facebook.restrictions-on-page.support
Open in
urlscan Pro
104.21.84.253
Malicious Activity!
Public Scan
Submission: On August 06 via api from US — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on August 5th 2023. Valid for: 3 months.
This is the only time facebook.restrictions-on-page.support was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 104.21.84.253 104.21.84.253 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.186.42 142.250.186.42 | 15169 (GOOGLE) (GOOGLE) | |
4 | 89.187.169.3 89.187.169.3 | 60068 (CDN77 ^_^) (CDN77 ^_^) | |
1 | 58.187.8.5 58.187.8.5 | 18403 (FPT-AS-AP...) (FPT-AS-AP FPT Telecom Company) | |
1 | 142.250.186.35 142.250.186.35 | 15169 (GOOGLE) (GOOGLE) | |
2 | 18.140.106.118 18.140.106.118 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 120.138.69.227 120.138.69.227 | 38244 (VINAGAME-...) (VINAGAME-AS-VN VNG Corporation) | |
16 | 8 |
ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f10.1e100.net
fonts.googleapis.com |
ASN60068 (CDN77 ^_^, GB)
PTR: 89-187-169-3.bunnyinfra.net
w.ladicdn.com |
ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net
fonts.gstatic.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-140-106-118.ap-southeast-1.compute.amazonaws.com
a.ladipage.com |
ASN38244 (VINAGAME-AS-VN VNG Corporation, VN)
PTR: ptr.vng.vn
log.adtimaserver.vn |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
adtimaserver.vn
log.adtimaserver.vn — Cisco Umbrella Rank: 37630 |
695 B |
4 |
ladicdn.com
w.ladicdn.com — Cisco Umbrella Rank: 44582 |
149 KB |
4 |
restrictions-on-page.support
1 redirects
facebook.restrictions-on-page.support |
18 KB |
2 |
ladipage.com
a.ladipage.com — Cisco Umbrella Rank: 56086 |
632 B |
1 |
gstatic.com
fonts.gstatic.com |
43 KB |
1 |
zzcdn.me
s.zzcdn.me — Cisco Umbrella Rank: 69718 |
8 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 77 |
1 KB |
16 | 7 |
Domain | Requested by | |
---|---|---|
4 | log.adtimaserver.vn |
s.zzcdn.me
facebook.restrictions-on-page.support |
4 | w.ladicdn.com |
facebook.restrictions-on-page.support
w.ladicdn.com |
4 | facebook.restrictions-on-page.support |
1 redirects
facebook.restrictions-on-page.support
|
2 | a.ladipage.com |
w.ladicdn.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | s.zzcdn.me |
facebook.restrictions-on-page.support
|
1 | fonts.googleapis.com |
facebook.restrictions-on-page.support
|
16 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
restrictions-on-page.support GTS CA 1P5 |
2023-08-05 - 2023-11-03 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
w.ladicdn.com Sectigo RSA Domain Validation Secure Server CA |
2023-02-10 - 2024-03-12 |
a year | crt.sh |
*.zzcdn.me RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2023-01-10 - 2024-01-09 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
a.ladipage.com Amazon RSA 2048 M02 |
2023-05-18 - 2024-06-15 |
a year | crt.sh |
*.adtimaserver.vn DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-04-24 - 2024-05-01 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://facebook.restrictions-on-page.support/.com/
Frame ID: B564DFFF3AB30D73092E1DC6981194F9
Requests: 14 HTTP requests in this frame
Frame:
https://facebook.restrictions-on-page.support/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js
Frame ID: 8F3B26BB9BE3DC5DBCCC29DC484E139E
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
๐ฏ๐ขะพ๐ฅะฐ๐ญ๐ขะพ๐งั-ะพ๐ง-๐ฉะฐ๐ ๐.ั๐ฎ๐ฉ๐ฉะพ๐ซ๐ญDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
TrackJs (Analytics) Expand
Detected patterns
- tracker\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://facebook.restrictions-on-page.support/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
- https://facebook.restrictions-on-page.support/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/invisible.js
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
facebook.restrictions-on-page.support/.com/ |
58 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
15 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipagev3.min.js
w.ladicdn.com/v2/source/ |
377 KB 94 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ztracker.js
s.zzcdn.me/ztr/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-mu0SC55I.woff2
fonts.gstatic.com/s/opensans/v35/ |
42 KB 43 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
untitled-1-20230729100313-zvnqo.jpg
w.ladicdn.com/s1300x600/64366c789df04f0012600c5d/ |
32 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
event
a.ladipage.com/ Frame |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.formdata.min.js
w.ladicdn.com/v2/source/ |
54 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
385 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
a.ladipage.com/ |
106 B 632 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
invisible.js
facebook.restrictions-on-page.support/cdn-cgi/challenge-platform/h/g/scripts/jsd/74ac0d47/ Frame 8F3B Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
7f2759134d1d73c3
facebook.restrictions-on-page.support/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 8F3B |
0 617 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
events
log.adtimaserver.vn/ptrck/ |
264 B 412 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracklp
log.adtimaserver.vn/ |
8 B 142 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tracklp
log.adtimaserver.vn/ |
8 B 141 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log
log.adtimaserver.vn/ptrck/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.svg
w.ladicdn.com/source/v3/by/ |
12 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| ladi_ttq function| ztrq function| _ztrk object| LadiPageZaloAds function| lazyload_run function| LadiPageScriptV2 object| Base64 function| equalsLadiPage function| isObjectLadiPage function| isArrayLadiPage function| isFunctionLadiPage function| isBooleanLadiPage function| isStringLadiPage function| isEmptyLadiPage function| isNullLadiPage function| parseFloatLadiPage function| decodeURIComponentLadiPage object| LadiPageScript object| LadiFormulaData object| LadiFormApi object| LadiPageCommand object| LadiPageLocation object| LadiPageShopping object| LadiPageFormData object| LadiPageQueueCommandList object| LadiPageQueueCommand function| formatNumber function| textToNumber function| formatNumberComma function| textToNumberComma function| formatNumberDot function| textToNumberDot function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| LadiPageLibraryV2 function| ladi function| LadiPageAppV2 function| sha256 function| sha224 object| LadiPageApp object| ztracker3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
facebook.restrictions-on-page.support/.com/ | Name: _timenow Value: 1691325622916 |
|
facebook.restrictions-on-page.support/.com/ | Name: LADI_UNIQUE_ID Value: dc799aa0-bf30-4ea1-ac31-571df3f8099e |
|
.restrictions-on-page.support/ | Name: cf_clearance Value: yBywTwQrw7vF2yaXtm0qBiRKDjCIehIu9lFWpaOwhXQ-1691325623-0-1-39189f5.d6da5811.81719b70-0.2.1691325623 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.ladipage.com
facebook.restrictions-on-page.support
fonts.googleapis.com
fonts.gstatic.com
log.adtimaserver.vn
s.zzcdn.me
w.ladicdn.com
104.21.84.253
120.138.69.227
142.250.186.35
142.250.186.42
18.140.106.118
58.187.8.5
89.187.169.3
0108e5c10378b405d69d8250118f1fb052464f3b1aea2469d5e877de9c5173eb
0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a
1208d57de072942a8feca96cc7957638eab3845d2600cda9885a0345cbdbfbbc
26b7a3d62b776389695e8b5946c8ff9a014c006b00a46edc9da189b0c17ae708
29d9e01151932ae6955f915572beab07a838318c9ec100bb77923f13ffcc2eee
45b4fb3d724d209c5064eae7d20e445c8af7e7829aeebf0369de54febf7d8593
4df24c1c88120512e898c83365fec1659c98295c47529838dfa64177345b433a
528c522a9eb44d1f787d814a3d55ecdb2c37e51a4193c69b83d41e38c7060229
628302bae3cba02607d2fefa6eaf3d0549c0c8ab9f41bd171d74f3757826b6bf
ba3783050d8a2d02e1cdc8463b635dc21ac2a84da9ebd33bf362ed83ee53a2b5
d1d7d49eabc05a94aaea14f19a2edee991ea0d27d9e4118e3329e5840e937a0a
e0ea31710b47d1c2d362bb5b268f21df17ecec5472c999762931f03da3e37ca5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855