remove.fbcom-001703097.feltna.si Open in urlscan Pro
91.185.213.151  Malicious Activity! Public Scan

URL: https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Submission: On September 24 via automatic, source openphish

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 91.185.213.151, located in Ljubljana, Slovenia and belongs to TELEMACH-HOSTING, SI. The main domain is remove.fbcom-001703097.feltna.si.
TLS certificate: Issued by *.feltna.si on September 22nd 2020. Valid for: a year.
This is the only time remove.fbcom-001703097.feltna.si was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
4 91.185.213.151 41828 (TELEMACH-...)
4 1
Apex Domain
Subdomains
Transfer
4 feltna.si
remove.fbcom-001703097.feltna.si
122 KB
4 1
Domain Requested by
4 remove.fbcom-001703097.feltna.si remove.fbcom-001703097.feltna.si
4 1

This site contains links to these domains. Also see Links.

Domain
m.facebook.com
Subject Issuer Validity Valid
*.feltna.si
*.feltna.si
2020-09-22 -
2021-09-22
a year crt.sh

This page contains 1 frames:

Primary Page: https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Frame ID: 7AAB2626DC1CE7A5395E9B92F136350E
Requests: 4 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

122 kB
Transfer

121 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request sign_in.html
remove.fbcom-001703097.feltna.si/
5 KB
5 KB
Document
General
Full URL
https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.185.213.151 Ljubljana, Slovenia, ASN41828 (TELEMACH-HOSTING, SI),
Reverse DNS
predator3.slovenijanet.com
Software
Apache /
Resource Hash
54a5e12a896e5099d827c496f2a1b7336d03cbe77a3176a00e14a59674992da2

Request headers

:method
GET
:authority
remove.fbcom-001703097.feltna.si
:scheme
https
:path
/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 24 Sep 2020 13:25:05 GMT
server
Apache
last-modified
Mon, 15 Jun 2020 13:38:30 GMT
accept-ranges
bytes
content-length
4652
content-type
text/html
w2ZgxVPxn4D.css
remove.fbcom-001703097.feltna.si/sign_in_files/
80 KB
81 KB
Stylesheet
General
Full URL
https://remove.fbcom-001703097.feltna.si/sign_in_files/w2ZgxVPxn4D.css
Requested by
Host: remove.fbcom-001703097.feltna.si
URL: https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.185.213.151 Ljubljana, Slovenia, ASN41828 (TELEMACH-HOSTING, SI),
Reverse DNS
predator3.slovenijanet.com
Software
Apache /
Resource Hash
996d5d028d877b038957412784a35ba13bdab4805e7369e4395d117cc3efef82

Request headers

Referer
https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 24 Sep 2020 13:25:05 GMT
last-modified
Thu, 25 May 2017 08:57:36 GMT
server
Apache
accept-ranges
bytes
content-length
82331
content-type
text/css
lptpyJRZARh.css
remove.fbcom-001703097.feltna.si/sign_in_files/
35 KB
36 KB
Stylesheet
General
Full URL
https://remove.fbcom-001703097.feltna.si/sign_in_files/lptpyJRZARh.css
Requested by
Host: remove.fbcom-001703097.feltna.si
URL: https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.185.213.151 Ljubljana, Slovenia, ASN41828 (TELEMACH-HOSTING, SI),
Reverse DNS
predator3.slovenijanet.com
Software
Apache /
Resource Hash
e79bfab30441deed58c22baea4abe3802b817daff163812f9d383754a0f83a0e

Request headers

Referer
https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 24 Sep 2020 13:25:05 GMT
last-modified
Thu, 25 May 2017 08:57:36 GMT
server
Apache
accept-ranges
bytes
content-length
36320
content-type
text/css
logo.png
remove.fbcom-001703097.feltna.si/sign_in_files/
809 B
870 B
Image
General
Full URL
https://remove.fbcom-001703097.feltna.si/sign_in_files/logo.png
Requested by
Host: remove.fbcom-001703097.feltna.si
URL: https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.185.213.151 Ljubljana, Slovenia, ASN41828 (TELEMACH-HOSTING, SI),
Reverse DNS
predator3.slovenijanet.com
Software
Apache /
Resource Hash
e0ff2e0f45b6ac64540fe750795196238188e4e3a5ae9138318dd555b23a2eae

Request headers

Referer
https://remove.fbcom-001703097.feltna.si/sign_in.html?dop0681350078436c6f9ff3c318bf008256=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 24 Sep 2020 13:25:05 GMT
last-modified
Wed, 01 Feb 2017 21:26:32 GMT
server
Apache
accept-ranges
bytes
content-length
809
content-type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| __updateOrientation

0 Cookies