facebookliveservices.com
Open in
urlscan Pro
2606:4700:3033::681f:5605
Malicious Activity!
Public Scan
Submission Tags: @phishunt_io
Submission: On October 25 via api from ES
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 23rd 2020. Valid for: a year.
This is the only time facebookliveservices.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3033::681f:5605 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3035::6818:6e7f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 213.159.7.92 213.159.7.92 | 42807 (AEROTEK-AS) (AEROTEK-AS) | |
1 | 89.252.181.178 89.252.181.178 | 51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS) | |
1 | 2620:0:862:ed... 2620:0:862:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA) | |
1 | 2606:4700:10:... 2606:4700:10::6816:808 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 6 |
ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)
PTR: 1789thgow.guzel.net.tr
www.lgdestek.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
reamaze.com
cdn.reamaze.com |
7 KB |
1 |
wikimedia.org
upload.wikimedia.org |
62 KB |
1 |
lgdestek.net
www.lgdestek.net |
71 KB |
1 |
pazarlamasyon.com
pazarlamasyon.com |
511 KB |
1 |
resimag.com
resimag.com |
12 KB |
1 |
facebookliveservices.com
facebookliveservices.com |
2 KB |
6 | 6 |
Domain | Requested by | |
---|---|---|
1 | cdn.reamaze.com |
facebookliveservices.com
|
1 | upload.wikimedia.org |
facebookliveservices.com
|
1 | www.lgdestek.net |
facebookliveservices.com
|
1 | pazarlamasyon.com |
facebookliveservices.com
|
1 | resimag.com |
facebookliveservices.com
|
1 | facebookliveservices.com | |
6 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
instagram.com |
help.instagram.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-23 - 2021-10-22 |
a year | crt.sh |
mail.pazarlamasyon.com Let's Encrypt Authority X3 |
2020-09-02 - 2020-12-01 |
3 months | crt.sh |
*.lgdestek.net Let's Encrypt Authority X3 |
2020-09-04 - 2020-12-03 |
3 months | crt.sh |
*.wikipedia.org Let's Encrypt Authority X3 |
2020-09-18 - 2020-12-17 |
3 months | crt.sh |
*.reamaze.com Go Daddy Secure Certificate Authority - G2 |
2019-06-16 - 2021-08-15 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://facebookliveservices.com/
Frame ID: 9750C789AD661D7CEDA8F672DD014E20
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: About us
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: API
Search URL Search Domain Scan URL
Title: Jobs
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
facebookliveservices.com/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
819f2f28aae.png
resimag.com/p1/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook_wordmark.gif
pazarlamasyon.com/wp-content/uploads/2019/11/ |
747 KB 511 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
facebook-696x201.png
www.lgdestek.net/wp-content/uploads/2017/04/ |
71 KB 71 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1200px-Instagram_new.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/9/95/Instagram_new.svg/ |
62 KB 62 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebookbusiness-5c10773c84b1b232ffd4e8ac062ccba571f9c2648098b0f961dc61bfef3adcac.png
cdn.reamaze.com/assets/site/integrations/ |
6 KB 7 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.facebookliveservices.com/ | Name: __cfduid Value: dc1ce767d05324981e503a1b1596105b41603646080 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.reamaze.com
facebookliveservices.com
pazarlamasyon.com
resimag.com
upload.wikimedia.org
www.lgdestek.net
213.159.7.92
2606:4700:10::6816:808
2606:4700:3033::681f:5605
2606:4700:3035::6818:6e7f
2620:0:862:ed1a::2:b
89.252.181.178
1527ce88a4ba99b65a3949a8d55e98efa650206c2834e957a2eb726e47db3c80
4219fda6230b2e999d5b51e25805fe69ce85b172197bbda7eaa8b8879a33b54b
4e390a4a282403c2daf802fe940916ff8064a460c10be19dfa9b603df20aa497
4fa2ab8d30839e0bcf39b86ab9baadb042446e3a545df968c20f92dae851097e
702caf42f0bd2dcce73d18d6109dd14d7b3f2d8a07fd830566d7f743d3205fde
9624ecca26675389335bc5532bd83a6ba97643f0e91d4eee634008b00bb7d0ae