Submitted URL: http://lookaside.fbsbx.com/ig_messaging_cdn/ 9yr old
Effective URL: https://lookaside.fbsbx.com/ig_messaging_cdn/ 9yr old
Submission: On March 17 via manual from US — Scanned from CA

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 57.145.0.128, located in Boston, United States and belongs to FACEBOOK - Facebook, Inc., US. The main domain is lookaside.fbsbx.com. The Cisco Umbrella rank of the primary domain is 9380. 9yr old
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on December 24th 2025. Valid for: 3mo.
This is the only time lookaside.fbsbx.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 57.145.0.128 32934 (FACEBOOK)
2 1
Apex Domain
Subdomains
Transfer
2 fbsbx.com
lookaside.fbsbx.com — Cisco Umbrella Rank: 9380 9yr old
3 KB
2 1
Domain Requested by
2 lookaside.fbsbx.com
2 1

This site contains no links.

Subject Issuer Validity Valid
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-12-24 -
2026-03-24
3mo crt.sh

This page contains 1 frames:

Primary Page: https://lookaside.fbsbx.com/ig_messaging_cdn/
Frame ID: F1D61E7A6F167549BCECEE1DD896B1C4
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://lookaside.fbsbx.com/ig_messaging_cdn/ HTTP 307
    https://lookaside.fbsbx.com/ig_messaging_cdn/ Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

3 kB
Transfer

3 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lookaside.fbsbx.com/ig_messaging_cdn/ HTTP 307
    https://lookaside.fbsbx.com/ig_messaging_cdn/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
lookaside.fbsbx.com/ig_messaging_cdn/
Redirect Chain
  • http://lookaside.fbsbx.com/ig_messaging_cdn/
  • https://lookaside.fbsbx.com/ig_messaging_cdn/
9 B
125 B
Document
General
Full URL
https://lookaside.fbsbx.com/ig_messaging_cdn/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.145.0.128 Boston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
Security Headers
Name Value
Content-Security-Policy default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-eczoViu9' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

cache-control
private, no-cache, no-store, must-revalidate
content-length
9
content-security-policy
default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-eczoViu9' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 17 Mar 2026 15:47:59 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
priority
u=0,i
proxy-status
http_request_error; e_fb_vipaddr="AcM8LTaE3k_ChLSNrnK1_u_lsEUL2n7NMI0kn6B_f85Pwhy_vESqhfb9kG9F2kZRWXAAhAQr-Jnp9o5Z1GCVEtSgX7FwGOvGzWOh3g"; e_clientaddr="AcMrld7AyHdAyITjLmyQNYnUO9Z5jCdm4JJ6qqJCkCmSQg3nRDO-hVCG88RWOn6pmTJp_0RFNaFo9xCV1MEn5bLKmbpryoL_2FhqQ0oC_XiATFmc"; e_upip="AcPTPmfihgchZ_iZe9JnorgKOClXNAEVNlvnoRJNHAmTCOfLMVydt9jkJ2uwVpxAZRCgkc3JiZDWmwn2IDULkw8TVVODY_B88BQtHdOYOeE"; e_fb_zone="AcPZMEoes4_G66F8TxO2BROF9xPOHGIgqFswYgpYNbgsmakfUnU6CqSLFPRH_oUw"; e_fb_twtaskhandle="AcO5DViv14uDCWcjGN8bs3p0-sHUyawI0gMvM8X1sKhP5NZvGTJQBURSruUzuMr99c5qHd0WEdhiLNzuB8_D1Pxa4cl3EI3CQiZY9b4JXPn39d0"; e_proxy="AcMYOZ1VjO-zzCMOX9cwqIPKvaVn6qSGYvgpOss6bpQWFRznqk1zR23HzqHdGB4RDqNbBDfg2fCP-HtDoYfI", http_request_error; e_fb_vipaddr="AcOcsG23IxAo_055Ni_0tRox_wu2hC6jWe1u3QWfDRC85pQhrKZBV1EeuaxaHxqjZyk3sXVY"; e_clientaddr="AcMvulSWIRV00bScChxM596HHfZfRm5HJ71eBDlmevxQaZOoRAHPwkLN0heWaY6PcmCplun4_i9uEKWjyA"; e_fb_zone="AcMudWCJxx30neCZQjPxso0467zvX54AezOrMopoZJ8pSgVKczAVknPtmLYpPw"; e_fb_twtaskhandle="AcNdjM6FJ0ZpYozHG8mvFX8wUWSlyR5GM6NVIIpVJ8gWokiHyqnPtbGdAFTsJK8WA--ArIWe_fFzrRy_pZJfbNjoaYtmucDSVsU"; e_proxy="AcOJzs8782yjlm4tj1kSBlg86yYg7jV57_rNuz7mVoT7yYoW4n6J8e5NvH_f8FDnIrzGtzfGvfKO86c"
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7618251838653507468&cpp=C3&cv=1035336016&st=1773762479325"}]}
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7618251838653507468&cpp=C3&cv=1035336016&st=1773762479325"
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-fb-debug
fbpZrFIFAnPKHc40Yjp2RqaQNW93vhSI+CPBMdrRgbJdowXfJeOau3KuwiU5nyBl1Kcik8Zzrf2FvOp9Gwl1MQ==
x-frame-options
DENY
x-xss-protection
0

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://lookaside.fbsbx.com/ig_messaging_cdn/
Non-Authoritative-Reason
HSTS
favicon.ico
lookaside.fbsbx.com/
3 KB
3 KB
Other
General
Full URL
https://lookaside.fbsbx.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.145.0.128 Boston, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
bdee804356fcc5c7b420108ad234d32ab0f10ffabb82d000bd93eb53f83b0113

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://lookaside.fbsbx.com/ig_messaging_cdn/

Response headers

proxy-status
proxy_internal_response; e_fb_vipaddr="AcM_oYQMM_9swekkpjnpoz8Q3f4rT_2l-kStG3o815PNTm7K7ohs4JhEbPhlsy_0Xv8-aJ5E"; e_isproxyerr="AcMqb4O5auO-NsPswcUHTHka6LIQVIltJYClF_mF7US0PuNSECY_vFfOuoiCfA"; e_clientaddr="AcMN_i9C2OxIy09LNsN24zfMM2fk8Uo2FgjzsNslbENC6OsxiLVxvCyFvtk-Yn4crMOF_Gsly9tCOvXwdA"; e_fb_zone="AcPz92xQ-nju6IJn94rpL1VoTgJl5hIX6HtBZ47sGNKu22WyoWTSiqItAoq9hQ"; e_fb_twtaskhandle="AcMHOVCN1Tp6VjcAQajvD7BED7DgWlpzrQMsCQ7zriqqS6VcRtjXJUrnmHbr8NjvBYpLv92d-tkQk5LP43niXt0kRdtQtbTzEkw"; e_proxy="AcO52e9ftb9XEa8c7nIc1Y2c1dJmaX5su_WYedyApxaiXzKRvVF_BC6R-Gubkl8aS4llFCzXIhmwzmE"
access-control-allow-origin
*
content-length
2854
date
Tue, 17 Mar 2026 15:47:59 GMT
content-type
text/html; charset=utf-8
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://lookaside.fbsbx.com/ig_messaging_cdn/
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://lookaside.fbsbx.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-eczoViu9' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lookaside.fbsbx.com
57.145.0.128
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
bdee804356fcc5c7b420108ad234d32ab0f10ffabb82d000bd93eb53f83b0113