urlscan.io logo urlscan.io
SecurityTrails logo

221.120.219.3 Open in urlscan Pro
221.120.219.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://221.120.219.3:8080/
Submission: On November 12 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 221.120.219.3, located in Sialkot, Pakistan and belongs to PKTELECOM-AS-PK Pakistan Telecommunication Company Limited, PK. The main domain is 221.120.219.3.
This is the only time 221.120.219.3 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 221.120.219.3 17557 (PKTELECOM...)
3 2a03:2880:f01... 32934 (FACEBOOK)
1 2a03:2880:f11... 32934 (FACEBOOK)
13 4
Apex Domain
Subdomains		 Transfer
3 fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 715 Failed
26 KB
1 facebook.com
facebook.com — Cisco Umbrella Rank: 28
3 KB
13 2
Domain Requested by
3 static.xx.fbcdn.net 221.120.219.3
1 facebook.com 221.120.219.3
13 2
Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-08-21 -
2022-11-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://221.120.219.3:8080/
Frame ID: B4A77D4FD130E3B11C3BD03F575E28ED
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Facebook – log in or sign up

Page Statistics

13
Requests

31 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

686 kB
Transfer

697 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
221.120.219.3/ 		641 KB
642 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://221.120.219.3:8080/
Protocol
HTTP/1.1
Server
221.120.219.3 Sialkot, Pakistan, ASN17557 (PKTELECOM-AS-PK Pakistan Telecommunication Company Limited, PK),
Reverse DNS
Software
Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6 /
Resource Hash
0ec0aad1020ba9e0497fa9267500c75042ad2875ae41e17f48c5cd50f8b9a642

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
656826
Content-Type
text/html
Date
Sat, 12 Nov 2022 01:01:56 GMT
ETag
"a05ba-5831de7565bc0"
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 02 Mar 2019 15:09:02 GMT
Server
Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6
9AeKPef2mDJ.css
static.xx.fbcdn.net/rsrc.php/v3/yy/l/0,cross/ 		0
0
YpEU-MBVGK_.css
static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/ 		0
0
6o0Oj-M_zZA.css
static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/ 		0
0
ChyjugY_28a.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ 		0
0
30YaB-HGA1A.css
static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/ 		0
0
g3Q5HRb0GFz.css
static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/ 		0
0
XLUXyHsj2XJ.css
static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/ 		0
0
lZ86cv9aR90.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ 		40 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/lZ86cv9aR90.css
Requested by
Host: 221.120.219.3
URL: http://221.120.219.3:8080/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5ac13ac4530094bf65f94168b095f12321be9ee5d0b0040122fcdf50f5c68822
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://221.120.219.3:8080/
Origin
http://221.120.219.3:8080
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 01:05:12 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
uMXuAVCcY1sq6iyJyd098Q==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
26015
x-fb-rlafr
0
x-fb-debug
21GBwshzJVl/dNHoa2+5n0X/W7QiiPDd93Z6ftwWv6wvVHtWv8iuyHIMhu6Gfz8pfNoQCTrKOB5lCEoX51Y2zg==
x-fb-trip-id
686109401
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Fri, 10 Nov 2023 09:34:41 GMT
tTeNuY0XrHQ.js
static.xx.fbcdn.net/rsrc.php/v3/yb/r/ 		0
0
GwFs3_KxNjS.png
static.xx.fbcdn.net/rsrc.php/v3/yc/r/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/GwFs3_KxNjS.png
Requested by
Host: 221.120.219.3
URL: http://221.120.219.3:8080/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://221.120.219.3:8080/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers
GsNJNwuI-UM.gif
static.xx.fbcdn.net/rsrc.php/v3/yb/r/ 		522 B
573 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/GsNJNwuI-UM.gif
Requested by
Host: 221.120.219.3
URL: http://221.120.219.3:8080/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7f4fbb61e5a1226b421109d4bfeb68b371b240bb6a0131c54581b777cb649908
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://221.120.219.3:8080/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Sat, 12 Nov 2022 01:05:12 GMT
x-content-type-options
nosniff
content-md5
cH2zTAVPHVXw/aQfDhS/Bg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
522
x-fb-rlafr
0
x-fb-debug
1rplwUspAFTj2JCYbptRd+2x03Fhqjqvm5u6Hs8+AD6Xth7edVXWNZMaPsIb9fREcixixa4rXUDy4qMDxz8TBw==
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/gif
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Thu, 02 Nov 2023 16:11:59 GMT
truncated
/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9a67fc4a7b9baa639b319f162a9a17f982d7e1b653aa12b08ec7a2ab74275773

Request headers

Referer
Origin
http://221.120.219.3:8080
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
font/opentype
hsts-pixel.gif
facebook.com/security/ 		43 B
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://facebook.com/security/hsts-pixel.gif
Requested by
Host: 221.120.219.3
URL: http://221.120.219.3:8080/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://221.120.219.3:8080/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
date
Sat, 12 Nov 2022 01:05:12 GMT
document-policy
force-load-at-top
content-security-policy-report-only
default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-fb-rlafr
0
x-xss-protection
0
pragma
no-cache
x-fb-debug
bSqjavOMkEa7SJEg3UR/yCmw0fsB6tZSSReQweqDCnSRRu5QQD3txJO5XD9vPikXIk6qCoXwgt9iLuFliL9CUw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/gif
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yy/l/0,cross/9AeKPef2mDJ.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/YpEU-MBVGK_.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/6o0Oj-M_zZA.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ChyjugY_28a.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/30YaB-HGA1A.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/g3Q5HRb0GFz.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/XLUXyHsj2XJ.css
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/tTeNuY0XrHQ.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 number| _cstart function| envFlush object| Env number| __DEV__ function| CavalryLogger undefined| bigPipe

0 Cookies

17 Console Messages

Source Level URL
Text
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/30YaB-HGA1A.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yB/l/0,cross/30YaB-HGA1A.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/6o0Oj-M_zZA.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/6o0Oj-M_zZA.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/YpEU-MBVGK_.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/YpEU-MBVGK_.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yy/l/0,cross/9AeKPef2mDJ.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yy/l/0,cross/9AeKPef2mDJ.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/g3Q5HRb0GFz.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/g3Q5HRb0GFz.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/tTeNuY0XrHQ.js' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/tTeNuY0XrHQ.js
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/XLUXyHsj2XJ.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/XLUXyHsj2XJ.css
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://221.120.219.3:8080/
Message:
Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ChyjugY_28a.css' from origin 'http://221.120.219.3:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ChyjugY_28a.css
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/GwFs3_KxNjS.png
Message:
Failed to load resource: the server responded with a status of 404 ()