![](/screenshots/935a5abf-7cce-4e4e-8e7d-22b92e0963f3.png)
worker2.lvhuaiyi.workers.dev
Open in
urlscan Pro
172.67.175.214
Malicious Activity!
Public Scan
Submission: On April 09 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on April 9th 2024. Valid for: 3 months.
This is the only time worker2.lvhuaiyi.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 172.67.175.214 172.67.175.214 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
16 | 31.13.66.19 31.13.66.19 | 32934 (FACEBOOK) (FACEBOOK) | |
29 | 5 |
ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
fbcdn.net
static.xx.fbcdn.net — Cisco Umbrella Rank: 838 |
253 KB |
3 |
workers.dev
worker2.lvhuaiyi.workers.dev |
23 KB |
1 |
facebook.com
facebook.com — Cisco Umbrella Rank: 28 |
3 KB |
29 | 3 |
Domain | Requested by | |
---|---|---|
25 | static.xx.fbcdn.net |
worker2.lvhuaiyi.workers.dev
static.xx.fbcdn.net |
3 | worker2.lvhuaiyi.workers.dev |
static.xx.fbcdn.net
|
1 | facebook.com |
worker2.lvhuaiyi.workers.dev
|
29 | 3 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
lvhuaiyi.workers.dev GTS CA 1P5 |
2024-04-09 - 2024-07-08 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2024-01-17 - 2024-04-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://worker2.lvhuaiyi.workers.dev/
Frame ID: CCA4C5A436B6CABA26DFE85356330370
Requests: 30 HTTP requests in this frame
22 Outgoing links
These are links going to different origins than the main page.
Title: Forgot account?
Search URL Search Domain Scan URL
Title: Español
Search URL Search Domain Scan URL
Title: Français (France)
Search URL Search Domain Scan URL
Title: 中文(简体)
Search URL Search Domain Scan URL
Title: العربية
Search URL Search Domain Scan URL
Title: Português (Brasil)
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: 한국어
Search URL Search Domain Scan URL
Title: Deutsch
Search URL Search Domain Scan URL
Title: हिन्दी
Search URL Search Domain Scan URL
Title: 日本語
Search URL Search Domain Scan URL
Title: Messenger
Search URL Search Domain Scan URL
Title: Video
Search URL Search Domain Scan URL
Title: Meta Pay
Search URL Search Domain Scan URL
Title: Meta Store
Search URL Search Domain Scan URL
Title: Meta Quest
Search URL Search Domain Scan URL
Title: Imagine with Meta AI
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Threads
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Ad choices
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
worker2.lvhuaiyi.workers.dev/ |
60 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OZRnJgs6Suh.css
static.xx.fbcdn.net/rsrc.php/v3/yQ/l/0,cross/ |
44 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oI7bhS_irZs.css
static.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nuNKxsHxWy3.css
static.xx.fbcdn.net/rsrc.php/v3/yr/l/0,cross/ |
12 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vB3CzVIR97P.js
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ |
350 KB 92 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4lCu2zih0ca.svg
static.xx.fbcdn.net/rsrc.php/y1/r/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hsts-pixel.gif
facebook.com/security/ |
43 B 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Hz-fQ_jgU8P.js
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
54 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RqRdOlyZWMv.js
static.xx.fbcdn.net/rsrc.php/v3i7M54/yI/l/en_US/ |
65 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ZMz_3PD0Ipc.png
static.xx.fbcdn.net/rsrc.php/v3/y7/r/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
O7nelmd9XSI.png
static.xx.fbcdn.net/rsrc.php/v3/yU/r/ |
95 B 289 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
78 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
RKK6hMCj3R1.js
static.xx.fbcdn.net/rsrc.php/v3/yk/r/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KqVnbuezAjj.js
static.xx.fbcdn.net/rsrc.php/v3/yE/r/ |
40 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
YvbwYOOvPhl.js
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ |
19 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3FPJ9YC_wUr.js
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ |
1 KB 737 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jMaPOqcTw38.js
static.xx.fbcdn.net/rsrc.php/v3/yK/r/ |
30 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
xPI18UMP6Nr.js
static.xx.fbcdn.net/rsrc.php/v3/y4/r/ |
42 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ui2DkP-wt_7.js
static.xx.fbcdn.net/rsrc.php/v3/yS/r/ |
11 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_tJ17sGyxOX.js
static.xx.fbcdn.net/rsrc.php/v3/yO/r/ |
18 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wwPr_f3niE-.js
static.xx.fbcdn.net/rsrc.php/v3/yj/r/ |
50 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
UE_VpTkFp3K.js
static.xx.fbcdn.net/rsrc.php/v3/yX/r/ |
32 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
QHboYVclAZ2.js
static.xx.fbcdn.net/rsrc.php/v3ihVQ4/yl/l/en_US/ |
45 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
PosgynLjFh0.js
static.xx.fbcdn.net/rsrc.php/v3/y-/r/ |
24 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4ub-qLkD6cN.js
static.xx.fbcdn.net/rsrc.php/v3/yX/r/ |
522 B 489 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
R9MsQbdO8Qf.js
static.xx.fbcdn.net/rsrc.php/v3/yz/r/ |
110 B 249 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ldf3zBap2iz.js
static.xx.fbcdn.net/rsrc.php/v3/yt/r/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
bz
worker2.lvhuaiyi.workers.dev/ajax/ |
90 B 845 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hLRJ1GG_y0J.ico
static.xx.fbcdn.net/rsrc.php/yb/r/ |
4 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
bz
worker2.lvhuaiyi.workers.dev/ajax/ |
90 B 845 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)71 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| envFlush object| Env number| __DEV__ undefined| toIntegerOrInfinity undefined| MAX_CALLS_TO_EXEC function| __annotator function| __bodyWrapper function| __t function| __w function| emptyFunction function| FB_enumerate function| __m object| babelHelpers function| define function| require function| requireInterop function| importDefault function| importNamespace function| requireDynamic function| requireLazy object| __onBeforeModuleFactory object| __onAfterModuleFactory function| __d function| $RefreshReg$ function| $RefreshSig$ function| getErrorSafe object| ErrorGuard object| ErrorSerializer object| ErrorUtils function| Arbiter function| $ function| ge object| Parent object| TimeSlice object| PageEvents function| _domcontentready function| onloadRegister_DEPRECATED function| onloadRegister function| onafterloadRegister_DEPRECATED function| onafterloadRegister function| onleaveRegister function| onbeforeunloadRegister function| onunloadRegister object| Bootloader function| goURI function| $E number| __bigPipeFactory string| _script_path object| onloadhooks function| now_inl number| __bigPipeFR number| __bigPipeCtor object| bigPipe object| PageHooks function| _domreadyHook function| _onloadHook function| runHook function| runHooks function| keep_window_set_as_loaded object| onafterunloadhooks function| AsyncRequest object| onunloadhooks object| onbeforeunloadhooks object| __FB_STORE object| onleavehooks function| intl_set_string_manager_mode function| intl_set_xmode function| intl_set_rmode function| intl_set_locale boolean| domready boolean| loaded0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://sandbox.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data: https://*.google-analytics.com *.google.com;block-all-mixed-content;upgrade-insecure-requests; |
Strict-Transport-Security | max-age=15552000; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebook.com
static.xx.fbcdn.net
worker2.lvhuaiyi.workers.dev
172.67.175.214
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
31.13.66.19
0d6f8d206a6bd8b60a2048a3df206ac956a2f633786e4af1c02057f81758ad7a
0f90ce92f6d627a995bf0300ac429ace9c65072877367d8bd8e5bc2052ceae93
15608556adf5513237381121d86a7c8f8454a0677a7446ba563f3d2317863025
17934d83ec7bb96bdeb330eba0f13a534f38d03b08871d25e240bef8e8e2a7cf
233ea983ef7a6e5503aa6b59d499c06bd7ebe3ceb11c836a2ff92f6a7f2be0e7
288f54aff6e3219d9b294c5083a376d55897c7a5e29889662ff9641df042f179
366dcc60fa21decbeeca0551e2988bf04a4235fecbc8a6a9c341c0eea798afc0
3d6a97aab6004d41c53f15a59194fe2cec294cc180425e323ccc5dcd228fa5af
539367bcbb06de79eb3432e57db0793265c721d4e7f18be9b8d8f435a6bd9147
53bad59933518142fb7a669c6a1790a91d2ba3e9313b9327407f2d5df0a206b6
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5c29dbe5d20b7e1364a84489e38222625774953fb5dd40028735092783ee2ab5
5e0c345584425fbd4b11b5947bf82e37ad4618ebbad388c2c4e9fe5b58bbcf31
5e1467843f6c6c548b08c1286379b90b3efc8b06d1e158487bd695b06e335a78
5fb29c66a3eda461a11e8dae54fcff64e73c23d6b67a5232fc23f417719d8ebb
67cb600c155ce7cf81e8f3f036fe12380dda0f1932ccad7071d7ea0dca22532b
6cf4be0574386ace7bbff7a1ffba8aab3346668372b03eb737a8225f5091831c
6fd92f46e2b85506e22ea984f77a5eb23a1e37659f1fcd6bbee2d980321fd18c
749ce89bc9e78ac3ee82632b023ae24842ba8c6fe6cf9c11fcc64332a4567873
76f848b14b35e2fd1c3fb3edf36e0b9b9f1afa9efd58ea2f3c542a8df113c804
89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
9eb382cef983aef7e97f8317560fc632521ae7c234a62932178efd9fccd70360
ab6777f622dce53efa7d6a93432292afba7757445eb4cc111b25810882375b98
c0f9968d0fa5f4deff86babccd6df52306138314607a6f3f0acd2e7afc783d1c
d9417eea3365b4d3085e14039b2b5ffd0bb61bc9d560ffdaa08a94256eb86499
d9665492285a5f1e0d31675379599dfd3e04375a908407741d1c7a74b7a9ce5d
eeca375851b1f6e67aa4c7d531186f4ee189a405cbd84f82d3454161b049c49c
f62efef6c8e9dbbcdc6c4c60f263977e87e43f22cf766727be85a00d6ceb4dac
fad63ae65d2579e89431b45c85649e4392fc105f5ed528896d2e7281788c8200