URL:
http://m.fb-reattend-wvjpqzsota.bostan-city.ir/
Tags: phishing malicious
Submission: On January 14 via api from HK
Tags: phishing malicious
Submission: On January 14 via api from HK
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 3 HTTP transactions.
The main IP is 185.55.227.78, located in Iran, Islamic Republic Of and belongs to SERVERPARS, IR. The main domain is m.fb-reattend-wvjpqzsota.bostan-city.ir.
The main domain was scanned 3 times on urlscan.io Show Scans 3
The main IP is 185.55.227.78, located in Iran, Islamic Republic Of and belongs to SERVERPARS, IR. The main domain is m.fb-reattend-wvjpqzsota.bostan-city.ir.
The main domain was scanned 3 times on urlscan.io Show Scans 3
Verdict: Malicious (Score: 100/100) Show Details
-
urlscan - Score: 100
phishingPhishing against Facebook (Social Network)
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 185.55.227.78 185.55.227.78 | 201999 (SERVERPARS) (SERVERPARS) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2b | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
| 3 | 2 |
| Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
bostan-city.ir
|
17 KB |
| 1 |
bootstrapcdn.com
|
20 KB |
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | m.fb-reattend-wvjpqzsota.bostan-city.ir |
m.fb-reattend-wvjpqzsota.bostan-city.ir
|
| 1 | maxcdn.bootstrapcdn.com |
m.fb-reattend-wvjpqzsota.bostan-city.ir
|
| 3 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| Subject / Issuer | Validity | Valid |
|---|---|---|
| *.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year |
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
LiteSpeed
(Web Servers)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^LiteSpeed$/i
Stats
0
Requests
0
Ad-blocked
0
Malicious
0
%
HTTPS
0
%
IPv6
0
Domains
0
Subdomains
0
IPs
0
Countries
0
kB
Transfer
0
kB
Size
0
Cookies
0 Outgoing links
These are links going to different origins than the main page. For each link, only the first name is shown.
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
|
818 B 744 B |
Document text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css |
118 KB 20 KB |
Stylesheet text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
|
16 KB 16 KB |
Image image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Redirect requests
There were HTTP redirects (301, 302) for the following requests:
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan - Score: 100
Categories:phishing
Tags:
phishing
Phishing against: Facebook (Social Network)
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators of compromise (IoCs)
This is a term in the security industry to describe indicators around an attack. This includes IPs, hashes, domains, etc.
m.fb-reattend-wvjpqzsota.bostan-city.ir maxcdn.bootstrapcdn.com 185.55.227.78 2001:4de0:ac19::1:b:2b 7df647be0675552935e31b7fc9facdbe3185c5fa96bba1c0a51a9d74961f3d9c 91b7fc46561fd3afb1132287e406fa0c5009a9b82af55743ced1f73584f007f0 f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c