facebook-log-in-attempt.egmont.news Open in urlscan Pro
70.32.23.41  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response facebook-log-in-attempt.egmont.news/	8 KB 3 KB	378ms 215ms	Document text/html	70.32.23.41 A2HOSTING
General Check archive.org Show headers Download Go to Full URL http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 Protocol HTTP/1.1 Server 70.32.23.41 Ann Arbor, United States, ASN55293 (A2HOSTING, US), Reverse DNS mi3-sr22.supercp.com Software Apache / PHP/7.2.33 Resource Hash 7e2c68c77a0b5f400c13a3368d77df636f0f7960393f02f94336ba8de8c3206a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Host facebook-log-in-attempt.egmont.news Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 14 Aug 2020 15:37:55 GMT Server Apache X-Powered-By PHP/7.2.33 Strict-Transport-Security max-age=63072000; includeSubDomains X-Frame-Options SAMEORIGIN X-Content-Type-Options nosniff Vary Accept-Encoding Content-Encoding gzip Content-Length 2445 Keep-Alive timeout=3, max=500 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/	157 KB 23 KB	10ms 9ms	Stylesheet text/css	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css Requested by Host: facebook-log-in-attempt.egmont.news URL: http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c Security Headers Name Value X-Content-Type-Options nosniff Request headers Origin http://facebook-log-in-attempt.egmont.news Referer http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 14 Aug 2020 15:37:55 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 12 May 2020 17:29:51 GMT status 200 etag "1589304591" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 23841
GET H2	200	jquery-3.5.1.slim.min.js Show response code.jquery.com/	71 KB 24 KB	12ms 11ms	Script application/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.slim.min.js Requested by Host: facebook-log-in-attempt.egmont.news URL: http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db Request headers Origin http://facebook-log-in-attempt.egmont.news Referer http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 14 Aug 2020 15:37:55 GMT content-encoding gzip last-modified Mon, 04 May 2020 23:02:39 GMT server nginx status 200 etag W/"5eb09f0f-11abc" vary Accept-Encoding x-hw 1597419475.dop007.fr8.t,1597419475.cds211.fr8.hn,1597419475.cds240.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24606
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/	21 KB 7 KB	12ms 12ms	Script application/javascript	2a04:4e42:3::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js Requested by Host: facebook-log-in-attempt.egmont.news URL: http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://facebook-log-in-attempt.egmont.news Referer http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 1004059 x-cache HIT status 200 content-length 7510 etag W/"5309-YvI45zNIx3656GVCan0bfeI8uy0" x-served-by cache-fra19151-FRA date Fri, 14 Aug 2020 15:37:55 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/	59 KB 15 KB	10ms 10ms	Script text/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js Requested by Host: facebook-log-in-attempt.egmont.news URL: http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff Security Headers Name Value X-Content-Type-Options nosniff Request headers Origin http://facebook-log-in-attempt.egmont.news Referer http://facebook-log-in-attempt.egmont.news/login.php?cmd=login_submit&id=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210&session=b9d70536d2f5907fe9b1c8d105b8d210b9d70536d2f5907fe9b1c8d105b8d210 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 14 Aug 2020 15:37:55 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 12 May 2020 17:27:09 GMT status 200 etag "1589304429" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 14885

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
facebook-log-in-attempt.egmont.news
stackpath.bootstrapcdn.com
2001:4de0:ac19::1:b:3a
2a04:4e42:3::621
70.32.23.41
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
7e2c68c77a0b5f400c13a3368d77df636f0f7960393f02f94336ba8de8c3206a
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db