facebook.6259316968311544.help Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response facebook.6259316968311544.help/.com/	58 KB 13 KB	300ms 224ms	Document text/html	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://facebook.6259316968311544.help/.com/?=&c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7fa71d203b0ef31ee889d3b88eb2b386df9355b6714b7d83a8d860bba1f49f14 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 802d9b2f69740b79-AMS content-encoding br content-type text/html date Thu, 07 Sep 2023 08:33:19 GMT last-modified Wed, 06 Sep 2023 15:25:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2DonoECQ%2F4MkUf5hW0nuCEf31lIjypQjeo0kLgkyMhshGd7mm1e4iTDlinYMaVd3osy2Q%2FnWegZtx6g%2FMAg8to9p2e%2FzNVrDbgByc9R9M1u68cqNFCkq9JoQv1e6gem1J1YG%2FneFYzG3CVVVlib2pzB45X5dSQ1%2Fkf7FnYI%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	15 KB 1 KB	114ms 42ms	Stylesheet text/css	2a00:1450:4001:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&family=Roboto+Slab:wght@400;700&family=Roboto:wght@400;700&display=swap Requested by Host: facebook.6259316968311544.help URL: https://facebook.6259316968311544.help/.com/?=&amp;c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 70453e8dc3a0c42a843aa4a971f5816920eeb77c47dcd4a2db3ec2ffe32eb0b5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 07 Sep 2023 08:33:19 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 07 Sep 2023 08:33:19 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 07 Sep 2023 08:33:19 GMT
GET H2	200	ladipagev3.min.js Show response w.ladicdn.com/v2/source/	378 KB 94 KB	125ms 32ms	Script text/javascript	2400:52e0:1e00::864:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipagev3.min.js?v=1693881728764 Requested by Host: facebook.6259316968311544.help URL: https://facebook.6259316968311544.help/.com/?=&amp;c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::864:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-864 / Resource Hash 696246ba30ebf0897f41a6a4f66b0028bb76cabb54238b3662d69ed2e9cabe0e Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 08:33:19 GMT content-encoding br cdn-edgestorageid 1075 perma-cache HIT cdn-storageserver NY-346 cdn-cachedat 09/05/2023 02:49:25 cdn-pullzone 575124 last-modified Tue, 05 Sep 2023 02:46:46 GMT server BunnyCDN-DE1-864 cdn-fileserver 694 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"64f69696-5e910" vary Accept-Encoding, Accept-Encoding content-type text/javascript cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba cache-control public, max-age=31919000 cdn-requestid adbda340020552149f194f2dc0bb15d7 cdn-requestcountrycode NL cdn-status 200 cdn-requestpullsuccess True
GET H2	200	ztracker.js Show response s.zzcdn.me/ztr/	23 KB 8 KB	688ms 209ms	Script application/javascript	58.187.8.6 FPT-AS-AP FPT Tel...
General Check archive.org Show headers Download Go to Full URL https://s.zzcdn.me/ztr/ztracker.js?id=7056840457216708608 Requested by Host: facebook.6259316968311544.help URL: https://facebook.6259316968311544.help/.com/?=&amp;c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_256_GCM Server 58.187.8.6 Hanoi, Viet Nam, ASN18403 (FPT-AS-AP FPT Telecom Company, VN), Reverse DNS Software Universe / Resource Hash 45b4fb3d724d209c5064eae7d20e445c8af7e7829aeebf0369de54febf7d8593 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 08:33:20 GMT content-encoding gzip server Universe age 4408376 x-cache-status HIT content-type application/javascript access-control-allow-origin * cache-control no-cache accept-ranges bytes content-length 7848
GET H2	200	z4617595995985_5d5fb8018d383b0d11b5748d4680c2f4-20230819092014-y2r-n.jpg w.ladicdn.com/s950x600/64366c789df04f0012600c5d/	36 KB 37 KB	163ms 96ms	Image image/jpeg	2400:52e0:1e00::864:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/s950x600/64366c789df04f0012600c5d/z4617595995985_5d5fb8018d383b0d11b5748d4680c2f4-20230819092014-y2r-n.jpg Requested by Host: facebook.6259316968311544.help URL: https://facebook.6259316968311544.help/.com/?=&amp;c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::864:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-864 / Resource Hash d83cb16d5cff17427be63d80ca659a66c8093ca4bed4189fc641ae1f3be57c98 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 08:33:19 GMT cdn-edgestorageid 756 perma-cache HIT cdn-storageserver NY-267 cdn-cachedat 09/02/2023 21:08:26 cdn-pullzone 575124 content-length 37150 last-modified Sat, 19 Aug 2023 09:34:03 GMT server BunnyCDN-DE1-864 cdn-fileserver 354 cdn-requestpullcode 200 cdn-proxyver 1.04 etag "64e08c8b-911e" content-type image/jpeg access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 0637bab0459afc0bc0b6a6f6eb1f3858 accept-ranges bytes cdn-requestcountrycode NL access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/	47 KB 48 KB	103ms 32ms	Font font/woff2	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;700&family=Roboto+Slab:wght@400;700&family=Roboto:wght@400;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://facebook.6259316968311544.help accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Fri, 01 Sep 2023 09:02:59 GMT x-content-type-options nosniff age 516620 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 31 Aug 2024 09:02:59 GMT
OPTIONS H2	200	event a.ladipage.com/	0 0	584ms 201ms	Preflight application/json	18.139.180.170 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.139.180.170 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-139-180-170.ap-southeast-1.compute.amazonaws.com Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,ladi_camp_form_submit,ladi_camp_id,ladi_camp_name,ladi_camp_origin_url,ladi_camp_page_view,ladi_camp_target_url,ladi_camp_type,ladi_client_id,ladi_form_submit,ladi_page_view Access-Control-Request-Method POST Origin https://facebook.6259316968311544.help Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily access-control-allow-methods POST, OPTIONS access-control-allow-origin * access-control-max-age 2592000 content-encoding gzip content-type application/json; charset=utf-8 date Thu, 07 Sep 2023 08:33:20 GMT vary Accept-Encoding x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-xss-protection 0
GET H2	200	ladipage.formdata.min.js Show response w.ladicdn.com/v2/source/	54 KB 16 KB	34ms 33ms	Script text/javascript	2400:52e0:1e00::864:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipage.formdata.min.js?v=1693881728764 Requested by Host: w.ladicdn.com URL: https://w.ladicdn.com/v2/source/ladipagev3.min.js?v=1693881728764 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::864:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-864 / Resource Hash 4df24c1c88120512e898c83365fec1659c98295c47529838dfa64177345b433a Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 08:33:19 GMT content-encoding br cdn-edgestorageid 1048 perma-cache HIT cdn-storageserver NY-427 cdn-cachedat 09/06/2023 03:55:43 cdn-pullzone 575124 last-modified Tue, 05 Sep 2023 02:47:32 GMT server BunnyCDN-DE1-864 cdn-fileserver 694 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"64f696c4-d765" vary Accept-Encoding, Accept-Encoding content-type text/javascript cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba cache-control public, max-age=31919000 cdn-requestid ad954091519cc5db398e05c0f414b0a1 cdn-requestcountrycode NL cdn-status 200 cdn-requestpullsuccess True
GET DATA	200 OK	truncated /	385 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/svg+xml
POST H2	200	event Show response a.ladipage.com/	106 B 632 B	417ms 417ms	XHR text/plain	18.139.180.170 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Requested by Host: w.ladicdn.com URL: https://w.ladicdn.com/v2/source/ladipagev3.min.js?v=1693881728764 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.139.180.170 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-139-180-170.ap-southeast-1.compute.amazonaws.com Software / Resource Hash 29d9e01151932ae6955f915572beab07a838318c9ec100bb77923f13ffcc2eee Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers LADI_CLIENT_ID LADI_CAMP_ORIGIN_URL LADI_FORM_SUBMIT 0 LADI_CAMP_ID LADI_CAMP_FORM_SUBMIT 0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 LADI_CAMP_NAME Content-Type application/json accept-language nl-NL,nl;q=0.9 LADI_CAMP_TARGET_URL LADI_CAMP_PAGE_VIEW 0 Referer https://facebook.6259316968311544.help/ LADI_PAGE_VIEW 0 LADI_CAMP_TYPE Response headers date Thu, 07 Sep 2023 08:33:20 GMT x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN access-control-allow-methods POST, OPTIONS content-type text/plain; charset=utf-8 access-control-allow-origin * access-control-max-age 2592000 access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily x-xss-protection 0
GET H2	200	events Show response log.adtimaserver.vn/ptrck/	264 B 412 B	689ms 196ms	XHR application/json	120.138.69.227 VINAGAME-AS-VN VN...
General Check archive.org Show headers Download Go to Full URL https://log.adtimaserver.vn/ptrck/events?pixelId=7056840457216708608&url=https%3A%2F%2Ffacebook.6259316968311544.help%2F.com%2F%3F%3D%26amp%3Bc9f55%3DNx2XIRMtoMZs42h Requested by Host: s.zzcdn.me URL: https://s.zzcdn.me/ztr/ztracker.js?id=7056840457216708608 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 120.138.69.227 , Viet Nam, ASN38244 (VINAGAME-AS-VN VNG Corporation, VN), Reverse DNS ptr.vng.vn Software nginx, 2835 / Resource Hash 26b7a3d62b776389695e8b5946c8ff9a014c006b00a46edc9da189b0c17ae708 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Sep 2023 08:33:20 GMT access-control-expose-headers X-sessionId,token server nginx, 2835 content-length 264 content-type application/json;charset=utf-8
GET H2	200	tracklp log.adtimaserver.vn/	8 B 142 B	684ms 191ms	Image text/html	120.138.69.227 VINAGAME-AS-VN VN...
General Check archive.org Show headers Download Go to Show image Full URL https://log.adtimaserver.vn/tracklp?type=pageview&pId=7056840457216708608&adtid=null&curl=https%3A%2F%2Ffacebook.6259316968311544.help%2F.com%2F%3F%3D%26amp%3Bc9f55%3DNx2XIRMtoMZs42h&uid=&ver=1.1.29&ref=&dur=1&atmrk=0.03960629064198695 Requested by Host: facebook.6259316968311544.help URL: https://facebook.6259316968311544.help/.com/?=&amp;c9f55=Nx2XIRMtoMZs42h Protocol H2 Security TLS 1.3, , AES_256_GCM Server 120.138.69.227 , Viet Nam, ASN38244 (VINAGAME-AS-VN VNG Corporation, VN), Reverse DNS ptr.vng.vn Software nginx, 2835 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Sep 2023 08:33:20 GMT access-control-allow-credentials true server nginx, 2835 content-length 8 content-type text/html;charset=utf-8
GET H2	200	tracklp log.adtimaserver.vn/	8 B 141 B	191ms 191ms	Image text/html	120.138.69.227 VINAGAME-AS-VN VN...
General Check archive.org Show headers Download Go to Show image Full URL https://log.adtimaserver.vn/tracklp?type=viewable&value=view_area%3D90%3Bduration%3D692&pId=7056840457216708608&adtid=null&curl=https%3A%2F%2Ffacebook.6259316968311544.help%2F.com%2F%3F%3D%26amp%3Bc9f55%3DNx2XIRMtoMZs42h&uid=&ver=1.1.29&ref=&atmrk=0.05316584431156901 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 120.138.69.227 , Viet Nam, ASN38244 (VINAGAME-AS-VN VNG Corporation, VN), Reverse DNS ptr.vng.vn Software nginx, 2835 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers access-control-allow-origin * date Thu, 07 Sep 2023 08:33:21 GMT access-control-allow-credentials true server nginx, 2835 content-length 8 content-type text/html;charset=utf-8
GET H2	200	log log.adtimaserver.vn/ptrck/	0 0	192ms 192ms	Image application/json	120.138.69.227 VINAGAME-AS-VN VN...
General Check archive.org Show headers Download Go to Show image Full URL https://log.adtimaserver.vn/ptrck/log?pId=7056840457216708608&eId=1393893465614933723&et=3&url=https%3A%2F%2Ffacebook.6259316968311544.help%2F.com%2F%3F%3D%26amp%3Bc9f55%3DNx2XIRMtoMZs42h&value=&adtid=null&curl=https%3A%2F%2Ffacebook.6259316968311544.help%2F.com%2F%3F%3D%26amp%3Bc9f55%3DNx2XIRMtoMZs42h&uid=&ver=1.1.29&ref=&estd=ViewContent&atmrk=0.7312588845044543 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 120.138.69.227 , Viet Nam, ASN38244 (VINAGAME-AS-VN VNG Corporation, VN), Reverse DNS ptr.vng.vn Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers
GET H2	200	ladipage.svg w.ladicdn.com/source/v3/by/	12 KB 6 KB	33ms 33ms	Image image/svg+xml	2400:52e0:1e00::864:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/source/v3/by/ladipage.svg?v=1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::864:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-864 / Resource Hash 628302bae3cba02607d2fefa6eaf3d0549c0c8ab9f41bd171d74f3757826b6bf Request headers accept-language nl-NL,nl;q=0.9 Referer https://facebook.6259316968311544.help/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 08:33:23 GMT content-encoding br cdn-edgestorageid 752 perma-cache HIT cdn-storageserver NY-346 cdn-cachedat 07/29/2023 08:34:30 cdn-pullzone 575124 last-modified Wed, 01 Mar 2023 03:26:11 GMT server BunnyCDN-DE1-864 cdn-fileserver 562 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"63fec5d3-3168" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 18fe701ec29f003c0cacb4d938b2b81b cdn-requestcountrycode NL access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| ladi_ttq function| ztrq function| _ztrk object| LadiPageZaloAds function| lazyload_run function| LadiPageScriptV2 object| Base64 function| equalsLadiPage function| isObjectLadiPage function| isArrayLadiPage function| isFunctionLadiPage function| isBooleanLadiPage function| isStringLadiPage function| isEmptyLadiPage function| isNullLadiPage function| parseFloatLadiPage function| decodeURIComponentLadiPage object| LadiPageScript object| LadiFormulaData object| LadiFormApi object| LadiPageCommand object| LadiPageLocation object| LadiPageShopping object| LadiPageFormData object| LadiPageQueueCommandList object| LadiPageQueueCommand function| formatNumber function| textToNumber function| formatNumberComma function| textToNumberComma function| formatNumberDot function| textToNumberDot function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| language_set function| LadiPageLibraryV2 function| ladi function| LadiPageAppV2 function| sha256 function| sha224 object| LadiPageApp object| ztracker

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			facebook.6259316968311544.help/.com/	1970-01-20 14:36:01	Name: _timenow Value: 1694075599705
			facebook.6259316968311544.help/.com/	1970-01-20 23:20:11	Name: LADI_UNIQUE_ID Value: d7579dfb-820a-4ffb-aceb-6b2440f06a08

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ladipage.com
facebook.6259316968311544.help
fonts.googleapis.com
fonts.gstatic.com
log.adtimaserver.vn
s.zzcdn.me
w.ladicdn.com
120.138.69.227
18.139.180.170
2400:52e0:1e00::864:1
2a00:1450:4001:811::2003
2a00:1450:4001:81c::200a
2a06:98c1:3120::3
58.187.8.6
0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a
26b7a3d62b776389695e8b5946c8ff9a014c006b00a46edc9da189b0c17ae708
29d9e01151932ae6955f915572beab07a838318c9ec100bb77923f13ffcc2eee
45b4fb3d724d209c5064eae7d20e445c8af7e7829aeebf0369de54febf7d8593
4df24c1c88120512e898c83365fec1659c98295c47529838dfa64177345b433a
628302bae3cba02607d2fefa6eaf3d0549c0c8ab9f41bd171d74f3757826b6bf
696246ba30ebf0897f41a6a4f66b0028bb76cabb54238b3662d69ed2e9cabe0e
70453e8dc3a0c42a843aa4a971f5816920eeb77c47dcd4a2db3ec2ffe32eb0b5
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7fa71d203b0ef31ee889d3b88eb2b386df9355b6714b7d83a8d860bba1f49f14
d83cb16d5cff17427be63d80ca659a66c8093ca4bed4189fc641ae1f3be57c98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855