facebook.oneye.us
Open in
urlscan Pro
38.95.11.236
Malicious Activity!
Public Scan
Submission Tags: @phishunt_io
Submission: On February 13 via api from DE — Scanned from US
Summary
TLS certificate: Issued by R3 on February 13th 2023. Valid for: 3 months.
This is the only time facebook.oneye.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 38.95.11.236 38.95.11.236 | 174 (COGENT-174) (COGENT-174) | |
29 | 2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
33 | 3 |
ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 660 |
248 KB |
3 |
oneye.us
facebook.oneye.us |
68 KB |
33 | 2 |
Domain | Requested by | |
---|---|---|
29 | static.xx.fbcdn.net |
facebook.oneye.us
static.xx.fbcdn.net |
3 | facebook.oneye.us |
facebook.oneye.us
static.xx.fbcdn.net |
33 | 2 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
facebook.oneye.us R3 |
2023-02-13 - 2023-05-14 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2022-11-22 - 2023-02-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://facebook.oneye.us/
Frame ID: 96D63C4910115502653A3D676AE18FBA
Requests: 34 HTTP requests in this frame
18 Outgoing links
These are links going to different origins than the main page.
Title: Bahasa Melayu
Search URL Search Domain Scan URL
Title: 中文(简体)
Search URL Search Domain Scan URL
Title: Bahasa Indonesia
Search URL Search Domain Scan URL
Title: Tiếng Việt
Search URL Search Domain Scan URL
Title: ภาษาไทย
Search URL Search Domain Scan URL
Title: العربية
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: Deutsch
Search URL Search Domain Scan URL
Title: Messenger
Search URL Search Domain Scan URL
Title: Meta Pay
Search URL Search Domain Scan URL
Title: Oculus
Search URL Search Domain Scan URL
Title: Portal
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Bulletin
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
facebook.oneye.us/ |
60 KB 63 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
HKvYlIbYGpN.css
static.xx.fbcdn.net/rsrc.php/v3/ye/l/0,cross/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
D3KHccI74jr.css
static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
VIXBkQhD3eU.css
static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XznY7q1olI3.css
static.xx.fbcdn.net/rsrc.php/v3/yW/l/0,cross/ |
32 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yotEdcUw9Gj.css
static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/ |
567 B 438 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uaRUZk18yNI.css
static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/ |
1 KB 647 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5IY8j2Ul2i6.js
static.xx.fbcdn.net/rsrc.php/v3/yy/r/ |
306 KB 81 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7e_EowNUO3T.js
static.xx.fbcdn.net/rsrc.php/v3i7M54/y9/l/en_US/ |
63 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
F3saR61Z2qK.js
static.xx.fbcdn.net/rsrc.php/v3/y3/r/ |
26 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
kgCswNiKScM.js
static.xx.fbcdn.net/rsrc.php/v3/y8/r/ |
735 B 441 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
LaibjggSBLZ.js
static.xx.fbcdn.net/rsrc.php/v3/yT/r/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
9LgNeX-IY5B.js
static.xx.fbcdn.net/rsrc.php/v3/y8/r/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
RBEuyj_n1fU.js
static.xx.fbcdn.net/rsrc.php/v3/yA/r/ |
28 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qu9vi-bmWl3.js
static.xx.fbcdn.net/rsrc.php/v3/y-/r/ |
8 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
O7nelmd9XSI.png
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ |
95 B 146 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
kNYkizqJr9j.png
static.xx.fbcdn.net/rsrc.php/v3/yK/r/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
hsts-pixel.gif
facebook.oneye.us/security/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
78 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
p0bcnVbl1Lr.js
static.xx.fbcdn.net/rsrc.php/v3/yC/r/ |
34 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
7x0wxebSNxQ.js
static.xx.fbcdn.net/rsrc.php/v3/yg/r/ |
50 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fu0HzUadWDw.js
static.xx.fbcdn.net/rsrc.php/v3/yt/r/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
I1AAaeVi4OB.js
static.xx.fbcdn.net/rsrc.php/v3/yX/r/ |
34 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
LgvwffuKmeX.js
static.xx.fbcdn.net/rsrc.php/v3/yf/r/ |
42 KB 13 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_tJ17sGyxOX.js
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
18 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ue_OWlkLDZP.js
static.xx.fbcdn.net/rsrc.php/v3/yY/r/ |
50 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
VUM-Q7pMDfO.js
static.xx.fbcdn.net/rsrc.php/v3iqES4/y7/l/en_US/ |
43 KB 13 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
0esKm-yyZ6x.js
static.xx.fbcdn.net/rsrc.php/v3/y1/r/ |
7 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vyPmDHZCAgG.js
static.xx.fbcdn.net/rsrc.php/v3/yh/r/ |
4 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
HvSx_4D8oKD.js
static.xx.fbcdn.net/rsrc.php/v3/y7/r/ |
14 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
skazhVdw245.js
static.xx.fbcdn.net/rsrc.php/v3/yZ/r/ |
2 KB 944 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
bz
facebook.oneye.us/ajax/ |
0 3 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
bz
facebook.oneye.us/ajax/ |
0 3 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- facebook.oneye.us
- URL
- https://facebook.oneye.us/security/hsts-pixel.gif
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)72 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange function| envFlush object| Env number| __DEV__ undefined| MAX_CALLS_TO_EXEC function| __annotator function| __bodyWrapper function| __t function| __w function| emptyFunction function| FB_enumerate function| __m object| babelHelpers function| define function| require function| importDefault function| importNamespace function| requireDynamic function| requireLazy object| __onBeforeModuleFactory object| __onAfterModuleFactory function| __d function| $RefreshReg$ function| $RefreshSig$ function| getErrorSafe object| ErrorGuard object| ErrorSerializer object| ErrorUtils function| Arbiter object| JSCC function| $ function| ge object| Parent object| TimeSlice function| goURI object| Bootloader object| PageEvents function| _domcontentready function| onloadRegister_DEPRECATED function| onloadRegister function| onafterloadRegister_DEPRECATED function| onafterloadRegister function| onleaveRegister function| onbeforeunloadRegister function| onunloadRegister function| $E number| __bigPipeFactory string| _script_path object| onloadhooks function| now_inl number| __bigPipeFR number| __bigPipeCtor object| bigPipe object| PageHooks function| _domreadyHook function| _onloadHook function| runHook function| runHooks function| keep_window_set_as_loaded function| AsyncRequest object| onbeforeunloadhooks object| __FB_STORE object| onleavehooks object| onunloadhooks function| intl_set_string_manager_mode function| intl_set_xmode function| intl_set_rmode function| intl_set_locale boolean| domready object| onafterunloadhooks boolean| loaded2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.facebook.oneye.us/ | Name: _js_datr Value: E1TqYx37Qnki9I4kf3D7qIhD |
|
.facebook.oneye.us/ | Name: wd Value: 1600x1200 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; |
Strict-Transport-Security | max-age=15552000; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebook.oneye.us
static.xx.fbcdn.net
facebook.oneye.us
2a03:2880:f012:10c:face:b00c:0:3
38.95.11.236
0e42d5cd60b32883fb89fe1bfd46521ff400dd9c8c4d890cc9a72e9553596169
0f90ce92f6d627a995bf0300ac429ace9c65072877367d8bd8e5bc2052ceae93
16d3c0482184680796a3622434a267886c1b38335d40b5e3732c89b807c8f2a9
1841af3d8a861352c543e1ecabe489bb4185a289a3b644f2ef3bc6a62562ca94
1ed26be1faf820c67ff656420ca4f6692cb0ca3a0b6e853065733a5a9a0cac60
33ea9d87d9b2ee6c4ce1192521500deecbf3c57c2fb4b793216e52eece601358
38f1c6cbbf1f35dc768312b5fa0e5a2a114d344ced207f8869844037dbc06415
3b866d87c597a64af368b16e8125c701c9912f87e1b88e56cbb3af4cefb98670
54338a6613654cab4d723709f45b831d63ba155ec6814409f899697b3ede052e
573e04a6018b8bd945eea045f7f6a636ae687346be232c31aefb35b2148c6ff8
626814a1d050ac62d3290457b6c9986220b14b4719e5e7ed54c84ae75cd07c37
634e0d8ad21819d29c415d6b17423d16f462f6ba0b16892ccaf78503d09d2bc5
80f1d459346853d9751e29d50c1871208c883585432d51c5299e1564a6759af5
84ffbb6dd09d0211c8a5217d83ea2717269ac772e0e8e6710b812b80efc41e2f
8dffa3380f50865b5c70c81f0184693c003ea2359ca6becdc2c5e74fdc22601a
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
96d4e264508293176bc25637ee602610c7f20be218cc71137dd8b0951000e50d
96eb82977f26ae33870877e2c2a236a91afa7bf13f2a7ab1505af1c73e9d7eb3
a1794060e1ad5af5abac2f5f1ddc804bffc1efeff0897600e637905512d24ebd
a77aabd09c9363b9a7e78221b1dfaa2f7f20d2c6b88f839c9118db747044bfad
ab6777f622dce53efa7d6a93432292afba7757445eb4cc111b25810882375b98
ae513c59331d68969d1f2f4dc4a4061a6138334da007ad2580aae88c2b5c84d6
b2251b3ac8040518353b22f3fd0fc16181a89b15042bb5073ce2510470463ddd
b57553db448cc94b9202e3d4b01007346f267b43ea076b9484c03eb45cc089fd
bebec4e6f82883404c87da8c64015d716206c061bd10005c4b1b90f14eec03a7
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
ca6db617eb8de1d4529fe3be6904ccac7f642e3e3a9fd63b9266e8154b24ad77
cd25fa509056798e6bb2bed23fe41ae7ce99083983e2c14fa519a70cda0ba9bb
df54d6f3bb19f016554cc90a927e072696d95bdab0fb54a1d7b399529ac492b4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2bd1857d2e7bd8cb1090eb6f3d3a65fab61990073e39d04f845ab93cd9c4aca
faaeb80123a9c17961b97c4f556f8e13f8fc3ce343b61e053414e8889668811a