security.confirmation-page.cc
Open in
urlscan Pro
188.166.243.151
Malicious Activity!
Public Scan
Submission: On February 24 via automatic, source phishtank
Summary
This is the only time security.confirmation-page.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 188.166.243.151 188.166.243.151 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
3 | 2620:100:6022... 2620:100:6022:15::a27d:420f | 19679 (DROPBOX) (DROPBOX) | |
8 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
confirmation-page.cc
security.confirmation-page.cc |
92 KB |
3 |
dropboxusercontent.com
dl.dropboxusercontent.com |
4 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
5 | security.confirmation-page.cc |
security.confirmation-page.cc
|
3 | dl.dropboxusercontent.com |
security.confirmation-page.cc
dl.dropboxusercontent.com |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-01-19 - 2022-02-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://security.confirmation-page.cc/verification-login.html
Frame ID: 87E3119599331FB06E0F9BF1425F4E3F
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
verification-login.html
security.confirmation-page.cc/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
internationalFB.css
dl.dropboxusercontent.com/s/8t1baw55x0gac9q/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
responsiveFB.css
dl.dropboxusercontent.com/s/nb32s7l135g96dd/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
security.png
security.confirmation-page.cc/img/ |
76 KB 76 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icoacc.png
security.confirmation-page.cc/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icoemail.png
security.confirmation-page.cc/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icopass.png
security.confirmation-page.cc/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_gold.png
dl.dropboxusercontent.com/u/264508472/fb-img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| mousedwn0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dl.dropboxusercontent.com
security.confirmation-page.cc
188.166.243.151
2620:100:6022:15::a27d:420f
0ac13aa673c18427731f09e7a900cf0f56412f33f4d0c47503d7a71c0388ea15
68d3b61b622735e303f413c81a04ca7893bb33f27cba7c30ff27b64e18ee36ab
79582839a6395af914e3765d5e06f25b2ee338359e1098651316cff341b29e72
7cf13e6a600acbc20d86aeffa2a33ab15b34a131d5bcfc1f9417ffb383af17d3
c13aae5de1f6df57c1a22983589ae139e58f622bc143f3e4bed36451dc1de533
cb93648d77c73dc5eb0dd576bc21dfba41d04bdd93a91fd3b0103220f1d8039d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcc7ebe9ed903253612b02b94a68102296ca0d821505fd2118cdd7d044e1487b