![](/screenshots/f3728da4-e62f-4d77-8a66-5d1745beb68b.png)
usay86.blob.core.windows.net
Open in
urlscan Pro
20.150.77.164
Malicious Activity!
Public Scan
Effective URL: https://usay86.blob.core.windows.net/usd5/wmtcrs.html?sv=2017-11-09&sr=b&st=2021-11-10T20:32:53Z&se=2021-11-17T22:37:53Z&sp=r&spr=htt...
Submission: On November 10 via api from CZ — Scanned from DE
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 01 on August 15th 2021. Valid for: a year.
This is the only time usay86.blob.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3036::6815:3956 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 20.150.77.164 20.150.77.164 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2606:4700:20:... 2606:4700:20::681a:407 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700:303... 2606:4700:3032::ac43:b92d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 158.69.139.226 158.69.139.226 | 16276 (OVH) (OVH) | |
2 | 67.202.94.86 67.202.94.86 | 32748 (STEADFAST) (STEADFAST) | |
1 | 104.18.28.199 104.18.28.199 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY) | |
7 | 208.100.17.181 208.100.17.181 | 32748 (STEADFAST) (STEADFAST) | |
2 | 2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 67.202.105.31 67.202.105.31 | 32748 (STEADFAST) (STEADFAST) | |
18 | 11 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
usay86.blob.core.windows.net |
ASN32748 (STEADFAST, US)
PTR: ip181.208-100-17.static.steadfastdns.net
ic.tynt.com |
ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net |
ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net
de.tynt.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
tynt.com
cdn.tynt.com ic.tynt.com de.tynt.com |
8 KB |
2 |
fbcdn.net
static.xx.fbcdn.net |
3 KB |
2 |
amung.us
whos.amung.us |
173 B |
2 |
3bp.fun
1 redirects
3bp.fun |
10 KB |
1 |
imgur.com
i.imgur.com |
9 KB |
1 |
dtscout.com
t.dtscout.com |
|
1 |
waust.at
waust.at |
7 KB |
1 |
windows.net
usay86.blob.core.windows.net |
2 KB |
1 |
sx8.eu
1 redirects
sx8.eu |
825 B |
18 | 9 |
Domain | Requested by | |
---|---|---|
7 | ic.tynt.com |
usay86.blob.core.windows.net
|
2 | static.xx.fbcdn.net |
usay86.blob.core.windows.net
|
2 | whos.amung.us |
waust.at
usay86.blob.core.windows.net |
2 | 3bp.fun |
1 redirects
usay86.blob.core.windows.net
|
1 | de.tynt.com |
cdn.tynt.com
|
1 | i.imgur.com |
usay86.blob.core.windows.net
|
1 | cdn.tynt.com |
waust.at
|
1 | t.dtscout.com |
waust.at
|
1 | waust.at |
usay86.blob.core.windows.net
|
1 | usay86.blob.core.windows.net | |
1 | sx8.eu | 1 redirects |
18 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.blob.core.windows.net Microsoft RSA TLS CA 01 |
2021-08-15 - 2022-08-15 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-08-04 - 2022-08-03 |
a year | crt.sh |
*.dtscout.com Sectigo RSA Domain Validation Secure Server CA |
2021-10-28 - 2022-11-27 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
*.tynt.com Sectigo RSA Domain Validation Secure Server CA |
2021-09-23 - 2022-09-30 |
a year | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-08-20 - 2021-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://usay86.blob.core.windows.net/usd5/wmtcrs.html?sv=2017-11-09&sr=b&st=2021-11-10T20:32:53Z&se=2021-11-17T22:37:53Z&sp=r&spr=https&sig=ee0wJ4l0R9zxzg3udDDmMt5WE3S77cdMWcaUrXT4Klk%3D
Frame ID: 8CCF801A225B198A08CC72DBFB1763BE
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/f3728da4-e62f-4d77-8a66-5d1745beb68b.png)
Page Title
Melden Sie sich bei Facebook an, um das Video anzusehenPage URL History Show full URLs
-
https://sx8.eu/MPBB4x
HTTP 302
https://usay86.blob.core.windows.net/usd5/wmtcrs.html?sv=2017-11-09&sr=b&st=2021-11-10T20:32:53Z&se=2021-11-17T22... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://sx8.eu/MPBB4x
HTTP 302
https://usay86.blob.core.windows.net/usd5/wmtcrs.html?sv=2017-11-09&sr=b&st=2021-11-10T20:32:53Z&se=2021-11-17T22:37:53Z&sp=r&spr=https&sig=ee0wJ4l0R9zxzg3udDDmMt5WE3S77cdMWcaUrXT4Klk%3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://3bp.fun/async?&user=christofer&html=mobile HTTP 301
- https://3bp.fun/async/?&user=christofer&html=mobile
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
wmtcrs.html
usay86.blob.core.windows.net/usd5/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d.js
waust.at/ |
13 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
3bp.fun/async/ Redirect Chain
|
43 KB 9 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
t.dtscout.com/i/ |
0 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 145 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.js
cdn.tynt.com/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wCOStwT.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
28 B 28 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5NR43BsYs8o.png
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lqbz1hqlAFx.png
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
de.tynt.com/deb/ |
4 B 202 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
0 227 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| _wau string| t string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| d object| dom string| head string| bod function| disableIE function| disableNS object| _33Across function| __uspapi0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3bp.fun
cdn.tynt.com
de.tynt.com
i.imgur.com
ic.tynt.com
static.xx.fbcdn.net
sx8.eu
t.dtscout.com
usay86.blob.core.windows.net
waust.at
whos.amung.us
104.18.28.199
151.101.12.193
158.69.139.226
20.150.77.164
208.100.17.181
2606:4700:20::681a:407
2606:4700:3032::ac43:b92d
2606:4700:3036::6815:3956
2a03:2880:f01c:8012:face:b00c:0:3
67.202.105.31
67.202.94.86
0c4fbfd9d019d99f3e026fe0a41e5158bb3ec85c8c634d25328e4862559fc784
0fd58536eb089f2060e86f14e60ef83f68169fbe34d95f8cdc2ad60abe4bb8c9
2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62
25d728c6811a3131e7bd1dd4ffb13f25038038de6a3977374302dedda9cf123f
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
85b85c2a0ccbea65b75faf94cd09d2fd1327971b74b4bff24a92839eff8b7a09
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd
9615b777212478a41835e410c9897cd544b98c5473b7b73cbec777f1db2d5404
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb2d42f3165ed951091868fc28231519245c62596e1664e635d0f7ded7436f57