facebooksecure.net Open in urlscan Pro
143.198.210.251  Malicious Activity! Public Scan

Submitted URL: http://facebooksecure.net/
Effective URL: https://facebooksecure.net/
Submission: On April 08 via api from US

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 16 HTTP transactions. The main IP is 143.198.210.251, located in United States and belongs to DIGITALOCEAN-ASN, US. The main domain is facebooksecure.net.
TLS certificate: Issued by R3 on April 7th 2021. Valid for: 3 months.
This is the only time facebooksecure.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 2 143.198.210.251 14061 (DIGITALOC...)
13 2a03:2880:f03... 32934 (FACEBOOK)
1 2a03:2880:f03... 32934 (FACEBOOK)
1 2a03:2880:f13... 32934 (FACEBOOK)
16 4
Apex Domain
Subdomains
Transfer
13 fbcdn.net
static.xx.fbcdn.net
78 KB
2 facebooksecure.net
facebooksecure.net
5 KB
1 facebook.com
facebook.com
831 B
1 atdmt.com
cs.atdmt.com
1 KB
16 4
Domain Requested by
13 static.xx.fbcdn.net facebooksecure.net
static.xx.fbcdn.net
2 facebooksecure.net 1 redirects
1 facebook.com facebooksecure.net
1 cs.atdmt.com facebooksecure.net
16 4
Subject Issuer Validity Valid
facebooksecure.net
R3
2021-04-07 -
2021-07-06
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-02-10 -
2021-05-10
3 months crt.sh
*.atlassolutions.com
DigiCert SHA2 High Assurance Server CA
2021-03-26 -
2021-06-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://facebooksecure.net/
Frame ID: 49291F7BAEF9711916E51C791584C1C4
Requests: 16 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://facebooksecure.net/ HTTP 301
    https://facebooksecure.net/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

85 kB
Transfer

299 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://facebooksecure.net/ HTTP 301
    https://facebooksecure.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
facebooksecure.net/
Redirect Chain
  • http://facebooksecure.net/
  • https://facebooksecure.net/
22 KB
5 KB
Document
General
Full URL
https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.198.210.251 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
LiteSpeed /
Resource Hash
2678c10cf96f5c29d42168765dcf892677ef1214d7020a99e6aa3cb0b67a9f32

Request headers

:method
GET
:authority
facebooksecure.net
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

set-cookie
PHPSESSID=elt9hdhu7c0d4hn4shjb6pa2vj; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html; charset=UTF-8
content-encoding
gzip
vary
Accept-Encoding
date
Thu, 08 Apr 2021 06:18:30 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

Redirect headers

Content-Type
text/html
Date
Thu, 08 Apr 2021 06:18:29 GMT
Server
LiteSpeed
Location
https://facebooksecure.net/
Content-Encoding
gzip
Vary
Accept-Encoding
Transfer-Encoding
chunked
Connection
Keep-Alive
lPjqTrZdgsu.css
static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/
31 KB
7 KB
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/lPjqTrZdgsu.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b8bb41fef146014af6fb47d49139028392b1e21d447253dfeb91e7b9bab75e5f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
5RtPVzWx29/aRW56eKPHCw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
6921
x-fb-rlafr
0
x-fb-debug
i8O50LxMlSm+P//wv2qhAyVHmEnuK/9SJsge98arLNiVpQQdRhQN/L6wdwrHLk748orD2bgalHTxmjFBjqY1uw==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 07 Apr 2022 18:13:12 GMT
s8FMQRvrcP_.css
static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/
33 KB
8 KB
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/s8FMQRvrcP_.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27b8c5b51ad2ea06ac291c92a9d32db3aeccb812eee1825cef40c306ea1f4a18
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
TX/amPWyg/4BpXuSTC4SJg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
8130
x-fb-rlafr
0
x-fb-debug
5Oxlk/sJ4HMLyzha72WPqyabz+NhFzuZ9AYPisCtiSKNU4orrAxavh7g6OwSiYhWs3AprN0kucGVVberq2xvtg==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Thu, 07 Apr 2022 16:10:15 GMT
t-7-XdFUc5v.css
static.xx.fbcdn.net/rsrc.php/v3/yJ/l/0,cross/
11 KB
2 KB
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yJ/l/0,cross/t-7-XdFUc5v.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c836af63b37eac4eaf56b5a973793fe39d307c1febb1edddc209edb1dbc5a7bb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
LTs3mcYVDG8rw7Z4YY5mUg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
2162
x-fb-rlafr
0
x-fb-debug
8Dmrx9HZ57wXvMnwDruWUPamykgc3fqBVufBwyqUILsyYYTZa+w6RpMhhMBhZWez0xGA6eCgYaT4rTXtq5VJmg==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Tue, 05 Apr 2022 15:07:59 GMT
XzMVk90uhh2.css
static.xx.fbcdn.net/rsrc.php/v3/ym/l/0,cross/
14 KB
4 KB
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/ym/l/0,cross/XzMVk90uhh2.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a5936c2fba62f37df5373aba3800425e4d5f540556f8bd7f909228df4030841d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
dhV5Y/q5Yi0rY955MrrwJg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
3572
x-fb-rlafr
0
x-fb-debug
oEzqTSaIzkmDN7deRuzcBqcgXh0cEuu0XqTTAhxbv48CL/t+hTMoPlLR4e6HH1NAsMHOxWkm/hPftW/aAeid2A==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Tue, 05 Apr 2022 16:12:51 GMT
b4THRVjtfKP.css
static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/
27 KB
5 KB
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/b4THRVjtfKP.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
2fc1677e27ac157fc1de6300d7bf8a45a5d83c020f9ab382249065392407761f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
gTrMSaZLYVFHw7KAGbNMWg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
4821
x-fb-rlafr
0
x-fb-debug
sJhxZnIc11SOfxvQbyOkurQaYUm5L9mIsLtc4vr1K4/L4nN/swXKPLth6B/y4VCidWpNJNx8i3BiDguKUeiBvA==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Thu, 07 Apr 2022 17:01:23 GMT
ycO1-AYtB-B.js
static.xx.fbcdn.net/rsrc.php/v3i7M54/yg/l/en_US/
69 KB
18 KB
Script
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3i7M54/yg/l/en_US/ycO1-AYtB-B.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
af279c8040a8980b491b294fb5b3de1276317ebac6915106f78cc276784dbead
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
ekbfOZQjeXjSCRymy29jGQ==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
18451
x-fb-rlafr
0
x-fb-debug
FsOZUbf6oPh/Djj2PzkPogAWClfe0zK27avSKT+ExBAPUb29HamC95d6fvi8TheiFb2KXWSCWufOL9rf1fX8WQ==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Tue, 29 Mar 2022 08:09:11 GMT
3hsmIhDOIUG.js
static.xx.fbcdn.net/rsrc.php/v3/yj/r/
60 KB
18 KB
Script
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yj/r/3hsmIhDOIUG.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
2225bf20b735d53a21accefcd5a904bc4c7ed01a117a8c67647d1cb459f4dbdb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
LyHmgeN9eXIAQWsOEqj9zw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
18697
x-fb-rlafr
0
x-fb-debug
g4IKqCjknthNGwbPxkLykdfyCU7wAX7lciEiPhZsq4c38VZe0+b0y6FGVYCUALvcomRH4SuGCKRiC4HApTAEYg==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Wed, 06 Apr 2022 17:38:13 GMT
IEOQM8FL8ot.js
static.xx.fbcdn.net/rsrc.php/v3/yr/r/
5 KB
2 KB
Script
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/IEOQM8FL8ot.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
908edfa9f7ec9fd5cb6b2159b5cb305d9c2c88601c8bf00a23bb0e96fcea1e21
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
mrvV7Xg6Liq29ANLrbPdkw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1630
x-fb-rlafr
0
x-fb-debug
jB0fncrZSKpuYmuNLOfCTaJqAQTDpou2K2XMCXggx9FdQ4ef9P5cYxAvBP3KHQgp0g+gYMZahWORm241Xc/Ixw==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Wed, 06 Apr 2022 17:38:13 GMT
L42kvzX0PIv.js
static.xx.fbcdn.net/rsrc.php/v3/yh/r/
17 KB
5 KB
Script
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/L42kvzX0PIv.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f778e711c259bcdb0a712722fb003a7e589fca0504e6d4775176513e4578c14a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
n4LzZ7sNcUptfe1tB8mj7w==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
5336
x-fb-rlafr
0
x-fb-debug
nFJom5lctAdzB3N5pkuUrNDGWcLw37AeeHk8xna5vuAZfCHucJmgLTMorwyMRHVlMjDanrgAyIPy6ysyy56dCg==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Thu, 07 Apr 2022 17:49:20 GMT
iWbQtMrJW8n.css
static.xx.fbcdn.net/rsrc.php/v3/y6/l/0,cross/
2 KB
632 B
Stylesheet
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/y6/l/0,cross/iWbQtMrJW8n.css?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4ca4273017e6589ae5e8a9866db11b4c8a81a98c6327cfed5c799518734264ed
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://facebooksecure.net
Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
vwsrftTG2n0s/+tXcsiwUQ==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
440
x-fb-rlafr
0
x-fb-debug
SQMQz43UAgTrSP7Ytz2O/b7X/wDJhmU5Qk2LKlzb4IcfEJXeRyLRPZXyDMOqGEg8IEwrA8f37q9SIvXqlZlWrA==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Thu, 31 Mar 2022 16:24:24 GMT
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/
2 KB
2 KB
Image
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
Security Headers
Name Value
Content-Security-Policy default-src fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.xx.facebook.com/csp/reporting/?m=c;
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.xx.facebook.com/csp/reporting/?m=c;
content-encoding
br
x-content-type-options
nosniff
content-md5
NiMA5zHIsmaYxSYEaw9fHg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1027
x-fb-rlafr
0
x-fb-debug
BltjMCkjP2NdynDxHhVAfrTxGmcqRxXNE+ndhtckBGT3ChXR/4qGp41LB1mroM1GAQNH0EZ3EgNkdyI9h4ITtA==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
date
Thu, 08 Apr 2021 06:18:30 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-xss-protection
0
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
expires
Tue, 05 Apr 2022 16:12:16 GMT
event
cs.atdmt.com/
67 B
1 KB
Image
General
Full URL
https://cs.atdmt.com/event?t=FB+Login+Page+Visit
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:13:face:b00c:0:2 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding
br
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
ZWjqSdfHsNdCO3pWmP4U0IzAR14RjEbApOqQssUVrG7XhBANJBEBnPc+9BCbTZ0u/vlrMnGgeA7kIUxzVZIAdg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-frame-options
DENY
date
Thu, 08 Apr 2021 06:18:30 GMT
vary
Accept-Encoding
report-to
{"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
image/png
x-xss-protection
0
cache-control
private, no-store, no-cache, must-revalidate
cross-origin-opener-policy-report-only
same-origin-allow-popups;report-to="coop_report"
expires
Sat, 01 Jan 2000 00:00:00 GMT
hsts-pixel.gif
facebook.com/security/
43 B
831 B
Image
General
Full URL
https://facebook.com/security/hsts-pixel.gif
Requested by
Host: facebooksecure.net
URL: https://facebooksecure.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f136:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Content-Security-Policy default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://facebooksecure.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
no-cache
x-fb-debug
oq+yAefameCZV+UIAsKJ6pZNyIGX59sXj5l3NSsbeijVSQVczA7Rbsr4blNgbUbsb2zyyRKxXZA3rKSdrcdPOg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
expires
Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 08 Apr 2021 06:18:30 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
image/gif
access-control-allow-origin
*
vary
Origin, Accept-Encoding
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-fb-rlafr
0
content-security-policy
default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
access-control-expose-headers
X-FB-Debug, X-Loader-Length
hm02Lq6f6Mh.png
static.xx.fbcdn.net/rsrc.php/v3/yX/r/
4 KB
5 KB
Image
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yX/r/hm02Lq6f6Mh.png
Requested by
Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/lPjqTrZdgsu.css?_nc_x=Ij3Wp8lg5Kz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
70d4c8fc95b2302210122e8abb16b9aec6b8ce00312b93ec90dfcbde8a343cda
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/lPjqTrZdgsu.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug
NWSqhNDHvzjIbFNnGKtxVtkk//F0oqVMYw31VUS8bdGkMW+jp8rVYSTPV7FLxUfOqsvv5ATB/E9Jcv2O5H8MdA==
x-fb-trip-id
512678718
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
peUkVhNOUYmuqC1w45dDaA==
date
Thu, 08 Apr 2021 06:18:30 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
4469
x-fb-rlafr
0
expires
Wed, 06 Apr 2022 16:25:11 GMT
YQNfPR9MJfx.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/
925 B
1 KB
Image
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/YQNfPR9MJfx.png
Requested by
Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/lPjqTrZdgsu.css?_nc_x=Ij3Wp8lg5Kz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f036:1d:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e60e1c170d239ef8628c55986ae1b8e68239665363c6355cfc03336718bc2d7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/lPjqTrZdgsu.css?_nc_x=Ij3Wp8lg5Kz
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 08 Apr 2021 06:18:30 GMT
x-content-type-options
nosniff
content-md5
K140XuhbdIPsN30EmTYyQA==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
925
x-fb-rlafr
0
x-fb-debug
ZgyokWRnR54R1MrJma4uLeeXldX6h+T08XO1suTrff7+6KUPZxEWPnqArO4GjNXfd7jkfk1NhljOL4h8BBWAww==
x-fb-trip-id
512678718
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Tue, 05 Apr 2022 00:29:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| do_

1 Cookies

Domain/Path Name / Value
facebooksecure.net/ Name: PHPSESSID
Value: elt9hdhu7c0d4hn4shjb6pa2vj