ldp.page Open in urlscan Pro
18.138.206.213  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request tk-support-login-fb-georgia Show response ldp.page/	67 KB 12 KB	742ms 242ms	Document text/html	18.138.206.213 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.138.206.213 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-138-206-213.ap-southeast-1.compute.amazonaws.com Software openresty / Resource Hash 1e04ba5ad7ffaa8873bd02361e2a877863bfe626a0feb47f1c94d772263bcb2a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0 content-encoding gzip content-type text/html; charset=utf-8 date Tue, 31 Jan 2023 06:00:42 GMT server openresty statuscode 200 vary Accept-Encoding
GET H2	200	css fonts.googleapis.com/	6 KB 1 KB	204ms 78ms	Stylesheet text/css	2a00:1450:400d:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 012deec03fbfd6c92c075b502ee777e094cd1a0cedb202a84cde1218b3b60fb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 31 Jan 2023 06:00:42 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 31 Jan 2023 06:00:42 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 31 Jan 2023 06:00:42 GMT
GET H2	200	ladipage.vi.min.js Show response w.ladicdn.com/v2/source/	371 KB 90 KB	212ms 46ms	Script text/javascript	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipage.vi.min.js?v=1674874972198 Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash ebae4a606f9bee0bae31985d90092e99e4e890d86df46135bb31c6b0196b2344 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers cdn-storagebalancer NY-266 date Tue, 31 Jan 2023 06:00:42 GMT content-encoding br cdn-edgestorageid 1082 perma-cache MISS cdn-cachedat 01/28/2023 03:21:26 cdn-pullzone 575124 server BunnyCDN-DE1-1048 cdn-proxyver 1.03 cdn-requestpullcode 200 vary Accept-Encoding, Accept-Encoding access-control-allow-methods GET content-type text/javascript access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-max-age 2592000 access-control-allow-credentials true cache-control public, max-age=31919000 cdn-requestid 6448fc1cb607ff9732b88e30053bf43e cdn-requestcountrycode DE access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Access-Control-Allow-Credentials cdn-status 200 cdn-requestpullsuccess True
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v34/	44 KB 44 KB	179ms 53ms	Font font/woff2	2a00:1450:400d:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://ldp.page accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Fri, 27 Jan 2023 08:26:15 GMT x-content-type-options nosniff age 336867 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 44856 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:20:18 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 27 Jan 2024 08:26:15 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 fonts.gstatic.com/s/opensans/v34/	26 KB 26 KB	208ms 115ms	Font font/woff2	2a00:1450:400d:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 59bd288e64c57e034672999e33ebda6eb5ad1575945eb563dbfb5b44f226e1e1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://ldp.page accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Wed, 25 Jan 2023 11:59:19 GMT x-content-type-options nosniff age 496883 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 26240 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:14:37 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 25 Jan 2024 11:59:19 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2 fonts.gstatic.com/s/opensans/v34/	31 KB 31 KB	254ms 162ms	Font font/woff2	2a00:1450:400d:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 24c0e724005344165ee0a0ff4c96a914e174bb4caa20c8a533fb194d92853e95 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://ldp.page accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 26 Jan 2023 22:03:03 GMT x-content-type-options nosniff age 374259 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31320 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:11:37 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 26 Jan 2024 22:03:03 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2 fonts.gstatic.com/s/opensans/v34/	21 KB 21 KB	274ms 183ms	Font font/woff2	2a00:1450:400d:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0c018fe9d09945d93f6f5aa5f1c53a2975621c3043a22344eaf86d6500c245c6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://ldp.page accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 24 Jan 2023 23:40:26 GMT x-content-type-options nosniff age 541216 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 21048 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:13:11 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 24 Jan 2024 23:40:26 GMT
GET H2	200	facebook-removebg-20221006190435-we_el.png w.ladicdn.com/s600x450/5c9c42dbd8a4d128f5925685/	90 KB 91 KB	66ms 65ms	Image image/png	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/s600x450/5c9c42dbd8a4d128f5925685/facebook-removebg-20221006190435-we_el.png Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash a1ba0b2bc63abc227115d262a2c0789a5fd90d7303707f466dc08d5aca8e4fee Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 06:00:42 GMT cdn-edgestorageid 756 perma-cache HIT cdn-storageserver NY-426 cdn-cachedat 11/14/2022 00:14:15 cdn-pullzone 575124 content-length 91889 last-modified Fri, 07 Oct 2022 15:39:27 GMT server BunnyCDN-DE1-1048 cdn-fileserver 353 cdn-requestpullcode 200 cdn-proxyver 1.03 etag "6340482f-166f1" content-type image/png access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 60b257f0225f22cc6128cfccc9ac26e0 accept-ranges bytes cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	2-20221006184816-kjeg3.png w.ladicdn.com/s350x350/5c9c42dbd8a4d128f5925685/	1009 B 2 KB	66ms 66ms	Image image/png	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/s350x350/5c9c42dbd8a4d128f5925685/2-20221006184816-kjeg3.png Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash 5bb9cecdc776083f989709a124fcd735d9d8f31ed0512acfaaf6c3b8b702c9e0 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 06:00:42 GMT cdn-edgestorageid 1077 perma-cache HIT cdn-storageserver NY-427 cdn-cachedat 01/04/2023 09:20:20 cdn-pullzone 575124 content-length 1009 last-modified Fri, 07 Oct 2022 12:47:47 GMT server BunnyCDN-DE1-1048 cdn-fileserver 354 cdn-requestpullcode 200 cdn-proxyver 1.03 etag "63401ff3-3f1" content-type image/png access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 9ac55de56c9e084164a5dc7c9b12a4df accept-ranges bytes cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	ladipage.min.css w.ladicdn.com/v2/source/	66 KB 9 KB	66ms 65ms	Stylesheet text/css	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipage.min.css?v=1674874972198 Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash cdf280f70a1b4ee57e3451e5aecb0d56269e5feec54513bed76598df05acabdf Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers cdn-storagebalancer NY-267 date Tue, 31 Jan 2023 06:00:42 GMT content-encoding br cdn-edgestorageid 1054 perma-cache MISS cdn-cachedat 01/28/2023 03:21:27 cdn-pullzone 575124 server BunnyCDN-DE1-1048 cdn-proxyver 1.03 cdn-requestpullcode 200 vary Accept-Encoding, Accept-Encoding access-control-allow-methods GET content-type text/css access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match access-control-allow-credentials true cache-control public, max-age=31919000 access-control-max-age 2592000 cdn-requestid ced54803960b98694a749fd411aeb4ac cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	sdk.js Show response w.ladicdn.com/ladichat/	763 B 943 B	66ms 65ms	Script text/javascript	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/ladichat/sdk.js Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash b64036116bf5824ee8150b1da696a6c8dfd4854d07901ceced4de34b9e48c4c7 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 06:00:42 GMT content-encoding br cdn-edgestorageid 863 perma-cache HIT cdn-storageserver NY-266 cdn-cachedat 11/23/2022 09:39:30 cdn-pullzone 575124 last-modified Wed, 23 Nov 2022 09:38:40 GMT server BunnyCDN-DE1-1048 cdn-fileserver 354 cdn-requestpullcode 200 cdn-proxyver 1.03 etag W/"637dea20-2fb" vary Accept-Encoding, Accept-Encoding content-type text/javascript cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba cache-control public, max-age=31919000 cdn-requestid 4cf00053611a99400f1ca99409b7712f cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
OPTIONS H2	200	event a.ladipage.com/	0 0	761ms 243ms	Preflight application/json	13.213.168.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.213.168.103 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-213-168-103.ap-southeast-1.compute.amazonaws.com Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,ladi_camp_form_submit,ladi_camp_id,ladi_camp_name,ladi_camp_origin_url,ladi_camp_page_view,ladi_camp_target_url,ladi_camp_type,ladi_client_id,ladi_form_submit,ladi_page_view Access-Control-Request-Method POST Origin https://ldp.page Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily access-control-allow-methods POST, OPTIONS access-control-allow-origin * access-control-max-age 2592000 content-encoding gzip content-type application/json; charset=utf-8 date Tue, 31 Jan 2023 06:00:43 GMT vary Accept-Encoding x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-xss-protection 0
GET DATA	200 OK	truncated /	385 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers Content-Type image/svg+xml
POST H2	200	event Show response a.ladipage.com/	106 B 632 B	243ms 243ms	XHR text/plain	13.213.168.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Requested by Host: w.ladicdn.com URL: https://w.ladicdn.com/v2/source/ladipage.vi.min.js?v=1674874972198 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.213.168.103 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-213-168-103.ap-southeast-1.compute.amazonaws.com Software / Resource Hash 4fa02c92c32cd79f96f6032cd26baa89f69748297451280bde4851c486b4c843 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers LADI_CLIENT_ID LADI_CAMP_ORIGIN_URL LADI_FORM_SUBMIT 0 LADI_CAMP_ID LADI_CAMP_FORM_SUBMIT 0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 LADI_CAMP_NAME Content-Type application/json accept-language de-DE,de;q=0.9 LADI_CAMP_TARGET_URL LADI_CAMP_PAGE_VIEW 0 Referer https://ldp.page/ LADI_PAGE_VIEW 0 LADI_CAMP_TYPE Response headers date Tue, 31 Jan 2023 06:00:43 GMT x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN access-control-allow-methods POST, OPTIONS content-type text/plain; charset=utf-8 access-control-allow-origin * access-control-max-age 2592000 access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily x-xss-protection 0
GET H2	200	ladichat.min.js Show response w.ladicdn.com/ladichat/	322 KB 85 KB	1679ms 1679ms	Script text/javascript	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/ladichat/ladichat.min.js?ver=1675144842701 Requested by Host: w.ladicdn.com URL: https://w.ladicdn.com/ladichat/sdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash d8c0d824bdbc5c3d5ff65c08d9c0c7a2922541edf1e317567e0b501b58663b44 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers cdn-storagebalancer NY-430 date Tue, 31 Jan 2023 06:00:44 GMT content-encoding br cdn-edgestorageid 865 perma-cache MISS cdn-cachedat 01/31/2023 06:00:44 cdn-pullzone 575124 server BunnyCDN-DE1-1048 cdn-proxyver 1.03 cdn-requestpullcode 200 vary Accept-Encoding, Accept-Encoding access-control-allow-methods GET content-type text/javascript access-control-allow-origin * cdn-cache MISS cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-max-age 2592000 access-control-allow-credentials true cache-control public, max-age=31919000 cdn-requestid 70a722f11583da30a3af209555b8dfc6 cdn-requestcountrycode DE access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Access-Control-Allow-Credentials cdn-status 200 cdn-requestpullsuccess True
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2 fonts.gstatic.com/s/opensans/v34/	14 KB 14 KB	53ms 52ms	Font font/woff2	2a00:1450:400d:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 84197a92671b7b7c8715220cea35354699c6221113c0ff531ff087ab8a8aa9e6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://ldp.page accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Sat, 28 Jan 2023 14:15:26 GMT x-content-type-options nosniff age 229516 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 14040 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:14:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 28 Jan 2024 14:15:26 GMT
GET H2	200	ladipage.svg w.ladicdn.com/source/v3/by/	9 KB 4 KB	40ms 40ms	Image image/svg+xml	2400:52e0:1e00::1048:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/source/v3/by/ladipage.svg Requested by Host: ldp.page URL: https://ldp.page/tk-support-login-fb-georgia Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1048:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1048 / Resource Hash d8118e9a1bff8aba3c8bed102fc492d12d3aa1e8266ed9691c7691bc06e3d890 Request headers accept-language de-DE,de;q=0.9 Referer https://ldp.page/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Tue, 31 Jan 2023 06:00:45 GMT content-encoding br cdn-edgestorageid 1076 perma-cache HIT cdn-storageserver NY-430 cdn-cachedat 01/04/2023 08:57:28 cdn-pullzone 575124 last-modified Sat, 15 Jan 2022 06:36:45 GMT server BunnyCDN-DE1-1048 cdn-fileserver 265 cdn-requestpullcode 200 cdn-proxyver 1.03 etag W/"61e26b7d-22dc" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid c8ea7e062facc8f7d03fabc089cc91f7 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET		63d7496e3f5850001144ce40-63d7496e3f5850001144ce52.json g.ladicdn.com/ladichat-sdk/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

g.ladicdn.com

URL

https://g.ladicdn.com/ladichat-sdk/63d7496e3f5850001144ce40-63d7496e3f5850001144ce52.json?v=1675144845977

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| LadiPageScriptV2 object| Base64 object| LadiPageScript object| LadiFormApi object| LadiPageCommand function| equalsLadiPage function| isObjectLadiPage function| isArrayLadiPage function| isFunctionLadiPage function| isBooleanLadiPage function| isStringLadiPage function| isEmptyLadiPage function| isNullLadiPage function| parseFloatLadiPage function| decodeURIComponentLadiPage function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| LadiPageLibraryV2 function| LadiPageAppV2 function| ladi object| LadiPageApp string| SDK_URL function| StaticConfig object| linkify function| linkifyElement function| io object| LadiChat object| LadiChat_Helper object| LadiChat_Config object| LadiChat_Static_Config

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ldp.page/tk-support-login-fb-georgia	1970-01-20 09:20:31	Name: _timenow Value: 1675144842684

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ladipage.com
fonts.googleapis.com
fonts.gstatic.com
g.ladicdn.com
ldp.page
w.ladicdn.com
g.ladicdn.com
13.213.168.103
18.138.206.213
2400:52e0:1e00::1048:1
2a00:1450:400d:80c::200a
2a00:1450:400d:80d::2003
012deec03fbfd6c92c075b502ee777e094cd1a0cedb202a84cde1218b3b60fb4
0c018fe9d09945d93f6f5aa5f1c53a2975621c3043a22344eaf86d6500c245c6
0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a
1e04ba5ad7ffaa8873bd02361e2a877863bfe626a0feb47f1c94d772263bcb2a
24c0e724005344165ee0a0ff4c96a914e174bb4caa20c8a533fb194d92853e95
4fa02c92c32cd79f96f6032cd26baa89f69748297451280bde4851c486b4c843
59bd288e64c57e034672999e33ebda6eb5ad1575945eb563dbfb5b44f226e1e1
5bb9cecdc776083f989709a124fcd735d9d8f31ed0512acfaaf6c3b8b702c9e0
84197a92671b7b7c8715220cea35354699c6221113c0ff531ff087ab8a8aa9e6
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
a1ba0b2bc63abc227115d262a2c0789a5fd90d7303707f466dc08d5aca8e4fee
b64036116bf5824ee8150b1da696a6c8dfd4854d07901ceced4de34b9e48c4c7
cdf280f70a1b4ee57e3451e5aecb0d56269e5feec54513bed76598df05acabdf
d8118e9a1bff8aba3c8bed102fc492d12d3aa1e8266ed9691c7691bc06e3d890
d8c0d824bdbc5c3d5ff65c08d9c0c7a2922541edf1e317567e0b501b58663b44
ebae4a606f9bee0bae31985d90092e99e4e890d86df46135bb31c6b0196b2344