URL: http://pubgniv11.dynamic-dns.net/login/facebook/
Submission: On January 21 via automatic , source openphish

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions.
The main IP is 173.212.224.123, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is pubgniv11.dynamic-dns.net.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 55/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Facebook (Social Network)
  • openphish - Score: 10 (URL submitted from openphish) -
    phishing

Domain & IP information

IP Address AS Autonomous System
1 173.212.224.123 51167 (CONTABO)
3 2a03:2880:f12... 32934 (FACEBOOK)
1 2a01:4a0:1338... 201011 (NETZBETRI...)
5 3
Domain
Subdomains
Transfer
3 fbcdn.net
47 KB
1 pubgmobile.com
74 KB
1 dynamic-dns.net
5 KB
5 3
Domain Requested by
3 z-m-static.xx.fbcdn.net pubgniv11.dynamic-dns.net
1 www.pubgmobile.com pubgniv11.dynamic-dns.net
1 pubgniv11.dynamic-dns.net
5 3

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-12-06 -
2020-03-05
3 months
wetv.acc.qq.com
DigiCert SHA2 Secure Server CA
2019-11-04 -
2020-02-29
4 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
/login/facebook
5 KB
5 KB
Document
General
Full URL
http://pubgniv11.dynamic-dns.net/login/facebook/
Protocol
HTTP/1.1
Server
173.212.224.123 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
root.server-ke317.com
Software
Apache /
Resource Hash
7efc06ba51abcb77b25696384ebc17d8914a7902fd18c707f78ba0f107aa5727

Request headers

Host
pubgniv11.dynamic-dns.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Tue, 21 Jan 2020 00:33:46 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Vlv_cUlK88S.css?_nc_x=Ij3Wp8lg5Kz
z-m-static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross
68 KB
16 KB
Stylesheet
General
Full URL
https://z-m-static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/Vlv_cUlK88S.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: pubgniv11.dynamic-dns.net
URL: http://pubgniv11.dynamic-dns.net/login/facebook/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:84:face:b00c:0:14c9 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f5547e0baa2dd9f1bc6e7acce7ad21a9eefc65c03a4fbdc94c8f195d39a6f09e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://pubgniv11.dynamic-dns.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-fb-debug
zvGyJABhvNt27yKsO42SCAch5LQq6ajDZ5nCaf1OuI23QDMUeH//dHIvgFz6y9c+RFisvYRoYYSui0OBk2DOmw==
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
Y+G+ame0+KUdEevqnL67rQ==
access-control-allow-origin
*
date
Tue, 21 Jan 2020 00:33:46 GMT, Tue, 21 Jan 2020 00:33:46 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
status
200
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
alt-svc
h3-24=":443"; ma=3600
content-length
16224
expires
Thu, 14 Jan 2021 14:10:12 GMT
GJ78_AiPCt2.css?_nc_x=Ij3Wp8lg5Kz
z-m-static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross
15 KB
4 KB
Stylesheet
General
Full URL
https://z-m-static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/GJ78_AiPCt2.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: pubgniv11.dynamic-dns.net
URL: http://pubgniv11.dynamic-dns.net/login/facebook/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:84:face:b00c:0:14c9 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
32b531167c02503d186ebe397e7f3b2e0cca18c009eceb1132d06823a704cc49
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://pubgniv11.dynamic-dns.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-fb-debug
4S0Jxn1s400yzzdmcwvZH8ntrY92UloJEMtn+esQU9dahON1f8sNJVTJGzEfyhEVuCCA5BXmZ3g+0eSEbE0qHw==
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
7hUR1H9InL56GXbLtQ3QHw==
access-control-allow-origin
*
date
Tue, 21 Jan 2020 00:33:46 GMT, Tue, 21 Jan 2020 00:33:46 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
status
200
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
alt-svc
h3-24=":443"; ma=3600
content-length
3594
expires
Sat, 09 Jan 2021 16:43:16 GMT
icon_logo.jpg
www.pubgmobile.com/id/event/royalepass10/images
73 KB
74 KB
Image
General
Full URL
https://www.pubgmobile.com/id/event/royalepass10/images/icon_logo.jpg
Requested by
Host: pubgniv11.dynamic-dns.net
URL: http://pubgniv11.dynamic-dns.net/login/facebook/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4a0:1338:28::c38a:ff11 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software
nginx /
Resource Hash
0d9cf7eb8fb12be77685134e63f7dae9a95fbf9306ae0529bd0347582d18a8ef

Request headers

Referer
http://pubgniv11.dynamic-dns.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Tue, 21 Jan 2020 00:33:46 GMT
last-modified
Fri, 08 Nov 2019 15:04:44 GMT
server
nginx
etag
"5dc5840c-1258d"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
75149
M2s5OnpRj9_.png
z-m-static.xx.fbcdn.net/rsrc.php/v3/yf/r
27 KB
27 KB
Image
General
Full URL
https://z-m-static.xx.fbcdn.net/rsrc.php/v3/yf/r/M2s5OnpRj9_.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:84:face:b00c:0:14c9 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
392d2194266a30f7df08ca1b8a13b34f7be377b74cbcf04b23d3cf9e00bdff59
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://z-m-static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/Vlv_cUlK88S.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-fb-debug
ik6p6c2FyRy1i0fnDScJgxg/OnRLMVQ2hRfxOETDY+YHgBntkI/Sk1yvJ6BT5ex2Z4Xv+ZOtmc1NBUyAMdeasA==
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
Nzk323+2XF3x4Omu/uiv/Q==
access-control-allow-origin
*
date
Tue, 21 Jan 2020 00:33:46 GMT, Tue, 21 Jan 2020 00:33:46 GMT
content-type
image/png
status
200
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
alt-svc
h3-24=":443"; ma=3600
content-length
27890
expires
Sat, 09 Jan 2021 01:01:56 GMT

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies