zh-snakecranewingchun-net.filesusr.com Open in urlscan Pro
2600:9000:26a0:ee00:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753*sgfja2lumgm=%2Ahttps%3A%2Fdocs.google....
Submission: On September 19 via api (September 19th 2023, 12:36:40 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 2600:9000:26a0:ee00:0:7dcd:9780:93a1, located in United States and belongs to AMAZON-02, US. The main domain is zh-snakecranewingchun-net.filesusr.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 26th 2023. Valid for: 6 months.

This is the only time zh-snakecranewingchun-net.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	2600:9000:26a... 2600:9000:26a0:ee00:0:7dcd:9780:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f00... 2a03:2880:f00e:13:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f10... 2a03:2880:f10e:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
12	4

1 2600:9000:26a0:ee00:0:7dcd:9780:93a1 (United States)

ASN16509 (AMAZON-02, US)

zh-snakecranewingchun-net.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f00e:13:face:b00c:0:3 (Toronto, Canada)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f10e:83:face:b00c:0:25de (Toronto, Canada)

ASN32934 (FACEBOOK, US)

facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 822	24 KB
1	facebook.com facebook.com — Cisco Umbrella Rank: 31	2 KB
1	filesusr.com zh-snakecranewingchun-net.filesusr.com	114 KB
12	3

	Domain	Requested by
4	static.xx.fbcdn.net	zh-snakecranewingchun-net.filesusr.com
1	facebook.com	zh-snakecranewingchun-net.filesusr.com
1	zh-snakecranewingchun-net.filesusr.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.oculus.com
portal.facebook.com
pay.facebook.com

Subject Issuer	Validity	Valid
*.filesusr.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-26` - `2024-01-22`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-06-28` - `2023-09-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753*sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook
Frame ID: 55CE5E64D5D6C2ECF7C2759CB84C774F
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facebook - Inicia sesión o regístrate

Page Statistics

12
Requests

50 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

141 kB
Transfer

216 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.oculus.com/
Title: Oculus

Search URL Search Domain Scan URL

URL: https://portal.facebook.com/?refid=8
Title: Portal

Search URL Search Domain Scan URL

URL: https://pay.facebook.com/?refid=8
Title: Facebook Pay

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 73e040_268ecc9148f062ba30941076878b52c5.html Show response
zh-snakecranewingchun-net.filesusr.com/html/ 114 KB
114 KB 364ms
157ms Document
text/html 2600:9000:26a0:ee00:0:7dcd:9780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753*sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:ee00:0:7dcd:9780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.21.4.1 /
Resource Hash: 88c4de5a7c23d80039deeab228925e46c50765a685108b21dfb279e4f2c21c57

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 5266
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=15552000, immutable
content-length: 116363
content-type: text/html; charset=utf-8
date: Tue, 19 Sep 2023 11:08:49 GMT
etag: "268ecc9148f062ba30941076878b52c5"
expires: Tue, 19 Sep 2023 12:08:49 GMT
last-modified: Mon, 18 Sep 2023 17:01:39 GMT
server: openresty/1.21.4.1
timing-allow-origin: *
via: 1.1 google, 1.1 24c2a7b3c7e677d544aa5e2a7eb85b4e.cloudfront.net (CloudFront)
x-amz-cf-id: 9kokTP6ud88uB1297ZsCydO6q2GWweuFd4bsljC2n7BjXHkPXoK1mA==
x-amz-cf-pop: YUL62-P2
x-cache: Hit from cloudfront
x-seen-by: gcp.us-central-1.media-router-f89dc7b48-l4kgd

GET
H2 200 6GLJ--9ztQp.css
static.xx.fbcdn.net/rsrc.php/v3/y6/l/0,cross/ 58 KB
14 KB 445ms
302ms Stylesheet
text/css 2a03:2880:f00e:13:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y6/l/0,cross/6GLJ--9ztQp.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: zh-snakecranewingchun-net.filesusr.com
URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753*sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f00e:13:face:b00c:0:3 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c5ed365908244f0ba0a484e110db2179ce55dc563bb813b5d3d9d76bc367ce26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://zh-snakecranewingchun-net.filesusr.com/
Origin: https://zh-snakecranewingchun-net.filesusr.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 12:36:36 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: JAQ4Fa9mvTD+EY1FL//xpA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14157
x-fb-debug: cdvLr2lwUdfL1lQ+jYYwoIkTZ+DUjYDpISkP7/5nP33epKx/TlQafxmDHTikihDKKIz1OwDJs9cj2sBhBNyCfQ==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 06 Sep 2024 10:19:47 GMT

GET
H2 200 PZ5jTjCM7M1.css
static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/ 28 KB
6 KB 219ms
75ms Stylesheet
text/css 2a03:2880:f00e:13:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/PZ5jTjCM7M1.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f00e:13:face:b00c:0:3 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6070889a78410f5b8c6c6acd82a6311f95f9cff7849cfe47a31065354aa6a305

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://zh-snakecranewingchun-net.filesusr.com/
Origin: https://zh-snakecranewingchun-net.filesusr.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 12:36:36 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: vlHgw3B15SMFxYMEQOxUDw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5796
x-fb-debug: HfvytkP6I5fw3Id/Zw9FQuytIwtOjmoxGCIhqW8QKel2HvK9j9xKUgNbznuRkz4QDp7pSiv2oFNFLCmVdZAsTw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 06 Sep 2024 10:19:47 GMT

GET
H2 200 0if6ZH9hBTh.css
static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/ 14 KB
3 KB 445ms
302ms Stylesheet
text/css 2a03:2880:f00e:13:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/0if6ZH9hBTh.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f00e:13:face:b00c:0:3 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2f05d4faed3ed88ddbfe14dc406ce38f17918b47b1bd0bb1f04a2645e18b097f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://zh-snakecranewingchun-net.filesusr.com/
Origin: https://zh-snakecranewingchun-net.filesusr.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 12:36:36 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: IwIq4joM+3SRjX6JCyaq8A==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3300
x-fb-debug: tM0LKPEgIchVfWuPzIUq6Aky7Ipe5VZtR2kjB91TPdKwCRc/DKMGIVmEcwXIOMC9Lit+ZXLvneF1E+cqtt/Jqw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Fri, 06 Sep 2024 10:19:47 GMT

GET sAcaU2FJdDD.js
static.xx.fbcdn.net/rsrc.php/v3/yF/r/ 0
0

GET
H3 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
1 KB 144ms
72ms Image
image/svg+xml 2a03:2880:f00e:13:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f00e:13:face:b00c:0:3 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://zh-snakecranewingchun-net.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 12:36:36 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1027
x-fb-debug: 7TlB8KN/ZjaEracn9bKad/Kg4oY/0OyuAquI7SRN2ZU8s6yWnd5YAbu+N7V73VYOvsCmHYi0yPmgSMqZJjmLsg==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: public,max-age=31536000,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=1,i
expires: Thu, 05 Sep 2024 07:29:14 GMT

GET
H2 200 hsts-pixel.gif
facebook.com/security/ 43 B
2 KB 246ms
100ms Image
image/gif 2a03:2880:f10e:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://facebook.com/security/hsts-pixel.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f10e:83:face:b00c:0:25de Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://zh-snakecranewingchun-net.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
date: Tue, 19 Sep 2023 12:36:36 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: no-cache
x-fb-debug: hVQaqU754g5PUrL4LnWB+RyaygtXiPZkE+i7XKz8CZJlw+nqML/YF7ylSLMAZk+FrvqHgVk9vCVFbJEeXmpShw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: *
origin-agent-cluster: ?0
cache-control: private, no-cache, no-store, must-revalidate
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET SieMvexb4RV.css
static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/ 0
0

GET ZFA2ZKi8_ij.js
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ 0
0

GET wgQtNFI9dU-.js
static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/ 0
0

GET v-qA4RoF1Br.css
static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/ 0
0

GET 29KpN-SSjEW.js
static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook(Line 46) Message*: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook(Line 46) Message*: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook(Line 46) Message*: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook(Line 46) Message*: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook(Line 46) Message*: A parser-blocking, cross site (i.e. different eTLD+1) script, https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to CSS stylesheet at 'https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/sAcaU2FJdDD.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz' from origin 'https://zh-snakecranewingchun-net.filesusr.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz Message: Failed to load resource: net::ERR_FAILED
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yp/l/0,cross/SieMvexb4RV.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: The resource https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/ZFA2ZKi8_ij.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: The resource https://static.xx.fbcdn.net/rsrc.php/v3/y1/l/0,cross/v-qA4RoF1Br.css?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: The resource https://static.xx.fbcdn.net/rsrc.php/v3i0VU4/yb/l/es_LA/29KpN-SSjEW.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://zh-snakecranewingchun-net.filesusr.com/html/73e040_268ecc9148f062ba30941076878b52c5.html?7798753sgfja2lumgm=%2Ahttps%3A%2Fdocs.google.com%2Fforms%2Fd%2Fe%2F1faipqlscpu6so3scnthiodc12sy5d6rhbqadwr_5oaitozcgtzm5ksg%2Fviewform%2Afacebook Message*: The resource https://static.xx.fbcdn.net/rsrc.php/v3ivXO4/yZ/l/es_LA/wgQtNFI9dU-.js?_nc_x=Ij3Wp8lg5Kz was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

facebook.com
static.xx.fbcdn.net
zh-snakecranewingchun-net.filesusr.com
static.xx.fbcdn.net
2600:9000:26a0:ee00:0:7dcd:9780:93a1
2a03:2880:f00e:13:face:b00c:0:3
2a03:2880:f10e:83:face:b00c:0:25de
2f05d4faed3ed88ddbfe14dc406ce38f17918b47b1bd0bb1f04a2645e18b097f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6070889a78410f5b8c6c6acd82a6311f95f9cff7849cfe47a31065354aa6a305
88c4de5a7c23d80039deeab228925e46c50765a685108b21dfb279e4f2c21c57
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
c5ed365908244f0ba0a484e110db2179ce55dc563bb813b5d3d9d76bc367ce26

zh-snakecranewingchun-net.filesusr.com Open in urlscan Pro 2600:9000:26a0:ee00:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

50 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

141 kBTransfer

216 kBSize

0 Cookies

3 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

0 Cookies

22 Console Messages

Indicators

zh-snakecranewingchun-net.filesusr.com Open in urlscan Pro
2600:9000:26a0:ee00:0:7dcd:9780:93a1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

50 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

141 kB
Transfer

216 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!