rosatcado.com Open in urlscan Pro
2606:4700:30::681b:b1fe  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response rosatcado.com/paypal.com/	51 KB 15 KB	540ms 539ms	Document text/html	2606:4700:30::681b:b1fe Cloudflare
General Check archive.org Show headers Download Go to Full URL https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:b1fe , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 8c891cbd830a38bc42b0e9d052a14f96cd8718958dbf3436f6d2f1c3f6ce42f2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority rosatcado.com :scheme https :path /paypal.com/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Sun, 07 Apr 2019 02:01:29 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dca1745517f1f70544a865d9d10e646ba1554602489; expires=Mon, 06-Apr-20 02:01:29 GMT; path=/; domain=.rosatcado.com; HttpOnly vary Accept-Encoding x-frame-options SAMEORIGIN x-xss-protection 1; mode=block x-content-type-options nosniff expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4c3869f67cfebec1-FRA content-encoding br
GET H2	200	TV4TWefxnzY.css static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/	68 KB 15 KB	7ms 6ms	Stylesheet text/css	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/TV4TWefxnzY.css Requested by Host: rosatcado.com URL: https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash c173fad9fbc0862e586c38b7d4e285773c0c6fa9c64a4e207979bb3f6ba126e1 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://rosatcado.com/ Origin https://rosatcado.com Response headers x-fb-debug mChz2IKkjJgQLcUXC57apOS0SwHPzlekeEdx9fAZA+Uwx2MPbJRxxWhBVivtrWft+rGlQAn+G0t6q06Ap7nWew== content-encoding br x-content-type-options nosniff last-modified Mon, 01 Jan 2001 08:00:00 GMT content-md5 OdNBPronjqr+m4HkjcbGBg== access-control-allow-origin * date Sun, 07 Apr 2019 02:01:29 GMT vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control public,max-age=31536000,immutable timing-allow-origin * content-length 14829 expires Thu, 02 Apr 2020 06:27:30 GMT
GET H2	200	8umx1EH0nR8.css static.xx.fbcdn.net/rsrc.php/v3/yL/l/0,cross/	12 KB 3 KB	7ms 6ms	Stylesheet text/css	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yL/l/0,cross/8umx1EH0nR8.css Requested by Host: rosatcado.com URL: https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 68b54a68924baec7bcb6fc4cadfbcda16586484b9afd0dc72d3fba742dd7064b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://rosatcado.com/ Origin https://rosatcado.com Response headers x-fb-debug VkLB2a3F0QKBFNeL6Eah90HpWxxwrNj0lD5lOy88SC/1wpfSsCNUlJrrWGBDitnER9WPMlKd7JhCoqDy49rp2A== content-encoding br x-content-type-options nosniff last-modified Mon, 01 Jan 2001 08:00:00 GMT content-md5 5GFKQgFOeIvHJGMEq/zGmA== access-control-allow-origin * date Sun, 07 Apr 2019 02:01:29 GMT vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control public,max-age=31536000,immutable timing-allow-origin * content-length 2819 expires Sun, 05 Apr 2020 09:00:10 GMT
GET H2	200	TDd2CggPhc1.js Show response static.xx.fbcdn.net/rsrc.php/v3i0sz4/yh/l/vi_VN/	410 KB 97 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://static.xx.fbcdn.net/rsrc.php/v3i0sz4/yh/l/vi_VN/TDd2CggPhc1.js Requested by Host: rosatcado.com URL: https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 7c883f4783ec7cdd5095356379a0b1f8ff53fffa36f3ba2343e8c1545610df3f Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://rosatcado.com/ Origin https://rosatcado.com Response headers x-fb-debug kgKdPf2K1EhhW/Jwf8RohIz0vA+hzXe2Bzvv8RvAvyJ1kQZwO+kBzubXE5AECAZzq7gU6JiDL8Lg8R0TMyhpOg== content-encoding br x-content-type-options nosniff last-modified Mon, 01 Jan 2001 08:00:00 GMT content-md5 LJDQViQxGy0YRbbLuw++eA== access-control-allow-origin * date Sun, 07 Apr 2019 02:01:29 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 status 200 cache-control public,max-age=31536000,immutable timing-allow-origin * content-length 99022 expires Sat, 04 Apr 2020 23:05:53 GMT
GET H2	200	hsts-pixel.gif facebook.com/security/	43 B 201 B	61ms 60ms	Image image/gif	2a03:2880:f129:83:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://facebook.com/security/hsts-pixel.gif Requested by Host: rosatcado.com URL: https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f129:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://rosatcado.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding br x-content-type-options nosniff status 200 vary Origin, Accept-Encoding x-xss-protection 0 pragma no-cache x-fb-debug jQRRIcBVinvI4+7n/nIRqTjalgkqfuoObcFJFC49QQH4LSePlLCVRuR1vRVfjxFrVO95BSwGp1XavxT7QuhKkQ== date Sun, 07 Apr 2019 02:01:29 GMT expect-ct max-age=86400, report-uri="https://reports.fb.com/expectct/" x-frame-options DENY access-control-allow-methods OPTIONS content-type image/gif access-control-allow-origin * access-control-expose-headers X-FB-Debug, X-Loader-Length cache-control private, no-cache, no-store, must-revalidate access-control-allow-credentials true content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET		_S8wqX_UBCI.js static.xx.fbcdn.net/rsrc.php/v3ijO64/yL/l/vi_VN/	0 0
GET H2	200	g7ALbzcD4QX.png static.xx.fbcdn.net/rsrc.php/v3/yV/r/	313 B 477 B	6ms 5ms	Image image/png	2a03:2880:f02d:12:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/yV/r/g7ALbzcD4QX.png Requested by Host: rosatcado.com URL: https://rosatcado.com/paypal.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash fe22803f8d144324b4a18144988e01fb47c98d355cc91873e63fb768b368143b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://static.xx.fbcdn.net/rsrc.php/v3/y-/l/0,cross/TV4TWefxnzY.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-fb-debug yIJzIiJDlRkquWdA8baW3BEOqG4JcZAwoHT7VtnY3on+McK7y/B7OclO0XJVihLUXdBm3H6sF6PQNiLr/XQwCg== x-content-type-options nosniff last-modified Mon, 01 Jan 2001 08:00:00 GMT content-md5 wfwXd1O13RkU1lKrZmf//w== access-control-allow-origin * date Sun, 07 Apr 2019 02:01:29 GMT content-type image/png status 200 cache-control public,max-age=31536000,immutable timing-allow-origin * content-length 313 expires Wed, 01 Apr 2020 15:45:38 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

static.xx.fbcdn.net

URL

https://static.xx.fbcdn.net/rsrc.php/v3ijO64/yL/l/vi_VN/_S8wqX_UBCI.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| envFlush object| Env number| __DEV__ undefined| __p function| emptyFunction function| __annotator function| __bodyWrapper function| __t function| __w function| FB_enumerate function| __m object| babelHelpers function| define function| require function| requireDynamic function| requireLazy function| __d object| ErrorUtils object| TimeSlice function| CavalryLogger function| __updateOrientation function| ProfilingCounters

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.rosatcado.com/	1970-01-19 08:35:38	Name: __cfduid Value: dca1745517f1f70544a865d9d10e646ba1554602489

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3i0sz4/yh/l/vi_VN/TDd2CggPhc1.js(Line 55) Message: ErrorUtils caught an error: "Requiring module "MCoreInit" with unresolved dependencies: MCoreInit is waiti...". Subsequent errors won't be logged; see https://fburl.com/debugjs.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook.com
rosatcado.com
static.xx.fbcdn.net
static.xx.fbcdn.net
2606:4700:30::681b:b1fe
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f129:83:face:b00c:0:25de
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
68b54a68924baec7bcb6fc4cadfbcda16586484b9afd0dc72d3fba742dd7064b
7c883f4783ec7cdd5095356379a0b1f8ff53fffa36f3ba2343e8c1545610df3f
8c891cbd830a38bc42b0e9d052a14f96cd8718958dbf3436f6d2f1c3f6ce42f2
c173fad9fbc0862e586c38b7d4e285773c0c6fa9c64a4e207979bb3f6ba126e1
fe22803f8d144324b4a18144988e01fb47c98d355cc91873e63fb768b368143b