www.veraccfbsdrwtyjh.xyz Open in urlscan Pro
185.61.153.110 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.veraccfbsdrwtyjh.xyz/help.htm
Submission: On September 21 via automatic, source openphish (September 21st 2020, 1:30:27 am UTC)

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 185.61.153.110, located in United Kingdom and belongs to NAMECHEAP-NET, US. The main domain is www.veraccfbsdrwtyjh.xyz.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 20th 2020. Valid for: a year.

This is the only time www.veraccfbsdrwtyjh.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
7	185.61.153.110 185.61.153.110	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2620:100:6022... 2620:100:6022:15::a27d:420f	19679 (DROPBOX) (DROPBOX)
8	2

7 185.61.153.110 (United Kingdom)

ASN22612 (NAMECHEAP-NET, US)
PTR: server257-4.web-hosting.com

www.veraccfbsdrwtyjh.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)

dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	veraccfbsdrwtyjh.xyz www.veraccfbsdrwtyjh.xyz	20 KB
1	dropboxusercontent.com dl.dropboxusercontent.com
8	2

	Domain	Requested by
7	www.veraccfbsdrwtyjh.xyz	www.veraccfbsdrwtyjh.xyz
1	dl.dropboxusercontent.com	www.veraccfbsdrwtyjh.xyz
8	2

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
veraccfbsdrwtyjh.xyz Sectigo RSA Domain Validation Secure Server CA	`2020-09-20` - `2021-09-20`	a year	crt.sh
*.dl.dropboxusercontent.com DigiCert SHA2 High Assurance Server CA	`2020-01-30` - `2022-04-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.veraccfbsdrwtyjh.xyz/help.htm
Frame ID: 2737FC288B445D484BF9CEBE4A0F35AB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

31 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/
Title: Facebook

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request help.htm Show response www.veraccfbsdrwtyjh.xyz/	5 KB 2 KB	462ms 27ms	Document text/html	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `e045955f42c01d871167cdbcb839ac3ca26754ec37a2878e27bf6bdbc44ee37c` Request headers :method GET :authority www.veraccfbsdrwtyjh.xyz :scheme https :path /help.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 21 Sep 2020 01:30:11 GMT server Apache last-modified Thu, 06 Aug 2020 19:21:54 GMT accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 1795 content-type text/html
GET H2	200	responsiveFB.css www.veraccfbsdrwtyjh.xyz/css/	7 KB 2 KB	29ms 28ms	Stylesheet text/css	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.veraccfbsdrwtyjh.xyz/css/responsiveFB.css Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `cb93648d77c73dc5eb0dd576bc21dfba41d04bdd93a91fd3b0103220f1d8039d` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 21 Sep 2020 01:30:11 GMT content-encoding gzip last-modified Thu, 06 Aug 2020 19:23:02 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 1590
GET H2	200	internationalFB.css www.veraccfbsdrwtyjh.xyz/css/	5 KB 1 KB	37ms 36ms	Stylesheet text/css	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.veraccfbsdrwtyjh.xyz/css/internationalFB.css Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `0ac13aa673c18427731f09e7a900cf0f56412f33f4d0c47503d7a71c0388ea15` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 21 Sep 2020 01:30:11 GMT content-encoding gzip last-modified Thu, 06 Aug 2020 19:23:08 GMT server Apache vary Accept-Encoding content-type text/css status 200 accept-ranges bytes content-length 1370
GET H2	200	qu.gif www.veraccfbsdrwtyjh.xyz/img/	1 KB 2 KB	27ms 26ms	Image image/gif	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.veraccfbsdrwtyjh.xyz/img/qu.gif Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `7f8167edee007d82b26c7db2abb46ad5f549f7029d9b3a7c2983dec9d2a64a3b` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 21 Sep 2020 01:30:11 GMT last-modified Thu, 06 Aug 2020 19:24:14 GMT server Apache accept-ranges bytes content-length 1476 content-type image/gif
GET H2	200	icoacc.png www.veraccfbsdrwtyjh.xyz/img/	2 KB 3 KB	28ms 27ms	Image image/png	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.veraccfbsdrwtyjh.xyz/img/icoacc.png Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `fcc7ebe9ed903253612b02b94a68102296ca0d821505fd2118cdd7d044e1487b` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 21 Sep 2020 01:30:11 GMT last-modified Thu, 06 Aug 2020 19:24:14 GMT server Apache accept-ranges bytes content-length 2453 content-type image/png
GET H2	200	icoemail.png www.veraccfbsdrwtyjh.xyz/img/	7 KB 7 KB	38ms 37ms	Image image/png	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.veraccfbsdrwtyjh.xyz/img/icoemail.png Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `7cf13e6a600acbc20d86aeffa2a33ab15b34a131d5bcfc1f9417ffb383af17d3` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 21 Sep 2020 01:30:11 GMT last-modified Thu, 06 Aug 2020 19:24:14 GMT server Apache accept-ranges bytes content-length 7404 content-type image/png
GET H2	200	icopass.png www.veraccfbsdrwtyjh.xyz/img/	3 KB 4 KB	27ms 26ms	Image image/png	185.61.153.110 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://www.veraccfbsdrwtyjh.xyz/img/icopass.png Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/help.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.61.153.110 , United Kingdom, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server257-4.web-hosting.com Software Apache / Resource Hash `68d3b61b622735e303f413c81a04ca7893bb33f27cba7c30ff27b64e18ee36ab` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/help.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Mon, 21 Sep 2020 01:30:11 GMT last-modified Thu, 06 Aug 2020 19:24:14 GMT server Apache accept-ranges bytes content-length 3522 content-type image/png
GET H2	404	arrow_gold.png dl.dropboxusercontent.com/u/264508472/fb-img/	0 0	165ms 150ms	Image text/html	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/u/264508472/fb-img/arrow_gold.png Requested by Host: www.veraccfbsdrwtyjh.xyz URL: https://www.veraccfbsdrwtyjh.xyz/css/internationalFB.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.veraccfbsdrwtyjh.xyz/css/internationalFB.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| mousedwn

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dl.dropboxusercontent.com
www.veraccfbsdrwtyjh.xyz
185.61.153.110
2620:100:6022:15::a27d:420f
0ac13aa673c18427731f09e7a900cf0f56412f33f4d0c47503d7a71c0388ea15
68d3b61b622735e303f413c81a04ca7893bb33f27cba7c30ff27b64e18ee36ab
7cf13e6a600acbc20d86aeffa2a33ab15b34a131d5bcfc1f9417ffb383af17d3
7f8167edee007d82b26c7db2abb46ad5f549f7029d9b3a7c2983dec9d2a64a3b
cb93648d77c73dc5eb0dd576bc21dfba41d04bdd93a91fd3b0103220f1d8039d
e045955f42c01d871167cdbcb839ac3ca26754ec37a2878e27bf6bdbc44ee37c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcc7ebe9ed903253612b02b94a68102296ca0d821505fd2118cdd7d044e1487b

www.veraccfbsdrwtyjh.xyz Open in urlscan Pro 185.61.153.110 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

20 kBTransfer

31 kBSize

0 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.veraccfbsdrwtyjh.xyz Open in urlscan Pro
185.61.153.110 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

31 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!