4093817danieladiaz20569.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==*anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb...
Submission: On May 27 via automatic, source openphish (May 27th 2022, 1:19:24 am UTC) — Scanned from DE

Summary HTTP 13 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 34.102.176.152, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is 4093817danieladiaz20569.filesusr.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 27th 2022. Valid for: 6 months.

This is the only time 4093817danieladiaz20569.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	34.102.176.152 34.102.176.152	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
13	4

1 34.102.176.152 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 152.176.102.34.bc.googleusercontent.com

4093817danieladiaz20569.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 611	24 KB
1	facebook.com facebook.com — Cisco Umbrella Rank: 32	2 KB
1	filesusr.com 4093817danieladiaz20569.filesusr.com	115 KB
13	3

	Domain	Requested by
5	static.xx.fbcdn.net	4093817danieladiaz20569.filesusr.com
1	facebook.com	4093817danieladiaz20569.filesusr.com
1	4093817danieladiaz20569.filesusr.com
13	3

This site contains links to these domains. Also see Links.

Domain
www.oculus.com
portal.facebook.com
pay.facebook.com

Subject Issuer	Validity	Valid
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA	`2022-04-27` - `2022-10-24`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-03-05` - `2022-06-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==*anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=*https://www.facebook.com/profile.php?id=100002908945454**RmFjZWJvb2s=
Frame ID: 22D36F94880A91637E89434DD86ACEDA
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook - log in or sign up

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

13
Requests

54 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

141 kB
Transfer

210 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.oculus.com/
Title: Oculus

Search URL Search Domain Scan URL

URL: https://portal.facebook.com/?refid=8
Title: Portal

Search URL Search Domain Scan URL

URL: https://pay.facebook.com/?refid=8
Title: Facebook Pay

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html Show response
4093817danieladiaz20569.filesusr.com/html/ 114 KB
115 KB 107ms
25ms Document
text/html 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==*anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=*https://www.facebook.com/profile.php?id=100002908945454**RmFjZWJvb2s=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.19.9.1 /
Resource Hash: b3adf423c7838090f1c002e5552a2648c6fec6d99179a314eac95b692d6f0c24

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 21295
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=15552000, immutable
content-length: 117083
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="gfe-default_product_name"
date: Thu, 26 May 2022 19:24:26 GMT
etag: "123c05c2f3ad4792fb218a4c7cd6dc0c"
expires: Thu, 26 May 2022 20:23:01 GMT
last-modified: Tue, 24 May 2022 13:00:21 GMT
report-to: {"group":"gfe-default_product_name","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/default_product_name"}]}
server: openresty/1.19.9.1
timing-allow-origin: *
via: 1.1 google
x-goog-generation: 1653397221079448
x-goog-hash: crc32c=Oq9wWA== md5=EjwFwvOtR5L7IYpMfNbcDA==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 117083
x-guploader-uploadid: ADPycdsPWpI4s-wwpLwlCQwmlVhp8cCcKOfylaqsd-iwGS3EDhg8-QoU0uxv_YimtmbmlH4R6ZBXLStHxRV315Uph2jdcQ
x-seen-by: gcp.us-central-1.media-router-9bbb74d4c-lq8gp

GET
H2 200 iL8HwZlLYmb.css
static.xx.fbcdn.net/rsrc.php/v3/yD/l/0,cross/ 11 KB
3 KB 79ms
24ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yD/l/0,cross/iL8HwZlLYmb.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: 4093817danieladiaz20569.filesusr.com
URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==*anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=*https://www.facebook.com/profile.php?id=100002908945454**RmFjZWJvb2s=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1800cebe8e2983335803aa3e8846c55a4941d2c910e4ead5486f79eafa07abb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://4093817danieladiaz20569.filesusr.com/
Origin: https://4093817danieladiaz20569.filesusr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:19:21 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 5ZYBDmbqxy4OGHzp7XjdOQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 2464
x-fb-rlafr: 0
x-fb-debug: w6j2D/FXtLxAg2HinjBHUHGhmT1PPgf5WnjPKecmCa0HH5g59WStVPtzL0Yp1THlGliZ5YS0jF5ZZTpqxyfNUQ==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Wed, 24 May 2023 09:26:52 GMT

GET
H2 200 0fDi6ijKUyo.css
static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/ 14 KB
4 KB 76ms
22ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/0fDi6ijKUyo.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a2feb4e81ed1f9ed1f2e85ee459971b8b11edb32f0ed68d4a7e70f815b4ad22a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://4093817danieladiaz20569.filesusr.com/
Origin: https://4093817danieladiaz20569.filesusr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:19:21 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: OWlhZUYF2+sqe0+mfBALaw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 3185
x-fb-rlafr: 0
x-fb-debug: GPBlGKrmjSAuBm3luIHMsDWw6VRVosTIN/uX8Q5YDzietnyrK9sn0Vv3Ceam6LZuaVhGBC+BQ+41D3tl9dVxRA==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 25 May 2023 17:43:06 GMT

GET
H2 200 _NRXgGh-rQl.css
static.xx.fbcdn.net/rsrc.php/v3/yM/l/0,cross/ 36 KB
8 KB 80ms
25ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yM/l/0,cross/_NRXgGh-rQl.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d9a55415d52fcf24b87c2429388a948eff22a6a557290f50da69dfeb2626f266

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://4093817danieladiaz20569.filesusr.com/
Origin: https://4093817danieladiaz20569.filesusr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:19:21 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 0Gn1FHAPu7ze+Gb7nrheUQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 7874
x-fb-rlafr: 0
x-fb-debug: 3czWiAKLD9+dMXODnwRqksE5aZBqS2SV3342SMspc0hC15hcHifEWSeETsT+bwVNty3ozIfZEFCw0h1B2jKchQ==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Thu, 25 May 2023 07:46:56 GMT

GET
H2 200 peq7Ozo_0Kf.css
static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/ 33 KB
9 KB 83ms
29ms Stylesheet
text/css 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yG/l/0,cross/peq7Ozo_0Kf.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a5dbcd144b22b3e3d33e4d619a06101e8099449d722c18421051481a1918b39

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://4093817danieladiaz20569.filesusr.com/
Origin: https://4093817danieladiaz20569.filesusr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:19:21 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: eShld5PDU7WHKJ9FK9Ta8A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 8816
x-fb-rlafr: 0
x-fb-debug: XsLvtvP5NEanARAYiNFMUe7pJ2Ox/quMe69OAXgSq51v40FqMbtOUknlA6pc1AQo9Pv1n+7UbbclEqBOcSdAig==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Wed, 24 May 2023 09:26:53 GMT

GET sAcaU2FJdDD.js
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ 0
0

GET
H3 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
1 KB 51ms
21ms Image
image/svg+xml 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4093817danieladiaz20569.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 27 May 2022 01:19:21 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1027
x-fb-rlafr: 0
x-fb-debug: mX4RUC+hKHBiNgZiAHCCnaNK8XUQF6pbBKIRdQurJ6JNk+5P86bJZtOse2hnI5VlNg5rC6oaG19BelrZQ9a86A==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 24 May 2023 23:34:01 GMT

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
2 KB 110ms
51ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4093817danieladiaz20569.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: no-cache
x-fb-debug: dCd03rmb+fCjkCXLsUGiNRlxnfPrJMyC1bDH+vga7ym/IU9buF9MSxPbJlYGqI9XFpU25K0ySfA60uudYkX6iw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 27 May 2022 01:19:21 GMT
strict-transport-security: max-age=15552000; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: image/gif
access-control-allow-origin: *
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-fb-rlafr: 0
priority: u=3,i
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET SieMvexb4RV.css
static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/ 0
0

GET ZFA2ZKi8_ij.js
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ 0
0

GET wgQtNFI9dU-.js
static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/ 0
0

GET v-qA4RoF1Br.css
static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/ 0
0

GET 29KpN-SSjEW.js
static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 28) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 28) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 28) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 28) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 28) Message**: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 29) Message**: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 29) Message**: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 29) Message**: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 29) Message**: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s=(Line 29) Message**: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://4093817danieladiaz20569.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: The resource https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: The resource https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: The resource https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://4093817danieladiaz20569.filesusr.com/html/668496_123c05c2f3ad4792fb218a4c7cd6dc0c.html?NDA5MzgxNw==anVhbml0b2NhbWVsbzc2MkBnbWFpbC5jb20=https://www.facebook.com/profile.php?id=100002908945454RmFjZWJvb2s= Message**: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4093817danieladiaz20569.filesusr.com
facebook.com
static.xx.fbcdn.net
static.xx.fbcdn.net
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.102.176.152
1800cebe8e2983335803aa3e8846c55a4941d2c910e4ead5486f79eafa07abb1
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5a5dbcd144b22b3e3d33e4d619a06101e8099449d722c18421051481a1918b39
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
a2feb4e81ed1f9ed1f2e85ee459971b8b11edb32f0ed68d4a7e70f815b4ad22a
b3adf423c7838090f1c002e5552a2648c6fec6d99179a314eac95b692d6f0c24
d9a55415d52fcf24b87c2429388a948eff22a6a557290f50da69dfeb2626f266

4093817danieladiaz20569.filesusr.com Open in urlscan Pro 34.102.176.152 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

54 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

141 kBTransfer

210 kBSize

0 Cookies

3 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

34 JavaScript Global Variables

0 Cookies

22 Console Messages

Indicators

4093817danieladiaz20569.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

54 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

141 kB
Transfer

210 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!