![](/screenshots/281db215-ea64-426b-83a5-ccbfb63c48b6.png)
facebook.business-pages-9619061112547065.support
Open in
urlscan Pro
2606:4700:3032::6815:2006
Malicious Activity!
Public Scan
Effective URL: https://facebook.business-pages-9619061112547065.support/.com/
Submission: On December 06 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on December 3rd 2023. Valid for: 3 months.
This is the only time facebook.business-pages-9619061112547065.support was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3030::ac43:9d41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2606:4700:303... 2606:4700:3030::ac43:b61b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 5 | 2606:4700:303... 2606:4700:3032::6815:2006 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:823::200a | 15169 (GOOGLE) (GOOGLE) | |
6 | 2600:9000:210... 2600:9000:210b:3000:11:52e1:b680:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81e::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 3.0.30.71 3.0.30.71 | 16509 (AMAZON-02) (AMAZON-02) | |
13 | 6 |
ASN13335 (CLOUDFLARENET, US)
facebook.business-pages-8862258228454579.support |
ASN13335 (CLOUDFLARENET, US)
facebook.business-pages-9619061112547065.support |
ASN13335 (CLOUDFLARENET, US)
facebook.business-pages-9619061112547065.support |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-0-30-71.ap-southeast-1.compute.amazonaws.com
a.ladipage.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
business-pages-9619061112547065.support
4 redirects
facebook.business-pages-9619061112547065.support |
21 KB |
6 |
ladicdn.com
w.ladicdn.com — Cisco Umbrella Rank: 61342 |
199 KB |
2 |
ladipage.com
a.ladipage.com — Cisco Umbrella Rank: 86225 |
632 B |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
1 |
business-pages-8862258228454579.support
1 redirects
facebook.business-pages-8862258228454579.support |
830 B |
13 | 6 |
Domain | Requested by | |
---|---|---|
7 | facebook.business-pages-9619061112547065.support |
4 redirects
facebook.business-pages-9619061112547065.support
|
6 | w.ladicdn.com |
facebook.business-pages-9619061112547065.support
w.ladicdn.com |
2 | a.ladipage.com |
w.ladicdn.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
facebook.business-pages-9619061112547065.support
|
1 | facebook.business-pages-8862258228454579.support | 1 redirects |
13 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
business-pages-9619061112547065.support GTS CA 1P5 |
2023-12-03 - 2024-03-02 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
w.ladicdn.com Amazon RSA 2048 M02 |
2023-10-12 - 2024-11-10 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
a.ladipage.com Amazon RSA 2048 M02 |
2023-05-18 - 2024-06-15 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://facebook.business-pages-9619061112547065.support/.com/
Frame ID: 6E3CB093C8AEA9431080F46110BE374F
Requests: 11 HTTP requests in this frame
Frame:
https://facebook.business-pages-9619061112547065.support/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
Frame ID: 89407C0F7C399AA4BF6C58DDDD0D0AAE
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/281db215-ea64-426b-83a5-ccbfb63c48b6.png)
Page Title
Troubleshooting USPage URL History Show full URLs
-
http://facebook.business-pages-8862258228454579.support/.com_id=2194524612958344
HTTP 302
http://facebook.business-pages-9619061112547065.support/.com HTTP 301
https://facebook.business-pages-9619061112547065.support/.com HTTP 301
http://facebook.business-pages-9619061112547065.support/.com/ HTTP 301
https://facebook.business-pages-9619061112547065.support/.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://facebook.business-pages-8862258228454579.support/.com_id=2194524612958344
HTTP 302
http://facebook.business-pages-9619061112547065.support/.com HTTP 301
https://facebook.business-pages-9619061112547065.support/.com HTTP 301
http://facebook.business-pages-9619061112547065.support/.com/ HTTP 301
https://facebook.business-pages-9619061112547065.support/.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://facebook.business-pages-9619061112547065.support/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://facebook.business-pages-9619061112547065.support/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/main.js
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
facebook.business-pages-9619061112547065.support/.com/ Redirect Chain
|
69 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipagev3.min.js
w.ladicdn.com/v2/source/ |
387 KB 91 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2-20231007073128-ck-ve.ico
w.ladicdn.com/64366c789df04f0012600c5d/ |
17 KB 2 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
untitled-2-20231007092424-8e4uj.png
w.ladicdn.com/s350x350/64366c789df04f0012600c5d/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1-20231007072010-3xxju.jpg
w.ladicdn.com/s1440x200/64366c789df04f0012600c5d/ |
79 KB 76 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
event
a.ladipage.com/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.formdata.min.js
w.ladicdn.com/v2/source/ |
55 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
385 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
a.ladipage.com/ |
106 B 632 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
facebook.business-pages-9619061112547065.support/cdn-cgi/challenge-platform/h/b/scripts/jsd/56d3063b/ Frame 8940 Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8316a3350ac08dcd
facebook.business-pages-9619061112547065.support/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 8940 |
0 612 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.svg
w.ladicdn.com/source/v3/by/ |
12 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| ladi_ttq function| lazyload_run function| equalsLadiPage function| isObjectLadiPage function| isArrayLadiPage function| isFunctionLadiPage function| isBooleanLadiPage function| isStringLadiPage function| isEmptyLadiPage function| isNullLadiPage function| parseFloatLadiPage function| decodeURIComponentLadiPage function| formatNumber function| textToNumber function| formatNumberComma function| textToNumberComma function| formatNumberDot function| textToNumberDot object| Base64 function| LadiPageScriptV2 object| LadiPageScript object| LadiFormulaData object| LadiFormApi object| LadiPageCommand object| LadiPageLocation object| LadiPageShopping object| LadiPageFormData object| LadiPageQueueCommandList object| LadiPageQueueCommand function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| language_set function| LadiPageLibraryV2 function| ladi function| LadiPageAppV2 function| sha256 function| sha224 object| LadiPageApp3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
facebook.business-pages-9619061112547065.support/.com/ | Name: _timenow Value: 1701887819576 |
|
facebook.business-pages-9619061112547065.support/.com/ | Name: LADI_UNIQUE_ID Value: 5df69235-f433-470f-aa6f-08cbfa001af6 |
|
.business-pages-9619061112547065.support/ | Name: cf_clearance Value: VNIyVOi9Aai5gJoaLkGnjZA6i88DwMfh_xdoFrLwh1Q-1701887819-0-1-316c7993.7239618c.530e6886-0.2.1701887819 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.ladipage.com
facebook.business-pages-8862258228454579.support
facebook.business-pages-9619061112547065.support
fonts.googleapis.com
fonts.gstatic.com
w.ladicdn.com
2600:9000:210b:3000:11:52e1:b680:93a1
2606:4700:3030::ac43:9d41
2606:4700:3030::ac43:b61b
2606:4700:3032::6815:2006
2607:f8b0:4006:81e::2003
2607:f8b0:4006:823::200a
3.0.30.71
0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a
289d99b21fae145c868238c0c499dcf8e84bea445b63e47e3406acfe98e20a34
29d9e01151932ae6955f915572beab07a838318c9ec100bb77923f13ffcc2eee
55717da5f0bc7b97c87e7abdc4e097054048bc1c23998d5cc4b83a960d691062
628302bae3cba02607d2fefa6eaf3d0549c0c8ab9f41bd171d74f3757826b6bf
6f96db3bffcd7019cefaf732f6ed6008b2063b7687c916dd22dd76ef257b5f0d
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
a6afda56902145c98d1d2eacc2a64bd761001de2ea2279c7dc9fb50567e93627
b2f1d90a7f1f9209a1744ac8021ea99c542abf037d6216129049b68d7d5feb13
b652537223da3131b5bc05b5487b63142e5f8e0dca47b75b0b5c335fee8c7f47
ca05dc6882120c4feba600b15d86784b8a13484a536a8bdc97a1f9375d526b5f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6613ab4bcfe68a9e2204f20a9bb73715c2a817141922de4882e75c92a8355a9