![](/screenshots/c87ca53b-ea9b-4d27-a84c-b989f0ba51d3.png)
www.facebook.com.facebook.shayantest.shnpoc.net
Open in
urlscan Pro
169.53.83.217
Malicious Activity!
Public Scan
Effective URL: https://www.facebook.com.facebook.shayantest.shnpoc.net/login.php
Submission: On April 08 via automatic, source openphish
Summary
TLS certificate: Issued by GlobalSign Organization Validation CA... on March 28th 2018. Valid for: a year.
This is the only time www.facebook.com.facebook.shayantest.shnpoc.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 13 | 169.53.83.217 169.53.83.217 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
1 | 185.60.216.15 185.60.216.15 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
2 2 | 185.60.216.35 185.60.216.35 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
1 | 185.60.216.19 185.60.216.19 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
14 | 4 |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: d9.53.35a9.ip4.static.sl-reverse.com
www.facebook.com.facebook.shayantest.shnpoc.net | |
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net | |
facebook.com.facebook.shayantest.shnpoc.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
shnpoc.net
2 redirects
www.facebook.com.facebook.shayantest.shnpoc.net static.xx.fbcdn.net.facebook.shayantest.shnpoc.net facebook.com.facebook.shayantest.shnpoc.net |
189 KB |
1 |
facebook.net
connect.facebook.net |
366 B |
1 |
fbsbx.com
1 redirects
fbsbx.com |
169 B |
1 |
fbcdn.net
1 redirects
fbcdn.net |
328 B |
1 |
atdmt.com
cs.atdmt.com |
889 B |
14 | 5 |
Domain | Requested by | |
---|---|---|
10 | static.xx.fbcdn.net.facebook.shayantest.shnpoc.net |
www.facebook.com.facebook.shayantest.shnpoc.net
|
2 | www.facebook.com.facebook.shayantest.shnpoc.net | 1 redirects |
1 | connect.facebook.net |
www.facebook.com.facebook.shayantest.shnpoc.net
|
1 | fbsbx.com | 1 redirects |
1 | fbcdn.net | 1 redirects |
1 | facebook.com.facebook.shayantest.shnpoc.net | 1 redirects |
1 | cs.atdmt.com |
www.facebook.com.facebook.shayantest.shnpoc.net
|
14 | 7 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
facebook.shayantest.shnpoc.net GlobalSign Organization Validation CA - SHA256 - G2 |
2018-03-28 - 2019-03-29 |
a year | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2017-12-15 - 2019-03-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.facebook.com.facebook.shayantest.shnpoc.net/login.php
Frame ID: 698559CD057DF39057B113291F553419
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/c87ca53b-ea9b-4d27-a84c-b989f0ba51d3.png)
Page URL History Show full URLs
-
http://www.facebook.com.facebook.shayantest.shnpoc.net/login.php
HTTP 302
https://www.facebook.com.facebook.shayantest.shnpoc.net/login.php Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: Türkçe
Search URL Search Domain Scan URL
Title: Polski
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: Română
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: Русский
Search URL Search Domain Scan URL
Title: العربية
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Messenger
Search URL Search Domain Scan URL
Title: Moments
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Entwickler
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.facebook.com.facebook.shayantest.shnpoc.net/login.php
HTTP 302
https://www.facebook.com.facebook.shayantest.shnpoc.net/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://facebook.com.facebook.shayantest.shnpoc.net/security/hsts-pixel.gif?c=3.2.5 HTTP 302
- https://fbcdn.net/security/hsts-pixel.gif?c=2.5 HTTP 302
- https://fbsbx.com/security/hsts-pixel.gif?c=5 HTTP 302
- https://connect.facebook.net/security/hsts-pixel.gif
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
www.facebook.com.facebook.shayantest.shnpoc.net/ Redirect Chain
|
375 KB 83 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IWXv2YEq9N8.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yH/l/0,cross/ |
60 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LcyidfSBxPm.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yy/l/0,cross/ |
235 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
byuFmA64PLf.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yL/l/0,cross/ |
43 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DbwPVdOGkuW.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yo/l/0,cross/ |
5 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
kuDtSazfkCs.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yv/l/0,cross/ |
6 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fOmULt_gBTt.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yL/l/0,cross/ |
16 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Dsuud-CXLWZ.css
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yU/l/0,cross/ |
47 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
2o5v3knQzUI.js
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yV/r/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
event
cs.atdmt.com/ |
67 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hsts-pixel.gif
connect.facebook.net/security/ Redirect Chain
|
43 B 366 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glFjOuBfbbi.png
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/ys/r/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WA2KxnHDLfZ.png
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yj/r/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
O7nelmd9XSI.png
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yU/r/ |
95 B 751 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.xx.fbcdn.net.facebook.shayantest.shnpoc.net
- URL
- https://static.xx.fbcdn.net.facebook.shayantest.shnpoc.net/rsrc.php/v3/yV/r/2o5v3knQzUI.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| _cstart function| envFlush object| Env number| __DEV__ function| CavalryLogger undefined| bigPipe0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; |
Strict-Transport-Security | max-age=15552000; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.facebook.net
cs.atdmt.com
facebook.com.facebook.shayantest.shnpoc.net
fbcdn.net
fbsbx.com
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net
www.facebook.com.facebook.shayantest.shnpoc.net
static.xx.fbcdn.net.facebook.shayantest.shnpoc.net
169.53.83.217
185.60.216.15
185.60.216.19
185.60.216.35
1a78042fd49df2707e72f9bddbd6bda6ee3d028be190bc93332a2eecd0dda5a2
2acbd04fcca9fbf21aaac1e997ca5e273862b0584264c64c47b0a8e009f15abb
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6643c689dee687c4b320b140312cc232962a26e689303e8de0471ead607124af
68dc9ae561e702a51764d8ecc0ebff9419df3b93515b1dcbd8114dfa47fd39ed
762cae7533ea4623e43766691f0f458270f648a554be8c1d45e3dcc4028ca710
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
b1efbe84793a67cf83445b80a2baacd8ffc74a139743bc8728b9d501ddaf6f5a
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
d4aa488bae2b87d9fbe9945184adcac4d2dec7e88cc63758e48da9a9ae272fff
e5995631829d7cd366561abb2b75690c73da0598a2aa3d804601e38b5520adc1
efa94232ae3155c5d0b12bb3627ab7bfa965984a51c71ffc4ee012d5d09b2d5a
f7223a63bd1954ae0d6e7918aa0b292880ca4e47eb7f3f7e2580a17c9aff6829