lixinammois.click - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 104.21.68.229, located in and belongs to CLOUDFLARENET, US. The main domain is lixinammois.click.
TLS certificate: Issued by GTS CA 1P5 on March 11th 2024. Valid for: 3 months.

This is the only time lixinammois.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 4	104.21.68.229 104.21.68.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.80.106 142.250.80.106	15169 (GOOGLE) (GOOGLE)
1	151.101.129.229 151.101.129.229	54113 (FASTLY) (FASTLY)
5	3

4 104.21.68.229 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

lixinammois.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.106 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.229 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	lixinammois.click 1 redirects lixinammois.click	82 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 310	25 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
5	3

	Domain	Requested by
4	lixinammois.click	1 redirects lixinammois.click
1	cdn.jsdelivr.net	lixinammois.click
1	fonts.googleapis.com	lixinammois.click
5	3

This site contains links to these domains. Also see Links.

Domain
www.facebook.com

Subject Issuer	Validity	Valid
lixinammois.click GTS CA 1P5	`2024-03-11` - `2024-06-09`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://lixinammois.click/help-6308778635
Frame ID: 612C47A1D936DEA8713A7DB6975B2801
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Support Help Contact

Page URL History Show full URLs

https://lixinammois.click/help-3991318675 HTTP 302
https://lixinammois.click/help-6308778635 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

108 kB
Transfer

254 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/legal/terms?paipv=0&eav=AfZ-n0rF_sl3GP74yuYqcJAuMjtNpTHfUcnbG6w6xeh0GTLwLIRte40HvdraKz052z0&_rdr
Title: Terms of Service © 2023

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lixinammois.click/help-3991318675 HTTP 302
https://lixinammois.click/help-6308778635 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request help-6308778635 Show response
lixinammois.click/
Redirect Chain

https://lixinammois.click/help-3991318675
https://lixinammois.click/help-6308778635

3 KB
1 KB

341ms
340ms

Document
text/html

104.21.68.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lixinammois.click/help-6308778635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.68.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 62306362941e8a154f8a3b253ebbde9f071f6d4dfe68652a0339797736f7c7a0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 863cfb73eaa936da-YYZ
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 13 Mar 2024 15:15:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nmUMyI66KQ2uDcflCbfgoVfasC0mtNFqnEzzlM3j91lMTUwU1Xl4pM%2FGg4W1MsFMSsrI6rwYikfXOMinEhW5hFexuq2cj9NeUmzgVP2WdXR3dnIG%2BI6%2B5lsi6AtbCrbIVMj3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
x-turbo-charged-by: LiteSpeed

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 863cfb71be3f36da-YYZ
content-type: text/html; charset=UTF-8
date: Wed, 13 Mar 2024 15:15:56 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /help-6308778635
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eHrsMezCWvFz0NRMI511%2Fu2wyqtEaoY9xnJJ0EDpiiKjj%2B25S1DBkX3bt42aB%2BU30aprqDBtHrowv1oqWNKB7Apm5zymE329o9sK8fy%2BcD%2FeBTD76obLk%2BVXq7Wql0XI3A1vTg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
x-turbo-charged-by: LiteSpeed

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 144ms
60ms Stylesheet
text/css 142.250.80.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,200,300,400,500,700&display=swap

Requested by

Host: lixinammois.click
URL: https://lixinammois.click/help-6308778635

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.106 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f10.1e100.net

Software

ESF /

Resource Hash

59031fbe9c55f4bb1626065b56161ab7bdd3ae68912586f6f0e9735cc4badb64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lixinammois.click/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 13 Mar 2024 15:15:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 13 Mar 2024 15:06:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 13 Mar 2024 15:15:56 GMT

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ 152 KB
25 KB 120ms
28ms Stylesheet
text/css 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

Requested by

Host: lixinammois.click
URL: https://lixinammois.click/help-6308778635

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://lixinammois.click/
Origin: https://lixinammois.click
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 13 Mar 2024 15:15:56 GMT
x-content-type-options: nosniff
content-encoding: br
age: 23866198
x-jsd-version: 5.0.2
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 25360
x-served-by: cache-fra-eddf8230097-FRA, cache-yyz4572-YYZ
x-jsd-version-type: version
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 main.css
lixinammois.click/assets/ 12 KB
4 KB 69ms
68ms Stylesheet
text/css 104.21.68.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lixinammois.click/assets/main.css
Requested by: Host: lixinammois.click
URL: https://lixinammois.click/help-6308778635
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.68.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6280f74dcd8b8dd4e2bd3d62bb72876c9f59068c975ba69e4869ad7780c8e4a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lixinammois.click/help-6308778635
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 15:15:56 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 20 Nov 2023 20:24:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 61764
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f7pREyrpZrxxJRe47A70mElb8MBJlWbqOgqr65w3JKYDUrCoylhCOb2LwTgvjT4CXwtB5eRI8zx594vD%2FktDAD3cPIzYif%2Fmauro8I8ldJcoGUH4slwlrQNvWhNB6tGmJQS65A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
cf-ray: 863cfb763de7a238-YYZ
alt-svc: h3=":443"; ma=86400
expires: Tue, 19 Mar 2024 22:06:32 GMT

GET
H3 200 warning.png
lixinammois.click/assets/ 76 KB
76 KB 41ms
40ms Image
image/png 104.21.68.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lixinammois.click/assets/warning.png
Requested by: Host: lixinammois.click
URL: https://lixinammois.click/help-6308778635
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.68.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8cb9a23a623e526f5c3399a6dbf7faf0eaa171846961a9867747676335f33d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://lixinammois.click/help-6308778635
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 15:15:56 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 61764
alt-svc: h3=":443"; ma=86400
content-length: 77583
last-modified: Mon, 20 Nov 2023 20:29:06 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnB5a7p6%2FIANqu1ICDMpUTzPZPFlKqq6Z%2BAjarqrxcQoqt2fYra12189FSkQldeUvrjItb49ssgFkfdp%2F%2FTqHO3LGgQSLcuurswBVai4S6dIkbIGRQtlmiglZT3brgjPthSXMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 863cfb763deea238-YYZ
expires: Tue, 19 Mar 2024 22:06:32 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lixinammois.click/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4a93ceb6dde0a914eda9bf4bcf5b8d48

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
lixinammois.click
104.21.68.229
142.250.80.106
151.101.129.229
59031fbe9c55f4bb1626065b56161ab7bdd3ae68912586f6f0e9735cc4badb64
62306362941e8a154f8a3b253ebbde9f071f6d4dfe68652a0339797736f7c7a0
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
d6280f74dcd8b8dd4e2bd3d62bb72876c9f59068c975ba69e4869ad7780c8e4a
e8cb9a23a623e526f5c3399a6dbf7faf0eaa171846961a9867747676335f33d8

lixinammois.click Open in urlscan Pro 104.21.68.229 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

108 kBTransfer

254 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

lixinammois.click Open in urlscan Pro
104.21.68.229 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

108 kB
Transfer

254 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!