lsafopl.maxinvo.xyz
Open in
urlscan Pro
190.123.44.108
Malicious Activity!
Public Scan
Submission: On February 22 via api from PL — Scanned from PL
Summary
This is the only time lsafopl.maxinvo.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 190.123.44.108 190.123.44.108 | 52284 (Panamaser...) (Panamaserver.com) | |
1 | 172.217.18.10 172.217.18.10 | 15169 (GOOGLE) (GOOGLE) | |
2 | 157.240.251.9 157.240.251.9 | 32934 (FACEBOOK) (FACEBOOK) | |
2 | 142.250.186.163 142.250.186.163 | 15169 (GOOGLE) (GOOGLE) | |
1 | 157.240.253.35 157.240.253.35 | 32934 (FACEBOOK) (FACEBOOK) | |
9 | 5 |
ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f10.1e100.net
fonts.googleapis.com |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net
connect.facebook.net |
ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net
fonts.gstatic.com |
ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
maxinvo.xyz
lsafopl.maxinvo.xyz |
6 KB |
2 |
gstatic.com
fonts.gstatic.com |
124 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174 |
69 KB |
1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 103 |
185 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28 |
1 KB |
9 | 5 |
Domain | Requested by | |
---|---|---|
3 | lsafopl.maxinvo.xyz |
lsafopl.maxinvo.xyz
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | connect.facebook.net |
lsafopl.maxinvo.xyz
connect.facebook.net |
1 | www.facebook.com |
lsafopl.maxinvo.xyz
|
1 | fonts.googleapis.com |
lsafopl.maxinvo.xyz
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-12-01 - 2024-02-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://lsafopl.maxinvo.xyz/
Frame ID: 7745708CDD533A806D5A5A0DDF05AC34
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Administracja FacebookDetected technologies
Facebook (Widgets) ExpandDetected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
lsafopl.maxinvo.xyz/ |
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
lsafopl.maxinvo.xyz/prel_fb_redirect_RUEUR/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-icon.webp
lsafopl.maxinvo.xyz/prel_fb_redirect_RUEUR/img/ |
810 B 998 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
214 KB 58 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa25L7SUc.woff2
fonts.gstatic.com/s/inter/v13/ |
78 KB 78 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1392687764671310
connect.facebook.net/signals/config/ |
52 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| fbq function| _fbq1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.maxinvo.xyz/ | Name: _fbp Value: fb.1.1708597833523.1671218676 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
lsafopl.maxinvo.xyz
www.facebook.com
142.250.186.163
157.240.251.9
157.240.253.35
172.217.18.10
190.123.44.108
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
147c08cebda03a47eec4bf69f41f571ba4a837618c434f536919b7a9cdd6f923
22ee1b87ab24b6a7cf3f20359ec0dd63876e6d65880d5e76b278365aebf6169e
30d0c20f159e3c582dd9c1d961e8bebadce044d5302d86c91ea0128fc3e2599e
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
91307d3cc670e515e2f2e2d2be9e18d4a7d5027787edbb36cc616cd3291b02de
a2bfd9fe607d28fd07b05046e622818b8b5b94a358d53853a0d3f03e597cdc71
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc6831b78453f7474393285694a664759e625e220c50835c3517aa279b1bf589