xxutuqrikwbrxc3v.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xxutuqrikwbrxc3v.filesusr.com/html/0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html?OTA4MTg2OA==*YWxla2luZzk2ODBAZ21haWwuY29t*aHR0...
Submission: On April 18 via automatic, source openphish (April 18th 2021, 1:05:29 am UTC)

Summary HTTP 12 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 34.102.176.152, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is xxutuqrikwbrxc3v.filesusr.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 10th 2021. Valid for: 6 months.

This is the only time xxutuqrikwbrxc3v.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	34.102.176.152 34.102.176.152	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
12	4

1 34.102.176.152 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 152.176.102.34.bc.googleusercontent.com

xxutuqrikwbrxc3v.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	fbcdn.net static.xx.fbcdn.net	26 KB
1	facebook.com facebook.com	1 KB
1	filesusr.com xxutuqrikwbrxc3v.filesusr.com	114 KB
12	3

	Domain	Requested by
4	static.xx.fbcdn.net	xxutuqrikwbrxc3v.filesusr.com
1	facebook.com	xxutuqrikwbrxc3v.filesusr.com
1	xxutuqrikwbrxc3v.filesusr.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.oculus.com
portal.facebook.com
pay.facebook.com

Subject Issuer	Validity	Valid
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-10` - `2021-08-09`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xxutuqrikwbrxc3v.filesusr.com/html/0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html?OTA4MTg2OA==*YWxla2luZzk2ODBAZ21haWwuY29t*aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2FuYWx5LnNhbmNoZXptaXJhbmRhLjE=**eFhVdHVRcmlrV2JyeEMzdg==*RmFjZWJvb2sgRXNwYcOxb2w=
Frame ID: 4E1AC1F16CEE02E02BD0DE4D31048FC2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Google Cloud (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /^1\.1 google$/i

Page Statistics

12
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

141 kB
Transfer

223 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.oculus.com/
Title: Oculus

Search URL Search Domain Scan URL

URL: https://portal.facebook.com/?refid=8
Title: Portal

Search URL Search Domain Scan URL

URL: https://pay.facebook.com/?refid=8
Title: Facebook Pay

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html Show response
xxutuqrikwbrxc3v.filesusr.com/html/ 113 KB
114 KB 199ms
159ms Document
text/html 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://xxutuqrikwbrxc3v.filesusr.com/html/0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html?OTA4MTg2OA==*YWxla2luZzk2ODBAZ21haWwuY29t*aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2FuYWx5LnNhbmNoZXptaXJhbmRhLjE=**eFhVdHVRcmlrV2JyeEMzdg==*RmFjZWJvb2sgRXNwYcOxb2w=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.17.8.2 /
Resource Hash: bf11455b7b12f062b3e17007e14adde47938edc778688562e92ecbc7d3c3c7e7

Request headers

:method: GET
:authority: xxutuqrikwbrxc3v.filesusr.com
:scheme: https
:path: /html/0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html?OTA4MTg2OA==*YWxla2luZzk2ODBAZ21haWwuY29t*aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2FuYWx5LnNhbmNoZXptaXJhbmRhLjE=**eFhVdHVRcmlrV2JyeEMzdg==*RmFjZWJvb2sgRXNwYcOxb2w=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: openresty/1.17.8.2
date: Sun, 18 Apr 2021 01:05:04 GMT
content-type: text/html; charset=utf-8
content-length: 115929
x-guploader-uploadid: ABg5-UwKFlwa0bS2rkTby7LmHN5CtHsmOl_6AVtu-ck8dN-sf-EoZsAQDXqv1wJiGjl35BbdUXfklT3SEM6bhF63rZ8
expires: Sun, 18 Apr 2021 02:05:04 GMT
cache-control: public, max-age=15552000, immutable
last-modified: Mon, 12 Apr 2021 17:58:04 GMT
etag: "f28bbd0e83e4293d4d64a235a3c1ed44"
x-goog-generation: 1618250284867309
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 115929
x-goog-hash: crc32c=YE+hog== md5=8ou9DoPkKT1NZKI1o8HtRA==
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
timing-allow-origin: *
x-seen-by: gcp.us-central-1.media-router-779d4599d7-447gz
via: 1.1 google
alt-svc: clear

GET
H2 200 ijJhlcjCY0g.css
static.xx.fbcdn.net/rsrc.php/v3/yx/l/0,cross/ 16 KB
4 KB 22ms
6ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yx/l/0,cross/ijJhlcjCY0g.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: xxutuqrikwbrxc3v.filesusr.com
URL: https://xxutuqrikwbrxc3v.filesusr.com/html/0e7e9b_f28bbd0e83e4293d4d64a235a3c1ed44.html?OTA4MTg2OA==*YWxla2luZzk2ODBAZ21haWwuY29t*aHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL2FuYWx5LnNhbmNoZXptaXJhbmRhLjE=**eFhVdHVRcmlrV2JyeEMzdg==*RmFjZWJvb2sgRXNwYcOxb2w=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

35a115743f28c533b4b895ea80656cea817eacaea5d39ed93464f3a6c6faca92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://xxutuqrikwbrxc3v.filesusr.com
Referer: https://xxutuqrikwbrxc3v.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 01:05:04 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: s1gXHmep1iamai8UzU96Iw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3446
x-fb-rlafr: 0
x-fb-debug: k3+SxmXvn27HKBz/SaGVQF5wGTMUEh1udLP5P7jstW7BAAKpuvty4I0dptYo4hMbxqCzmy12OzPjBPMp+RugfA==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 09 Apr 2022 05:28:36 GMT

GET
H2 200 2ZzGsBAVZXi.css
static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/ 76 KB
17 KB 22ms
7ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yf/l/0,cross/2ZzGsBAVZXi.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dde41fca387f7ffac5d442a95f1e8b1146946ce7b5c2bc4590c7ea5cf3ad5d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://xxutuqrikwbrxc3v.filesusr.com
Referer: https://xxutuqrikwbrxc3v.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 01:05:04 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: YBQj/l2z08r5OrUDntgslw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 17436
x-fb-rlafr: 0
x-fb-debug: dtg/S2Mutzq4c7rWOx3VZPqgU6Or6ITK/HPE7EeyX67ucVInGQlCmtGcGMX50lA3RE53xXFQlV059UkGLzTazw==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Wed, 06 Apr 2022 22:19:29 GMT

GET
H2 200 F3TawtyilZG.css
static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/ 15 KB
4 KB 22ms
7ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/F3TawtyilZG.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

36db8dec44926c0c580822c20cbd02abbd690da033331816f3127a37f6214d66

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://xxutuqrikwbrxc3v.filesusr.com
Referer: https://xxutuqrikwbrxc3v.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 18 Apr 2021 01:05:04 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: +1rXUHLvGNitTA8OYrAcOw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3386
x-fb-rlafr: 0
x-fb-debug: NdlBaJOkMQSV+6kQaac+jZ77RY2PTpw/QBDCfNXLqkRUknIw7SA3IsX99xdmmsgn44jCVg4Nl98lFrBctC7row==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 09 Apr 2022 11:00:30 GMT

GET sAcaU2FJdDD.js
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ 0
0

GET
H3-29 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
1 KB 13ms
6ms Image
image/svg+xml 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xxutuqrikwbrxc3v.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1027
x-fb-rlafr: 0
x-fb-debug: EcsZ3D96/HNxOwYUm205TbWT2LAL+A70OXyIakwk6iD7h6GEuzQbm10e5pOP8uaYnP+shFIOG3b5xxKGpmZjAA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
date: Sun, 18 Apr 2021 01:05:04 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-xss-protection: 0
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 16 Apr 2022 18:20:11 GMT

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
1 KB 55ms
39ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://xxutuqrikwbrxc3v.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: no-cache
x-fb-debug: 4M4FWdYJjDagpx69e54PAEzUU6gJ72Oa07WcWY2ZftckjPnznwH6WgtR1OJ/mCbcOhG0Ee2qJHb/Boe6g9Flcw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 18 Apr 2021 01:05:04 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-fb-rlafr: 0
content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
priority: u=3,i
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET SieMvexb4RV.css
static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/ 0
0

GET ZFA2ZKi8_ij.js
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ 0
0

GET wgQtNFI9dU-.js
static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/ 0
0

GET v-qA4RoF1Br.css
static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/ 0
0

GET 29KpN-SSjEW.js
static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook.com
static.xx.fbcdn.net
xxutuqrikwbrxc3v.filesusr.com
static.xx.fbcdn.net
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
34.102.176.152
35a115743f28c533b4b895ea80656cea817eacaea5d39ed93464f3a6c6faca92
36db8dec44926c0c580822c20cbd02abbd690da033331816f3127a37f6214d66
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
bf11455b7b12f062b3e17007e14adde47938edc778688562e92ecbc7d3c3c7e7
dde41fca387f7ffac5d442a95f1e8b1146946ce7b5c2bc4590c7ea5cf3ad5d59

xxutuqrikwbrxc3v.filesusr.com Open in urlscan Pro 34.102.176.152 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

50 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

141 kBTransfer

223 kBSize

0 Cookies

3 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

33 JavaScript Global Variables

0 Cookies

Indicators

xxutuqrikwbrxc3v.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

141 kB
Transfer

223 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!