hissfg-facebook.my-free.website
Open in
urlscan Pro
2606:4700::6811:e4a8
Malicious Activity!
Public Scan
Submission: On May 12 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 3rd 2023. Valid for: a year.
This is the only time hissfg-facebook.my-free.website was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700::68... 2606:4700::6811:e4a8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 35.190.14.35 35.190.14.35 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::42... 2606:4700::42eb:c80e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:f358 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:10:... 2606:4700:10::6816:4bab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:6010 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 13.92.180.208 13.92.180.208 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
15 | 9 |
ASN15169 (GOOGLE, US)
PTR: 35.14.190.35.bc.googleusercontent.com
components.mywebsitebuilder.com |
ASN13335 (CLOUDFLARENET, US)
runtime.builderservices.io | |
images.builderservices.io |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
in-us-east-event-hubs.servicebus.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
my-free.website
hissfg-facebook.my-free.website |
337 KB |
2 |
windows.net
in-us-east-event-hubs.servicebus.windows.net — Cisco Umbrella Rank: 85849 |
326 B |
2 |
amung.us
whos.amung.us — Cisco Umbrella Rank: 12114 |
52 B |
2 |
builderservices.io
runtime.builderservices.io — Cisco Umbrella Rank: 183679 images.builderservices.io — Cisco Umbrella Rank: 211045 |
763 KB |
2 |
wzdev.co
gfonts-proxy.wzdev.co — Cisco Umbrella Rank: 219505 |
29 KB |
2 |
mywebsitebuilder.com
components.mywebsitebuilder.com — Cisco Umbrella Rank: 81981 in-app.mywebsitebuilder.com — Cisco Umbrella Rank: 200586 |
40 KB |
1 |
marcianopanel.com
marcianopanel.com |
57 KB |
15 | 7 |
Domain | Requested by | |
---|---|---|
4 | hissfg-facebook.my-free.website |
hissfg-facebook.my-free.website
runtime.builderservices.io |
2 | in-us-east-event-hubs.servicebus.windows.net |
in-app.mywebsitebuilder.com
|
2 | whos.amung.us |
hissfg-facebook.my-free.website
|
2 | gfonts-proxy.wzdev.co |
hissfg-facebook.my-free.website
gfonts-proxy.wzdev.co |
1 | in-app.mywebsitebuilder.com |
runtime.builderservices.io
|
1 | images.builderservices.io |
hissfg-facebook.my-free.website
|
1 | runtime.builderservices.io |
hissfg-facebook.my-free.website
|
1 | marcianopanel.com |
hissfg-facebook.my-free.website
|
1 | components.mywebsitebuilder.com |
hissfg-facebook.my-free.website
|
15 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
my-free.website Cloudflare Inc ECC CA-3 |
2023-04-03 - 2024-04-02 |
a year | crt.sh |
*.mywebsitebuilder.com Sectigo RSA Domain Validation Secure Server CA |
2022-10-23 - 2023-11-23 |
a year | crt.sh |
marcianopanel.com E1 |
2023-04-20 - 2023-07-19 |
3 months | crt.sh |
gfonts-proxy.wzdev.co E1 |
2023-04-10 - 2023-07-09 |
3 months | crt.sh |
builderservices.io Cloudflare Inc ECC CA-3 |
2023-03-07 - 2024-03-06 |
a year | crt.sh |
*.amung.us Sectigo RSA Domain Validation Secure Server CA |
2022-05-18 - 2023-06-17 |
a year | crt.sh |
mywebsitebuilder.com Cloudflare Inc ECC CA-3 |
2023-03-31 - 2024-03-30 |
a year | crt.sh |
servicebus.windows.net Microsoft Azure TLS Issuing CA 01 |
2023-04-16 - 2024-04-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://hissfg-facebook.my-free.website/
Frame ID: DA3DB9F462308FC57C3AC6210864C8DA
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Facebook - AnmeldenDetected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
hissfg-facebook.my-free.website/ |
189 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
components.mywebsitebuilder.com/fonts/ |
30 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script
marcianopanel.com/profiles/ |
78 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
gfonts-proxy.wzdev.co/ |
774 B 671 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inicio.15d61b95.js
hissfg-facebook.my-free.website/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle.js
runtime.builderservices.io/runtime-websitebuilder-21645/ |
2 MB 459 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m
hissfg-facebook.my-free.website/s/cdn/v1.0/i/ |
304 KB 305 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wWA.woff
gfonts-proxy.wzdev.co/font/s/lato/v23/ |
28 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
51903151
hissfg-facebook.my-free.website/v1.0/runtime/appmarket/render/3/ |
1 KB 774 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m
images.builderservices.io/s/cdn/v1.0/i/ |
304 KB 305 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
26 B 26 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
26 B 26 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk-insights-tracker
in-app.mywebsitebuilder.com/ |
20 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
/
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/messages/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/messages/ |
0 326 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| __features object| _featureSettings object| _page object| _WP_JSONP object| regeneratorRuntime number| 2f1acc6c3a606b082e5eef5e54414ffb object| _xsrfToken function| Velocity object| _GoogleMapsApi boolean| _isPublished object| _site function| __bi__ object| _feature_events function| showModal object| _zoomUpdateEvents string| html string| user_counter string| back string| repeat function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a object| EventHubHistory3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.builderservices.io/ | Name: _cfuvid Value: z_9kCF28D.XTHSAlLBoBMGsjr4ERmRkuQhOMlfCu7TM-1683915503328-0-604800000 |
|
hissfg-facebook.my-free.website/ | Name: app_key Value: 49149B53-23C1-9D1D-AEB9-E06D1DF5E883/1683915504934 |
|
hissfg-facebook.my-free.website/ | Name: app_ses_key Value: FF38DA0E-210A-5E3C-B8FC-A3AB29C80653%3A1683915504934%3A%25/none |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
components.mywebsitebuilder.com
gfonts-proxy.wzdev.co
hissfg-facebook.my-free.website
images.builderservices.io
in-app.mywebsitebuilder.com
in-us-east-event-hubs.servicebus.windows.net
marcianopanel.com
runtime.builderservices.io
whos.amung.us
13.92.180.208
2606:4700:10::6816:4bab
2606:4700::42eb:c80e
2606:4700::6811:e4a8
2606:4700::6812:6010
2606:4700::6812:f358
2a06:98c1:3120::3
35.190.14.35
0bfcee06e1baa043fdd1c0d85efbff2d26374ad69c2c0e0a4c9c823c534972a9
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
4ce95f8c58cf6a0c00ec734afe61373cb837e83ebc3d7d6580b845f508b43e31
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
74a1f5763ac6153d7c4ba2943e9b1fdf9d5135f01f6db014b3be2fa6c4479f74
78dba71b8404a69b999e63837012a675caaa1ab124ad192de452a0b97158f89e
8fd638c32610a7882a28cc7025a59cb72a209de385177d7c6cb83e813560e658
a382e87f5137fbc1bff8bba6702b4400fb21d649d183f78cc886e40fab32ae53
a4250564f2ff5183f214a4df07c969efbe35384d42a8a7345afa2b223a68e619
ad119c7be887157eff66fade3d810a22b8624803d687fe799eddaf32a67b2455
bd1411968f2f8d6fac8407f679d31f30939345c45bf1df811ba149120d879fb1
d7ee85d5b7f72deba9cbf17e9e07ae06b0b866d6cad9048388c9d4a886f32243
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff717d669eef6ae37eb809ad106e4e3a442bba869d18be8a4ddf9c9c9d664c1f