![](/screenshots/50f6d679-7e29-4c4b-8428-ab6885247e9e.png)
video3446.grooveblog.com
Open in
urlscan Pro
104.18.15.3
Malicious Activity!
Public Scan
Effective URL: https://video3446.grooveblog.com/?v=4
Submission: On October 22 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 26th 2021. Valid for: a year.
This is the only time video3446.grooveblog.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 172.67.202.14 172.67.202.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 104.18.15.3 104.18.15.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.22.52 104.18.22.52 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.16.19.94 104.16.19.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 104.16.122.175 104.16.122.175 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 142.250.186.138 142.250.186.138 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 104.21.94.32 104.21.94.32 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 104.21.81.131 104.21.81.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY) | |
1 | 67.202.114.216 67.202.114.216 | 32748 (STEADFAST) (STEADFAST) | |
2 | 185.60.216.19 185.60.216.19 | 32934 (FACEBOOK) (FACEBOOK) | |
26 | 10 |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f10.1e100.net
fonts.googleapis.com |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-frx5.fbcdn.net
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
grooveblog.com
video3446.grooveblog.com |
13 KB |
4 |
googleapis.com
fonts.googleapis.com |
3 KB |
4 |
fontawesome.com
kit.fontawesome.com ka-f.fontawesome.com |
23 KB |
2 |
fbcdn.net
static.xx.fbcdn.net |
3 KB |
2 |
2bpr.xyz
1 redirects
2bpr.xyz |
10 KB |
2 |
unpkg.com
1 redirects
unpkg.com |
163 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
9 KB |
2 |
cqo.be
2 redirects
cqo.be |
4 KB |
1 |
amung.us
whos.amung.us |
27 B |
1 |
imgur.com
i.imgur.com |
9 KB |
26 | 10 |
Domain | Requested by | |
---|---|---|
10 | video3446.grooveblog.com |
video3446.grooveblog.com
|
4 | fonts.googleapis.com |
video3446.grooveblog.com
|
3 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | static.xx.fbcdn.net |
video3446.grooveblog.com
|
2 | 2bpr.xyz |
1 redirects
video3446.grooveblog.com
|
2 | unpkg.com |
1 redirects
video3446.grooveblog.com
|
2 | cdnjs.cloudflare.com |
video3446.grooveblog.com
|
2 | cqo.be | 2 redirects |
1 | whos.amung.us |
video3446.grooveblog.com
|
1 | i.imgur.com |
video3446.grooveblog.com
|
1 | kit.fontawesome.com |
video3446.grooveblog.com
|
26 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-01-26 - 2022-01-25 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2020-11-13 - 2021-12-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-09-09 - 2021-12-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://video3446.grooveblog.com/?v=4
Frame ID: 5B1DB8CF35C5246807E7FD0F86A507CA
Requests: 26 HTTP requests in this frame
Screenshot
![](/screenshots/50f6d679-7e29-4c4b-8428-ab6885247e9e.png)
Page URL History Show full URLs
-
http://cqo.be/to6n8
HTTP 301
https://cqo.be/to6n8 HTTP 301
https://video3446.grooveblog.com/?v=4 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cqo.be/to6n8
HTTP 301
https://cqo.be/to6n8 HTTP 301
https://video3446.grooveblog.com/?v=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://unpkg.com/tailwindcss@%5E1.0/dist/tailwind.min.css HTTP 302
- https://unpkg.com/tailwindcss@1.9.6/dist/tailwind.min.css
- https://2bpr.xyz/async?&user=Wason07&html=mobile HTTP 301
- https://2bpr.xyz/async/?&user=Wason07&html=mobile
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
video3446.grooveblog.com/ Redirect Chain
|
55 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e7647a48d4.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mustache.min.js
cdnjs.cloudflare.com/ajax/libs/mustache.js/2.1.0/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tailwind.min.css
unpkg.com/tailwindcss@1.9.6/dist/ Redirect Chain
|
2 MB 162 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
6 KB 756 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 671 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
2bpr.xyz/async/ Redirect Chain
|
43 KB 10 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
3 KB 1 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
version.js
video3446.grooveblog.com/js/ |
129 B 289 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
video3446.grooveblog.com/css/ |
11 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blogpostlist.json
video3446.grooveblog.com/json/ |
7 KB 1 KB |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 611 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
setting.json
video3446.grooveblog.com/json/ |
996 B 650 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigations.json
video3446.grooveblog.com/json/ |
1 KB 361 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
categories.json
video3446.grooveblog.com/json/ |
1 KB 417 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wCOStwT.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
27 B 27 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lqbz1hqlAFx.png
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.html
video3446.grooveblog.com/templates/ |
2 KB 793 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer.html
video3446.grooveblog.com/templates/ |
1 KB 555 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layout.html
video3446.grooveblog.com/templates/ |
187 B 212 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2bpr.xyz
cdnjs.cloudflare.com
cqo.be
fonts.googleapis.com
i.imgur.com
ka-f.fontawesome.com
kit.fontawesome.com
static.xx.fbcdn.net
unpkg.com
video3446.grooveblog.com
whos.amung.us
104.16.122.175
104.16.19.94
104.18.15.3
104.18.22.52
104.21.81.131
104.21.94.32
142.250.186.138
151.101.112.193
172.67.202.14
185.60.216.19
67.202.114.216
084a7135a2401b36223c591e41b2b60f073ab6432a8db01e3aa12708bb92f73e
0993948f76f9b7143450a40962b280ecf3f27450c06af5a13d1a0768ff9cb171
0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
10f65445eada0a4eb45baa9aaa572982ce7c907dd098e866daf6cf3b301fcf44
2483fa39123610a3b3a0111663a4211fdf03d173d9f4c670ba40eb726314844f
25ad62307622987a14baad415c0ad1177a249376da5c1e3de69dbe35b6ddda3e
452b32f99948d551d5c7b6c6a5e4ddb8935e6413d2755c4e2cfe09aba75ff68d
64faecb3252d8ceb331f6942b83f288c37210f5350a3a7a3b52f6c16e8471cc6
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
9658b60811d5756d78f29b953dff0616d10276ad5d5d176e6f701e036c265d3e
adcc462cfb07093f7ce07d68b9a6c004c5a273f292f138a2811d17f777be8027
b1ad2f9d383ef7e0adb2760405b4a8518ae632f1e7efdd2963bec491c44e2f69
bb8a74896b23a167b5669b0ecb26100b9295145fdd5a71e08df836638af23061
beb3786141808cd77d5b8c076a6ec78804558a92452d087a2f084ef69e5e4453
bef561f912604eb47ec5a3697da4c7f2811f58a7dd485742c56fa800e5a02406
c9bcb14eb9a8f58d76f9ce83393c299c1e3a06169e6990b9c8cd4e0ef70e53aa
d258f0d3f2ac658f42ecda0d26693398ddf51ed8921070f51ece4fe97cd1b963
de5ad6c3fb2d2b5b008a746dbe9328dffc39905d3cdc9e0e4ef3ce56ea2b5ab7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f47045dc97d9cff6626bc48248cdb9a778351a7c69d709dcf1004fbbd68b8e4f
f87d6b287a054c081b661f8460089dd02a69f5f31ec051ac36f11d6c54d0154a
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda