facebookliveservices.com

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3033::681f:5605, located in United States and belongs to CLOUDFLARENET, US. The main domain is facebookliveservices.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 23rd 2020. Valid for: a year.

This is the only time facebookliveservices.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3033::681f:5605	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3034::ac43:c38e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	213.159.7.92 213.159.7.92	42807 (AEROTEK-AS) (AEROTEK-AS)
1	89.252.181.178 89.252.181.178	51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2606:4700:10:... 2606:4700:10::6816:808	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	6

1 2606:4700:3033::681f:5605 (United States)

ASN13335 (CLOUDFLARENET, US)

facebookliveservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::ac43:c38e (United States)

ASN13335 (CLOUDFLARENET, US)

resimag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.159.7.92 (Turkey)

ASN42807 (AEROTEK-AS, TR)
PTR: srv.pazarlamasyon.com

pazarlamasyon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.252.181.178 (Turkey)

ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)
PTR: 1789thgow.guzel.net.tr

www.lgdestek.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:808 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.reamaze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	reamaze.com cdn.reamaze.com	7 KB
1	wikimedia.org upload.wikimedia.org	62 KB
1	lgdestek.net www.lgdestek.net	71 KB
1	pazarlamasyon.com pazarlamasyon.com	511 KB
1	resimag.com resimag.com	12 KB
1	facebookliveservices.com facebookliveservices.com	2 KB
6	6

	Domain	Requested by
1	cdn.reamaze.com	facebookliveservices.com
1	upload.wikimedia.org	facebookliveservices.com
1	www.lgdestek.net	facebookliveservices.com
1	pazarlamasyon.com	facebookliveservices.com
1	resimag.com	facebookliveservices.com
1	facebookliveservices.com
6	6

This site contains links to these domains. Also see Links.

Domain
instagram.com
help.instagram.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-23` - `2021-10-22`	a year	crt.sh
mail.pazarlamasyon.com Let's Encrypt Authority X3	`2020-09-02` - `2020-12-01`	3 months	crt.sh
*.lgdestek.net Let's Encrypt Authority X3	`2020-09-04` - `2020-12-03`	3 months	crt.sh
*.wikipedia.org Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.reamaze.com Go Daddy Secure Certificate Authority - G2	`2019-06-16` - `2021-08-15`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://facebookliveservices.com/
Frame ID: 1398FC4BD2E1BF0776BE4DFE07803A99
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

666 kB
Transfer

903 kB
Size

1
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://instagram.com/about/us/
Title: About us

Search URL Search Domain Scan URL

URL: https://help.instagram.com/
Title: Help

Search URL Search Domain Scan URL

URL: https://instagram.com/developers/
Title: API

Search URL Search Domain Scan URL

URL: https://instagram.com/about/jobs/
Title: Jobs

Search URL Search Domain Scan URL

URL: https://instagram.com/legal/terms/
Title: Terms

Search URL Search Domain Scan URL

URL: https://instagram.com/legal/privacy/
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
facebookliveservices.com/ 5 KB
2 KB 59ms
28ms Document
text/html 2606:4700:3033::681f:5605
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://facebookliveservices.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::681f:5605 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.11 PleskLin
Resource Hash: 1527ce88a4ba99b65a3949a8d55e98efa650206c2834e957a2eb726e47db3c80

Request headers

:method: GET
:authority: facebookliveservices.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sun, 25 Oct 2020 22:10:45 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dd85d5962b16f98cdee8086b356e9d7611603663845; expires=Tue, 24-Nov-20 22:10:45 GMT; path=/; domain=.facebookliveservices.com; HttpOnly; SameSite=Lax
x-powered-by: PHP/7.4.11 PleskLin
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 060369718400003237a32ec000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rbspyEZtWHriGrl9me5A7dVpE98Pg0JyOsprGHbgx6f9vVbBEvSW0zHAAYLeT4QZokRILYJ%2B2C9Wc1pfu3MyEnRIOYLA%2FH8CLdZdbgCrOP%2FYDb9yHukydDc9TdpmYeInWwtOFjo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5e7f44fc0ae53237-FRA
content-encoding: br

GET
H2 200 819f2f28aae.png
resimag.com/p1/ 12 KB
12 KB 53ms
27ms Image
image/png 2606:4700:3034::ac43:c38e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resimag.com/p1/819f2f28aae.png
Requested by: Host: facebookliveservices.com
URL: https://facebookliveservices.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:c38e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 4fa2ab8d30839e0bcf39b86ab9baadb042446e3a545df968c20f92dae851097e

Request headers

Referer: https://facebookliveservices.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 25 Oct 2020 22:10:45 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-powered-by: PleskLin
status: 200
content-length: 11984
cf-request-id: 06036971bf0000dff3419e0000000001
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BE4XzCB%2BmGCu8DzVcEphtCSw8QJeH8TrnreY%2BVZDDiAswuEEQusnFLpb1cRWirFkS55lIvMSFvQTiq4ZGfpwdZ5bPILR1UWHIQ5J9s8p14PUbKFgXrEMtA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=0, no-cache, no-store, must-revalidate
accept-ranges: bytes
cf-ray: 5e7f44fc68f6dff3-FRA
expires: Mon, 10 Apr 1972 00:00:00 GMT

GET
H2 200 facebook_wordmark.gif
pazarlamasyon.com/wp-content/uploads/2019/11/ 747 KB
511 KB 256ms
67ms Image
image/gif 213.159.7.92
AEROTEK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pazarlamasyon.com/wp-content/uploads/2019/11/facebook_wordmark.gif
Requested by: Host: facebookliveservices.com
URL: https://facebookliveservices.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.159.7.92 , Turkey, ASN42807 (AEROTEK-AS, TR),
Reverse DNS: srv.pazarlamasyon.com
Software: LiteSpeed /
Resource Hash: 4219fda6230b2e999d5b51e25805fe69ce85b172197bbda7eaa8b8879a33b54b

Request headers

Referer: https://facebookliveservices.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 25 Oct 2020 22:10:46 GMT
content-encoding: br
last-modified: Tue, 05 Nov 2019 10:04:55 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-22=":443"; ma=2592000
content-length: 523215
expires: Sun, 01 Nov 2020 22:10:46 GMT

GET
H/1.1 200
OK facebook-696x201.png
www.lgdestek.net/wp-content/uploads/2017/04/ 71 KB
71 KB 261ms
81ms Image
image/png 89.252.181.178
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lgdestek.net/wp-content/uploads/2017/04/facebook-696x201.png
Requested by: Host: facebookliveservices.com
URL: https://facebookliveservices.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 89.252.181.178 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: 1789thgow.guzel.net.tr
Software: Apache /
Resource Hash: 9624ecca26675389335bc5532bd83a6ba97643f0e91d4eee634008b00bb7d0ae

Request headers

Referer: https://facebookliveservices.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 25 Oct 2020 22:10:46 GMT
Last-Modified: Thu, 27 Apr 2017 14:08:48 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=2592000, public
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 72367
Expires: max-age=2592000, public

GET
H2 200 1200px-Instagram_new.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/ 62 KB
62 KB 51ms
24ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/1200px-Instagram_new.svg.png

Requested by

Host: facebookliveservices.com
URL: https://facebookliveservices.com/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

Referer: https://facebookliveservices.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 25 Oct 2020 08:22:04 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 49721
x-cache-status: hit-front
x-cache: cp3055 hit, cp3065 hit/31
status: 200
server-timing: cache;desc="hit-front"
content-length: 63143
x-client-ip: 2a01:4f8:192:5414::2
last-modified: Sun, 24 Dec 2017 17:19:39 GMT
server: ATS/8.0.8
etag: 24ae7140ef6bb03a33a8ea6e36a55775
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
x-timestamp: 1514135978.13911
accept-ranges: bytes
timing-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

GET
H2 200 facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.png
cdn.reamaze.com/assets/site/integrations/ 6 KB
7 KB 48ms
24ms Image
image/webp 2606:4700:10::6816:808
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.reamaze.com/assets/site/integrations/facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.png
Requested by: Host: facebookliveservices.com
URL: https://facebookliveservices.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:808 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 702caf42f0bd2dcce73d18d6109dd14d7b3f2d8a07fd830566d7f743d3205fde

Request headers

Referer: https://facebookliveservices.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 25 Oct 2020 22:10:45 GMT
cf-cache-status: HIT
age: 112552
cf-polished: origFmt=png, origSize=7669
status: 200
content-disposition: inline; filename="facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.webp"
content-length: 6454
cf-request-id: 06036971be0000dff356ae4000000001
last-modified: Thu, 03 Oct 2019 18:19:24 GMT
server: cloudflare
etag: "1df5-59405a0054300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
cache-control: max-age=604800, public
accept-ranges: bytes
cf-ray: 5e7f44fc68f4dff3-FRA
cf-bgj: imgq:100,h2pri

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.facebookliveservices.com/	1970-01-19 14:10:55	Name: __cfduid Value: dd85d5962b16f98cdee8086b356e9d7611603663845

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.reamaze.com
facebookliveservices.com
pazarlamasyon.com
resimag.com
upload.wikimedia.org
www.lgdestek.net
213.159.7.92
2606:4700:10::6816:808
2606:4700:3033::681f:5605
2606:4700:3034::ac43:c38e
2620:0:862:ed1a::2:b
89.252.181.178
1527ce88a4ba99b65a3949a8d55e98efa650206c2834e957a2eb726e47db3c80
4219fda6230b2e999d5b51e25805fe69ce85b172197bbda7eaa8b8879a33b54b
4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497
4fa2ab8d30839e0bcf39b86ab9baadb042446e3a545df968c20f92dae851097e
702caf42f0bd2dcce73d18d6109dd14d7b3f2d8a07fd830566d7f743d3205fde
9624ecca26675389335bc5532bd83a6ba97643f0e91d4eee634008b00bb7d0ae

facebookliveservices.com Open in urlscan Pro 2606:4700:3033::681f:5605 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

666 kBTransfer

903 kBSize

1 Cookies

6 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

facebookliveservices.com Open in urlscan Pro
2606:4700:3033::681f:5605 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

666 kB
Transfer

903 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!