![](/screenshots/8dc77e62-93c0-4199-9ab1-20ca6f72a1ae.png)
cd8uu.csb.app
Open in
urlscan Pro
2606:4700::6812:1a72
Malicious Activity!
Public Scan
Effective URL: https://cd8uu.csb.app/na08b8kl289
Submission: On July 26 via automatic, source openphish
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 14th 2021. Valid for: a year.
This is the only time cd8uu.csb.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700::68... 2606:4700::6812:1a72 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6812:16cf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700:303... 2606:4700:3037::ac43:dafe | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY) | |
2 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST) | |
2 | 2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
10 | 6 |
ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
codesandbox.io
codesandbox.io |
47 KB |
2 |
fbcdn.net
static.xx.fbcdn.net |
3 KB |
2 |
amung.us
whos.amung.us |
58 B |
2 |
2bpr.xyz
1 redirects
2bpr.xyz |
12 KB |
1 |
imgur.com
i.imgur.com |
9 KB |
1 |
csb.app
cd8uu.csb.app |
281 B |
10 | 6 |
Domain | Requested by | |
---|---|---|
3 | codesandbox.io |
cd8uu.csb.app
codesandbox.io |
2 | static.xx.fbcdn.net |
cd8uu.csb.app
|
2 | whos.amung.us |
cd8uu.csb.app
|
2 | 2bpr.xyz |
1 redirects
cd8uu.csb.app
|
1 | i.imgur.com |
cd8uu.csb.app
|
1 | cd8uu.csb.app | |
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-05-14 - 2022-05-13 |
a year | crt.sh |
codesandbox.io Cloudflare Inc ECC CA-3 |
2021-05-19 - 2022-05-18 |
a year | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-05-26 - 2021-08-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cd8uu.csb.app/na08b8kl289
Frame ID: 81A276E66057615A13C8D44EE8B138E8
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/8dc77e62-93c0-4199-9ab1-20ca6f72a1ae.png)
Page URL History Show full URLs
-
http://cd8uu.csb.app/na08b8kl289
HTTP 307
https://cd8uu.csb.app/na08b8kl289 Page URL
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Detected patterns
- headers via /^1\.1 google$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cd8uu.csb.app/na08b8kl289
HTTP 307
https://cd8uu.csb.app/na08b8kl289 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://2bpr.xyz/async?&user=davidgore&html=mobile HTTP 301
- https://2bpr.xyz/async/?&user=davidgore&html=mobile
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
na08b8kl289
cd8uu.csb.app/ Redirect Chain
|
359 B 281 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sse-hooks.f648b14c15c640a14a557113a991cb8d.js
codesandbox.io/public/sse-hooks/ |
172 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.be879265d.js
codesandbox.io/static/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
/
2bpr.xyz/async/ Redirect Chain
|
49 KB 12 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
phishing
codesandbox.io/api/v1/sandboxes/cd8uu/ |
33 B 446 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wCOStwT.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 29 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 29 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lqbz1hqlAFx.png
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| d object| dom string| head string| bod function| disableIE function| disableNS object| _0x8da6 function| _0x2f03b6 function| _0x78b1 object| _0x2553 function| _0x50dc5f function| _0x594f0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2bpr.xyz
cd8uu.csb.app
codesandbox.io
i.imgur.com
static.xx.fbcdn.net
whos.amung.us
151.101.12.193
2606:4700:3037::ac43:dafe
2606:4700::6812:16cf
2606:4700::6812:1a72
2a03:2880:f02d:100:face:b00c:0:3
67.202.94.93
0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
185f316eb86d0b318b19a5cae0e8fe3cf0c56d327786fbe27b6652769463ea73
2d91020394c232a07e303c0caff12346b174a759ed94de8bb0eac6c8b60e2660
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60
716243f7bdda81abdff0d68104f63ee1c184b260dc771e7cf39a3c38d8f78ff7
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
b77d71b51db62c64d4da006d3e3604730bb4f5a0f910d52a5d6784ceaa9aac9a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855