drugclouds.com Open in urlscan Pro
192.185.121.75  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/	484 KB 91 KB	396ms 270ms	Document text/html	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash aa5e8bc5db3abd2274d3dbe464b7b703a087f93ccd877f01a30616297529bc28 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Pragma no-cache Date Fri, 27 Apr 2018 04:57:43 GMT Content-Encoding gzip Server nginx/1.12.2 Transfer-Encoding chunked Connection keep-alive Content-Type text/html; charset=utf-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie PHPSESSID=7c234f89e764ae6ad8ca569d9951adb7; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	jAboDKQKmYT.css drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	21 KB 8 KB	140ms 139ms	Stylesheet text/css	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/jAboDKQKmYT.css Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash e975ac2a7614deb822f8d824d47199ef2f6c47dc1638e0537ee65e4a92a0a498 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Cookie PHPSESSID=7c234f89e764ae6ad8ca569d9951adb7 Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:44 GMT Content-Encoding gzip Last-Modified Sat, 28 Oct 2017 13:23:28 GMT Server nginx/1.12.2 Connection keep-alive Transfer-Encoding chunked Content-Type text/css
GET H/1.1	200 OK	DNtiLQFKsGZ.css drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	39 KB 10 KB	140ms 140ms	Stylesheet text/css	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/DNtiLQFKsGZ.css Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash 890022d6c5a90c645601df5bebcb59ed68e34f057324e572ff05e001147406e6 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Cookie PHPSESSID=7c234f89e764ae6ad8ca569d9951adb7 Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:44 GMT Content-Encoding gzip Last-Modified Sat, 28 Oct 2017 13:34:46 GMT Server nginx/1.12.2 Connection keep-alive Transfer-Encoding chunked Content-Type text/css
GET H/1.1	200 OK	IJdf31duJDa.css drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files//	7 KB 2 KB	140ms 139ms	Stylesheet text/css	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files//IJdf31duJDa.css Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash 617fc34ef1c27420bf7b95c342cfa01b41494050350b3a27932cdefe9b0d909c Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Cookie PHPSESSID=7c234f89e764ae6ad8ca569d9951adb7 Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:44 GMT Content-Encoding gzip Last-Modified Sat, 28 Oct 2017 13:35:10 GMT Server nginx/1.12.2 Connection keep-alive Transfer-Encoding chunked Content-Type text/css
GET		uWhQ33IUqQ1.js static.xx.fbcdn.net/rsrc.php/v3iuD54/y8/l/en_US/	0 0
GET H/1.1	200 OK	jquery-1.9.1.min.js Show response code.jquery.com/	90 KB 38 KB	365ms 247ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.min.js Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Request headers Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Fri, 27 Apr 2018 04:57:44 GMT Content-Encoding gzip Last-Modified Fri, 24 Oct 2014 00:16:07 GMT Server nginx ETag W/"54499a47-169d5" Vary X-HW 1524805064.dop006.fr8.shc,1524805064.dop006.fr8.t,1524805064.cds018.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 37959
GET S	200	jquery-3.2.1.min.js Show response arxdock.com/ajax/libs/	85 KB 30 KB	345ms 282ms	Script application/javascript	104.24.113.155 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://arxdock.com/ajax/libs/jquery-3.2.1.min.js?version=KcpLVgPZYz Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol SPDY Server 104.24.113.155 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/5.6.25 Resource Hash 75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35 Request headers Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers pragma no-cache date Fri, 27 Apr 2018 04:57:44 GMT content-encoding gzip cf-cache-status MISS last-modified Fri, 27 Apr 2018 04:57:44 GMT server cloudflare x-powered-by PHP/5.6.25 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 411eb5c5ad2096dc-FRA expires Thu, 26 Apr 2018 04:57:44 GMT
GET H/1.1	200 OK	hsts-pixel.gif drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	43 B 258 B	134ms 133ms	Image image/gif	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/hsts-pixel.gif?c=3.2 Requested by Host: drugclouds.com URL: http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:44 GMT Last-Modified Sat, 28 Oct 2017 13:38:32 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	GNw16iEvhsm.png drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	8 KB 9 KB	136ms 135ms	Image image/png	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/GNw16iEvhsm.png Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.min.js Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash 0e59c596c4eafdb097ae99641f388940a8489faa66ebd81909d9c3b1f8834937 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/DNtiLQFKsGZ.css Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/DNtiLQFKsGZ.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:45 GMT Last-Modified Sat, 28 Oct 2017 13:28:02 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 8607 Content-Type image/png
GET H/1.1	200 OK	VTa0FPdgwLc.png drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	8 KB 8 KB	134ms 134ms	Image image/png	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/VTa0FPdgwLc.png Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.min.js Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash 0746cdef88e6a76da9b0b066b263827692f8f8f1bcafce8989ca19b22bbae65b Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/jAboDKQKmYT.css Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/jAboDKQKmYT.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:45 GMT Last-Modified Sat, 28 Oct 2017 13:23:26 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 7865 Content-Type image/png
GET H/1.1	200 OK	Y8VrvG-1crh.png drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/	513 B 729 B	136ms 135ms	Image image/png	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/Y8VrvG-1crh.png Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.min.js Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash e1c29c46b757402e0b8daf340c55e06625dfea1a6251cc9961d6212347f1ea23 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/DNtiLQFKsGZ.css Connection keep-alive Cache-Control no-cache Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/index_files/DNtiLQFKsGZ.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Fri, 27 Apr 2018 04:57:45 GMT Last-Modified Sat, 28 Oct 2017 13:32:18 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 513 Content-Type image/png
GET H/1.1	200 OK	Cookie set check.php Show response drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/	0 347 B	258ms 257ms	XHR text/html	192.185.121.75 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/check.php?var=error Requested by Host: arxdock.com URL: https://arxdock.com/ajax/libs/jquery-3.2.1.min.js?version=KcpLVgPZYz Protocol HTTP/1.1 Server 192.185.121.75 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS ns1314.websitewelcome.com Software nginx/1.12.2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host drugclouds.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept */* Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ X-Requested-With XMLHttpRequest Connection keep-alive Cache-Control no-cache Accept */* Referer http://drugclouds.com/facebookdotcomfriendcheck.drugclouds.com/facebook/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Pragma no-cache Date Fri, 27 Apr 2018 04:57:45 GMT Server nginx/1.12.2 Connection keep-alive Content-Type text/html Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie PHPSESSID=42e0b05bcf97bc4461261ab18ea8a6ce; path=/ Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

static.xx.fbcdn.net

URL

https://static.xx.fbcdn.net/rsrc.php/v3iuD54/y8/l/en_US/uWhQ33IUqQ1.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _0x36ee function| _0xe36e function| _0x2c231d function| _0x475d51 function| _0x47ce05 object| _0x118335 string| _0x26dd4b object| _0x120229 number| _0x10636b number| _0x37f186 function| _0x24d833 function| envFlush object| Env number| __DEV__ function| pageLoad function| $ function| jQuery function| __updateOrientation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

arxdock.com
code.jquery.com
drugclouds.com
static.xx.fbcdn.net
static.xx.fbcdn.net
104.24.113.155
192.185.121.75
205.185.208.52
0746cdef88e6a76da9b0b066b263827692f8f8f1bcafce8989ca19b22bbae65b
0e59c596c4eafdb097ae99641f388940a8489faa66ebd81909d9c3b1f8834937
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
617fc34ef1c27420bf7b95c342cfa01b41494050350b3a27932cdefe9b0d909c
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
890022d6c5a90c645601df5bebcb59ed68e34f057324e572ff05e001147406e6
aa5e8bc5db3abd2274d3dbe464b7b703a087f93ccd877f01a30616297529bc28
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
e1c29c46b757402e0b8daf340c55e06625dfea1a6251cc9961d6212347f1ea23
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e975ac2a7614deb822f8d824d47199ef2f6c47dc1638e0537ee65e4a92a0a498