms Stylesheet
text/css 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://facebook-help.support/static/css/main.f82ce72a.css
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: a14fd4d49f053df2ff5c8c4bee5fa141cbc1878cf8a006207b9d5265bf6548e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:10 GMT
Last-Modified: Fri, 01 Apr 2022 01:30:02 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246559a-92571"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 599409

GET
H2 200 11cdjuP55Lo.png
www.facebook.com/rsrc.php/v3/yF/r/ 28 KB
28 KB 25ms
8ms Image
image/png 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yF/r/11cdjuP55Lo.png

Requested by

Host: facebook-help.support
URL: https://facebook-help.support/static/css/main.f82ce72a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5d5e444b8ea1d79da3d6de98145c64c6387c2514c08cd18e3159a2907d3a9c13

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fb-debug: yuukooYh3DYo9fS5YUJQxecoCx75NxItVr8AfkpK63hxz1DihDAbDsfrukSH2GIDYsMqqs25AiWVJqLjvdr6PA==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: sTMXzBHYUsyVJhCGvqP1wQ==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
date: Thu, 31 Mar 2022 23:32:16 GMT
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
content-length: 28231
x-fb-rlafr: 0
expires: Fri, 31 Mar 2023 23:32:16 GMT

GET
H2 200 gjTEpitnxIv.png
www.facebook.com/rsrc.php/v3/yl/r/ 7 KB
7 KB 25ms
8ms Image
image/png 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yl/r/gjTEpitnxIv.png

Requested by

Host: facebook-help.support
URL: https://facebook-help.support/static/css/main.f82ce72a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

09ca171e68260913bfd1a1e535662b0095c00eb3f54c167aa0cb367110254496

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fb-debug: 1w7B9LcrTIddXVOpxHnC/gLw7GUqOaDuf/KPoFn6o0rGddSlHtGDjXD5HEsvO2ihMUpq8DyeLdkYiOstTZ/AVg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: denKNB0QDFNlNyJQ6qRvTQ==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
date: Thu, 31 Mar 2022 23:32:15 GMT
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
content-length: 7188
x-fb-rlafr: 0
expires: Fri, 31 Mar 2023 23:32:15 GMT

GET
H2 200 Y4qEfNKxt-z.png
www.facebook.com/rsrc.php/v3/yu/r/ 84 KB
85 KB 83ms
66ms Image
image/png 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/yu/r/Y4qEfNKxt-z.png

Requested by

Host: facebook-help.support
URL: https://facebook-help.support/static/css/main.f82ce72a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

916e0b22e5455f61e2a75459d2087456caa97896dc25853f76e5b853d08ef611

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fb-debug: hOG0jC/6qsnf5KX8YHqoLbbN8HJJXghifQrkdlTLBAO41YVtYgZJLg7YoiwsFCsLrsKZwgUoPxMbdQFmHKlf7Q==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OEK+5PpFOsnLrRHD93i48A==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
date: Fri, 01 Apr 2022 05:17:14 GMT
cross-origin-resource-policy: cross-origin
content-length: 86266
timing-allow-origin: *
priority: u=3,i
x-fb-rlafr: 0
expires: Sat, 01 Apr 2023 05:17:14 GMT

GET
H2 200 oSkF_jfLLiO.png
www.facebook.com/rsrc.php/v3/ym/r/ 21 KB
21 KB 34ms
17ms Image
image/png 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/ym/r/oSkF_jfLLiO.png

Requested by

Host: facebook-help.support
URL: https://facebook-help.support/static/css/main.f82ce72a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3c60702e5c6f634d24f67ab5cd7e2971716284e20453b168dc642ec503428add

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fb-debug: FHPG0dFXHymN+1D/7MkRAjKFv+jIdhpFQXygqcZ16w7XtZApocCCC6x7jcPPPHOqYrRGgk6bQLN/0FQ0IahLZA==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: sAREdLw+FCVacQOmZWsylg==
document-policy: force-load-at-top
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
date: Thu, 31 Mar 2022 23:32:15 GMT
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 21113
x-fb-rlafr: 0
expires: Fri, 31 Mar 2023 23:32:15 GMT

GET
H2 200 json Show response
ipinfo.io/ 249 B
372 B 134ms
116ms Fetch
application/json 34.117.59.81
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/json

Requested by

Host: facebook-help.support
URL: https://facebook-help.support/static/js/main.b09c3a4d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

c963a65f272c24dfbf9d159212dbc03b87983c4e470dc05563731bb09c129353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 05:17:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-envoy-upstream-service-time: 2
alt-svc: clear
via: 1.1 google

GET
H/1.1 200
OK facebookLogo1.png
facebook-help.support/ 58 KB
59 KB 123ms
123ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/facebookLogo1.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 8ee6e378d2d70a5f5c9772c38571e5334ef8620c34bcdd479d06cd6b16dfb964

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-e918"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59672

GET
H/1.1 200
OK secure.png
facebook-help.support/ 28 KB
28 KB 84ms
83ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/secure.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e2d85b7515cbe41fed7e43bde39ecab913e2702708d9901ef0918ded28e69bec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-7022"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28706

GET
H/1.1 200
OK arrowdown.png
facebook-help.support/ 172 B
418 B 125ms
42ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/arrowdown.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: f0467f9693642f683f97262490f36b1dfc43095b2ad7fa758bf572a49563d132

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-ac"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 172

GET
H/1.1 200
OK yourprivacy.png
facebook-help.support/ 35 KB
36 KB 164ms
82ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/yourprivacy.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2313c3fceb42deca30dc26839f7133146d43cdd5963a702743688ff4af829a48

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-8d47"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36167

GET
H/1.1 200
OK drawimage.png
facebook-help.support/ 15 KB
16 KB 165ms
83ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/drawimage.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-3d45"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15685

GET
H/1.1 200
OK reportingabuse.png
facebook-help.support/ 4 KB
5 KB 125ms
43ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/reportingabuse.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5aaf62fae22726833ee9736565e82156d138373ee93a8e56d1554abad557f495

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-11a4"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4516

GET
H/1.1 200
OK logometa.png
facebook-help.support/ 14 KB
14 KB 82ms
82ms Image
image/png 185.155.96.35
FAIRYHOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://facebook-help.support/logometa.png
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.155.96.35 , Estonia, ASN202759 (FAIRYHOSTING, EE),
Reverse DNS: raik.designute.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://facebook-help.support/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
Last-Modified: Fri, 01 Apr 2022 01:29:35 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6246557f-37e7"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14311

POST
H/1.1 400
Bad Request oneToken Show response
apifreshteam.com/api/users/ 37 B
312 B 211ms
211ms XHR
application/json 88.80.147.129
BELCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://apifreshteam.com/api/users/oneToken
Requested by: Host: facebook-help.support
URL: https://facebook-help.support/static/js/main.b09c3a4d.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 88.80.147.129 Sofia, Bulgaria, ASN44901 (BELCLOUD, BG),
Reverse DNS
Software: nginx/1.18.0 / Express
Resource Hash: 4851ed4c04f358bf3a4886c77726c10d6304bdd5d5a7a4784851987cc5b1f966

Request headers

Accept: application/json, text/plain, */*
Referer: https://facebook-help.support/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type: application/json

Response headers

Date: Fri, 01 Apr 2022 05:17:14 GMT
ETag: W/"25-RF0+ZEj5ypFumYpyPiU6rouDCys"
Server: nginx/1.18.0
X-Powered-By: Express
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 37

OPTIONS
H/1.1 204
No Content oneToken
apifreshteam.com/api/users/ 0
0 172ms
41ms Preflight 88.80.147.129
BELCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://apifreshteam.com/api/users/oneToken
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 88.80.147.129 Sofia, Bulgaria, ASN44901 (BELCLOUD, BG),
Reverse DNS
Software: nginx/1.18.0 / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://facebook-help.support
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 0
Date: Fri, 01 Apr 2022 05:17:14 GMT
Server: nginx/1.18.0
Vary: Access-Control-Request-Headers
X-Powered-By: Express

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://apifreshteam.com/api/users/oneToken Message: Failed to load resource: the server responded with a status of 400 (Bad Request)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apifreshteam.com
facebook-help.support
ipinfo.io
www.facebook.com
185.155.96.35
2a03:2880:f11c:8083:face:b00c:0:25de
34.117.59.81
88.80.147.129
09ca171e68260913bfd1a1e535662b0095c00eb3f54c167aa0cb367110254496
2313c3fceb42deca30dc26839f7133146d43cdd5963a702743688ff4af829a48
3c60702e5c6f634d24f67ab5cd7e2971716284e20453b168dc642ec503428add
4851ed4c04f358bf3a4886c77726c10d6304bdd5d5a7a4784851987cc5b1f966
4d6076ed3b84aaeebed013602859317f84323e382e741ceefc517cab1ad49fd2
5aaf62fae22726833ee9736565e82156d138373ee93a8e56d1554abad557f495
5d5e444b8ea1d79da3d6de98145c64c6387c2514c08cd18e3159a2907d3a9c13
84e30295e10b684475b110001987652754c5738c32f691a1196f95107b0784f6
8ee6e378d2d70a5f5c9772c38571e5334ef8620c34bcdd479d06cd6b16dfb964
916e0b22e5455f61e2a75459d2087456caa97896dc25853f76e5b853d08ef611
a14fd4d49f053df2ff5c8c4bee5fa141cbc1878cf8a006207b9d5265bf6548e6
c2435db27ddf6a45722350331f207dd2ff513ff163e93481bcdb51b6bb970f09
c963a65f272c24dfbf9d159212dbc03b87983c4e470dc05563731bb09c129353
e2d85b7515cbe41fed7e43bde39ecab913e2702708d9901ef0918ded28e69bec
ee17fdd9c919e7aab8295e1ab3f24929126298033354db9e0b712597b7aaea29
f0467f9693642f683f97262490f36b1dfc43095b2ad7fa758bf572a49563d132

facebook-help.support Open in urlscan Pro 185.155.96.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

1672 kBTransfer

1669 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

facebook-help.support Open in urlscan Pro
185.155.96.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

1672 kB
Transfer

1669 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!