![](/screenshots/73f982d7-c955-4227-b33c-761075f682ed.png)
metasupport1681.click
Open in
urlscan Pro
137.59.105.38
Malicious Activity!
Public Scan
Submission: On October 24 via api from CZ — Scanned from DE
Summary
TLS certificate: Issued by R10 on October 22nd 2024. Valid for: 3 months.
This is the only time metasupport1681.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 137.59.105.38 137.59.105.38 | 131392 (RUNSYSTEM...) (RUNSYSTEM-AS-VN GMO-Z.com Runsystem Joint Stock Company) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 18.173.154.22 18.173.154.22 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 13.251.202.37 13.251.202.37 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 6 |
ASN131392 (RUNSYSTEM-AS-VN GMO-Z.com Runsystem Joint Stock Company, VN)
PTR: ng-shost104.tenten.vn
metasupport1681.click |
ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-22.muc50.r.cloudfront.net
w.ladicdn.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-13-251-202-37.ap-southeast-1.compute.amazonaws.com
a.ladipage.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
ladicdn.com
w.ladicdn.com — Cisco Umbrella Rank: 89845 |
367 KB |
2 |
ladipage.com
a.ladipage.com — Cisco Umbrella Rank: 102650 |
651 B |
2 |
metasupport1681.click
metasupport1681.click |
12 KB |
1 |
gstatic.com
fonts.gstatic.com |
47 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
2 KB |
10 | 5 |
Domain | Requested by | |
---|---|---|
4 | w.ladicdn.com |
metasupport1681.click
w.ladicdn.com |
2 | a.ladipage.com |
w.ladicdn.com
|
2 | metasupport1681.click | |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
metasupport1681.click
|
10 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpcalendars.metasupport1681.click R10 |
2024-10-22 - 2025-01-20 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
w.ladicdn.com Amazon RSA 2048 M02 |
2024-09-12 - 2025-10-12 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
a.ladipage.com Amazon RSA 2048 M03 |
2024-04-17 - 2025-05-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://metasupport1681.click/
Frame ID: 2E06CD0C98CB307C8C79212272E812B8
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/73f982d7-c955-4227-b33c-761075f682ed.png)
Page Title
Meta SupportDetected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
metasupport1681.click/ |
60 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
12 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipagev3.min.js
w.ladicdn.com/v4/source/ |
412 KB 97 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vhh-20240617084303-fdndp.jpeg
w.ladicdn.com/s750x550/63ea07ec81c3610012d4afa0/ |
236 KB 234 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
event
a.ladipage.com/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.formdata.min.js
w.ladicdn.com/v4/source/ |
127 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
385 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
a.ladipage.com/ |
125 B 651 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
metasupport1681.click/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ladipage.svg
w.ladicdn.com/source/v3/by/ |
12 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)46 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| ladi_ttq function| lazyload_run function| equalsLadiPage function| isObjectLadiPage function| isArrayLadiPage function| isFunctionLadiPage function| isBooleanLadiPage function| isStringLadiPage function| isEmptyLadiPage function| isNullLadiPage function| parseFloatLadiPage function| decodeURIComponentLadiPage function| formatNumber function| textToNumber function| formatNumberComma function| textToNumberComma function| formatNumberDot function| textToNumberDot object| Base64 function| LadiPageScriptV2 object| LadiPageScript object| LadiFormulaData object| LadiFormApi object| LadiPageCommand object| LadiPageLocation object| LadiPageShopping object| LadiPageFormData object| LadiPageQueueCommandList object| LadiPageQueueCommand function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| language_set function| LadiPageLibraryV2 function| checkVideoInTabForAutoplay function| ladi function| ladi_api_fbq function| ladi_api_ttq function| LadiPageAppV2 function| sha256 function| sha224 object| LadiPageApp3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
metasupport1681.click/ | Name: _timenow Value: 1729735271858 |
|
metasupport1681.click/ | Name: LADI_UNIQUE_ID Value: 7434c0bc-9232-4168-956c-6d9a729d1391 |
|
metasupport1681.click/ | Name: LADI_FFD Value: eyJwdiI6eyJlIjoxNzYxMjcxMjcxLCJ2IjoxfX0= |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.ladipage.com
fonts.googleapis.com
fonts.gstatic.com
metasupport1681.click
w.ladicdn.com
13.251.202.37
137.59.105.38
18.173.154.22
2a00:1450:4001:81d::200a
2a00:1450:4001:82a::2003
0d43791134e2e13160c0f0ad2a1b60831798f279d51728750ab7a5e3adce156a
15f0ec97f50aafcf6eb1897a3119f1a1853e15b3743270405194514858e134d1
1b08452347062ec983b6fc92d82cf2af31c8969e8df70dc7d871352215462da2
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
4cf83180be5d295983d767e8707553bad91890759375ed8e535f9447c2ff2ebe
52fef9793b17424922aa60ca8090658449874f99bfb93e6e2569bb8c4fa4f657
628302bae3cba02607d2fefa6eaf3d0549c0c8ab9f41bd171d74f3757826b6bf
6af40093744add7762ad9953347c4cc9494b22d08540bda121d920e74698e431
e063566e797cac66b08f1781227f5ed7f4f3ecb2553f3b497c2a60ea1677ad17