0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com Open in urlscan Pro
2600:9000:2840:2200:0:7dcd:9780:93a1  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html Show response 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/	747 KB 749 KB	230ms 74ms	Document text/html	2600:9000:2840:2200:0:7dcd:9780:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2840:2200:0:7dcd:9780:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software openresty/1.25.3.2 / Resource Hash 9ea7ac42b40cd5851bada6e64afaba220461ea51f3a3688605cfd579efd63182 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers accept-ranges bytes access-control-allow-origin * age 2521 alt-svc h3=":443"; ma=86400 cache-control public, max-age=15552000, immutable content-length 765106 content-type text/html; charset=utf-8 date Sat, 14 Sep 2024 13:32:50 GMT etag "975d47f0ac266cbe347c376d4cbaf9d7" expires Sat, 14 Sep 2024 14:32:50 GMT last-modified Thu, 15 Aug 2024 23:00:18 GMT server openresty/1.25.3.2 timing-allow-origin * via 1.1 google, 1.1 bf0943fd0f38bf92ee970a229713bd76.cloudfront.net (CloudFront) x-amz-cf-id -ZSXtGJRhfehUfQ70aV7mIJ4KBkzt_7ROXwsSe-n6WwYSrsoBVtJMw== x-amz-cf-pop JFK52-P7 x-cache Hit from cloudfront x-seen-by gcp.us-central-1.media-router-56f88799f9-ljlcc
GET H2	200	55013136-widget_css_bundle.css www.blogger.com/static/v1/widgets/	30 KB 7 KB	241ms 65ms	Stylesheet text/css	2607:f8b0:4006:806::2009 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.blogger.com/static/v1/widgets/55013136-widget_css_bundle.css Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:806::2009 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 11 Sep 2024 16:04:30 GMT content-encoding gzip x-content-type-options nosniff age 252622 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 6620 x-xss-protection 0 last-modified Wed, 11 Sep 2024 08:59:34 GMT server sffe vary Accept-Encoding report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Thu, 11 Sep 2025 16:04:30 GMT
GET H2	200	1938605287-css_bundle_v2.css www.blogger.com/static/v1/widgets/	36 KB 8 KB	247ms 72ms	Stylesheet text/css	2607:f8b0:4006:806::2009 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.blogger.com/static/v1/widgets/1938605287-css_bundle_v2.css Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:806::2009 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 765601709b703cd426bea3c604efc4a3efcf22e886eb8b78f4521b5d5f8d0482 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Thu, 12 Sep 2024 21:59:19 GMT content-encoding gzip x-content-type-options nosniff age 144933 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 7999 x-xss-protection 0 last-modified Wed, 27 Mar 2019 18:23:10 GMT server sffe vary Accept-Encoding report-to {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="blogger-tech" expires Fri, 12 Sep 2025 21:59:19 GMT
GET		vue@next unpkg.com/	0 0
GET H3	200	4lCu2zih0ca.svg static.xx.fbcdn.net/rsrc.php/y1/r/	2 KB 1 KB	135ms 62ms	Image image/svg+xml	157.240.241.1 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/y1/r/4lCu2zih0ca.svg Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.241.1 Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-lga3.fbcdn.net Software / Resource Hash 0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 14 Sep 2024 14:14:52 GMT content-encoding zstd x-content-type-options nosniff content-md5 n3VoHwQDdPdD5BC1HAoIkw== document-policy force-load-at-top x-fb-server-load 38 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 986 reporting-endpoints permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality GOOD; q=0.7, rtt=59, rtx=0, c=23, mss=1232, tbw=4420, tp=9, tpl=0, uplat=0, ullat=-1 x-fb-debug O6yLR6Q7B8USw+NK1XaIp075F/PULUb1P8r+WwBZ5642YUEhcTz8pfeIGFV9HV9EPDcnWCmwUpqbxQFuM+/lRQ== last-modified Mon, 01 Jan 2001 08:00:00 GMT vary Accept-Encoding report-to {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/svg+xml access-control-allow-origin * origin-agent-cluster ?1 cache-control public,max-age=31536000,immutable permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * priority u=1,i expires Wed, 03 Sep 2025 11:13:37 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 34 KB	236ms 65ms	Script text/javascript	2607:f8b0:4006:80a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80a::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 12 Sep 2024 12:28:00 GMT content-encoding gzip x-content-type-options nosniff age 179212 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 12 Sep 2025 12:28:00 GMT
GET H2	403	YQNfPR9MJfx.png 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/v3/yO/r/	9 B 431 B	256ms 256ms	Image text/plain	2600:9000:2840:2200:0:7dcd:9780:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/v3/yO/r/YQNfPR9MJfx.png Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2840:2200:0:7dcd:9780:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software openresty/1.25.3.2 / Resource Hash 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3 Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 14 Sep 2024 14:14:52 GMT via 1.1 google, 1.1 bf0943fd0f38bf92ee970a229713bd76.cloudfront.net (CloudFront) server openresty/1.25.3.2 x-amz-cf-pop JFK52-P7 x-cache Error from cloudfront content-type text/plain access-control-allow-origin * cache-control no-cache, private, must-revalidate, proxy-revalidate, no-store timing-allow-origin * alt-svc h3=":443"; ma=86400 content-length 9 x-amz-cf-id doWfh0hBLQWHUlWwVkibo1NqzqtQfFXfyYdNOnQpEUwC0BKKvEV5aQ== x-seen-by gcp.us-central-1.media-router-56f88799f9-xdkhk
GET H3	200	7eIprq01c1g.png exploits-de.com/blogger/assets/images/	8 KB 8 KB	128ms 44ms	Image image/png	172.67.152.49 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://exploits-de.com/blogger/assets/images/7eIprq01c1g.png Requested by Host: 0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.152.49 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ba1597ec9317219ba5a2bfde2e75f6c5fb7dc185c695073c7166ea09bc29056b Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 14 Sep 2024 14:14:52 GMT cf-cache-status HIT last-modified Fri, 10 Dec 2021 01:54:59 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 187621 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BYaI6KyHwwvmEzPMTiMZh11iaciTgabZrHoCyLk%2BhpCOiy3m%2FeUtYx666XdT48j0qpzIoJ%2BAXmk9DCn%2FelW6i9BIutZya80j8vPTi14niA5al1QD%2F2L8kmOfQqh86LD133E%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 8c30fc60cae14c18-MIA alt-svc h3=":443"; ma=86400 content-length 7798
GET H3	200	favicoin-facebook.ico exploits-fr.com/blogger/assets/images/	5 KB 2 KB	199ms 46ms	Other image/x-icon	172.67.191.13 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://exploits-fr.com/blogger/assets/images/favicoin-facebook.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.191.13 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c636a92a12eb33629e6dcadc67e49651ac54e8f3b18a03c805668505f05c885a Request headers Referer https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 14 Sep 2024 14:14:52 GMT content-encoding gzip cf-cache-status HIT last-modified Fri, 25 Feb 2022 17:41:16 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 187620 vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UMpjsk4hibgT5Rh9TjUgYUSL1%2FPMBHjw%2BcrrJjz51%2BQ48Rw%2BsPssuSUU47dspwf9975qbOCC92uLuYencpwOSXO6GlH95rvVryqKQurK3T21%2FTbKOjIcUk1%2FC1RTBin9j%2Bk%3D"}],"group":"cf-nel","max_age":604800} content-type image/x-icon cache-control max-age=14400 accept-ranges bytes cf-ray 8c30fc62ba119ab9-MIA alt-svc h3=":443"; ma=86400 content-length 1564

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

unpkg.com

URL

https://unpkg.com/vue@next

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| regexS object| regex string| tmpURL object| llegaron object| uno object| myString object| myArray string| urlfin string| regreso string| enblanco string| ip function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx(Line 47) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://unpkg.com/vue@next, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx(Line 47) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://unpkg.com/vue@next, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx(Line 47) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/html/a96d75_975d47f0ac266cbe347c376d4cbaf9d7.html?*cwfjazzaz21hawwuy29t*http:/www.ibaebc.com.mx Message: [DOM] Input elements should have autocomplete attributes (suggested: "username"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com/v3/yO/r/YQNfPR9MJfx.png Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0yeee0yeeefacebookgrup0artisticobajacalifornia.filesusr.com
ajax.googleapis.com
exploits-de.com
exploits-fr.com
static.xx.fbcdn.net
unpkg.com
www.blogger.com
unpkg.com
157.240.241.1
172.67.152.49
172.67.191.13
2600:9000:2840:2200:0:7dcd:9780:93a1
2607:f8b0:4006:806::2009
2607:f8b0:4006:80a::200a
0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a
1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
765601709b703cd426bea3c604efc4a3efcf22e886eb8b78f4521b5d5f8d0482
78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3
9ea7ac42b40cd5851bada6e64afaba220461ea51f3a3688605cfd579efd63182
ba1597ec9317219ba5a2bfde2e75f6c5fb7dc185c695073c7166ea09bc29056b
c636a92a12eb33629e6dcadc67e49651ac54e8f3b18a03c805668505f05c885a