metax.nu-facepa.com Open in urlscan Pro
178.128.107.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://metax.nu-facepa.com/
Effective URL:
https://metax.nu-facepa.com/support-communiity-standard
Submission: On March 06 via api (March 6th 2024, 10:08:38 am UTC) from SA — Scanned from SG

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 178.128.107.227, located in Singapore, Singapore and belongs to DIGITALOCEAN-ASN, US. The main domain is metax.nu-facepa.com.
TLS certificate: Issued by R3 on March 3rd 2024. Valid for: 3 months.

This is the only time metax.nu-facepa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
2 5	178.128.107.227 178.128.107.227	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2404:6800:400... 2404:6800:4003:c1c::63	15169 (GOOGLE) (GOOGLE)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6814:3d7a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2404:6800:400... 2404:6800:4003:c11::5e	15169 (GOOGLE) (GOOGLE)
7	6

5 178.128.107.227 (Singapore, Singapore) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

metax.nu-facepa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4003:c1c::63 (Singapore, Singapore)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:3d7a (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipgeolocation.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4003:c11::5e (Singapore, Singapore)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	nu-facepa.com 2 redirects metax.nu-facepa.com	77 KB
1	gstatic.com www.gstatic.com	198 KB
1	ipgeolocation.io api.ipgeolocation.io — Cisco Umbrella Rank: 36851	807 B
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2821	156 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
7	5

	Domain	Requested by
5	metax.nu-facepa.com	2 redirects metax.nu-facepa.com
1	www.gstatic.com	www.google.com
1	api.ipgeolocation.io	metax.nu-facepa.com
1	api.ipify.org	metax.nu-facepa.com
1	www.google.com	metax.nu-facepa.com
7	5

This site contains no links.

Subject Issuer	Validity	Valid
metax.nu-facepa.com R3	`2024-03-03` - `2024-06-01`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
ipify.org GTS CA 1P5	`2024-01-22` - `2024-04-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-28` - `2024-04-27`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://metax.nu-facepa.com/support-communiity-standard
Frame ID: 60DB3F70A45F881C5264F4FFAA81B32C
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BUSINESS SUITE

Page URL History Show full URLs

http://metax.nu-facepa.com/ HTTP 301
https://metax.nu-facepa.com/ HTTP 302
https://metax.nu-facepa.com/support-communiity-standard Page URL

Detected technologies

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

7
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

277 kB
Transfer

839 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://metax.nu-facepa.com/ HTTP 301
https://metax.nu-facepa.com/ HTTP 302
https://metax.nu-facepa.com/support-communiity-standard Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request support-communiity-standard Show response
metax.nu-facepa.com/
Redirect Chain

http://metax.nu-facepa.com/
https://metax.nu-facepa.com/
https://metax.nu-facepa.com/support-communiity-standard

149 KB
53 KB

8ms
7ms

Document
text/html

178.128.107.227
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://metax.nu-facepa.com/support-communiity-standard
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.128.107.227 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3f741874017027139a393adc60763051761b7c84eee06d142520f26c70ff540f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 06 Mar 2024 10:08:34 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Mar 2024 10:08:34 GMT
location: support-communiity-standard
server: Apache

GET
H2 200 m.css
metax.nu-facepa.com/css/ 146 KB
24 KB 11ms
11ms Stylesheet
text/css 178.128.107.227
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://metax.nu-facepa.com/css/m.css
Requested by: Host: metax.nu-facepa.com
URL: https://metax.nu-facepa.com/support-communiity-standard
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.128.107.227 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: cc8b1a0c0827d63eec2c7b9a30d4794ea64fe479cab57c61e86a9d6ad339e4d5

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://metax.nu-facepa.com/support-communiity-standard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 10:08:34 GMT
content-encoding: gzip
last-modified: Wed, 06 Dec 2023 21:32:02 GMT
server: Apache
etag: "24661-60bde14ed3880-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 24235

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c220e023d96c314f9aaea30f093ce0c1fd03b58a81331fa451ffb6f1355c397a

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 20 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b1f89c63b9a87f0a0b2737a0789cf18c8b3786302e2c7dd56fa1d2ebc7bfde2

Request headers

accept-language: zh-SG,zh;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 19ms
9ms Script
text/javascript 2404:6800:4003:c1c::63
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=explicit

Requested by

Host: metax.nu-facepa.com
URL: https://metax.nu-facepa.com/support-communiity-standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c1c::63 Singapore, Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f116bc57443b62f2a08eb9ed3f11f00623557a94f9a6762a6b9451a27fee2d7a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://metax.nu-facepa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 10:08:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 06 Mar 2024 10:08:34 GMT

GET
H2 200 / Show response
api.ipify.org/ 23 B
156 B 219ms
201ms Fetch
application/json 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=json
Requested by: Host: metax.nu-facepa.com
URL: https://metax.nu-facepa.com/support-communiity-standard
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17dca9d54d6aaffb02851a377775e9e67a8c206c9766418279bc763bc2ce26a5

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://metax.nu-facepa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 10:08:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: application/json
access-control-allow-origin: *
cf-ray: 86018b95ffdf2f0a-SIN
content-length: 23

GET
H2 200 ipgeo Show response
api.ipgeolocation.io/ 924 B
807 B 42ms
23ms Fetch
application/json 2606:4700:10::6814:3d7a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.ipgeolocation.io/ipgeo?apiKey=f40a6ea769ce4740b4d5462dc649bbcf

Requested by

Host: metax.nu-facepa.com
URL: https://metax.nu-facepa.com/support-communiity-standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:3d7a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe63aefd9623569a6f0a223d055078e414e26358a9c594c1671cbb5b58d7567c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://metax.nu-facepa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 10:08:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://metax.nu-facepa.com
access-control-allow-credentials: true
cf-ray: 86018b95fd255cd9-SIN
alt-svc: h3=":443"; ma=86400

GET
H2 404 Segoe.73e9cd89613cc1d9a962.ttf
metax.nu-facepa.com/css/ 0
0 4ms
3ms Font
text/html 178.128.107.227
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://metax.nu-facepa.com/css/Segoe.73e9cd89613cc1d9a962.ttf
Requested by: Host: metax.nu-facepa.com
URL: https://metax.nu-facepa.com/css/m.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.128.107.227 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://metax.nu-facepa.com/css/m.css
Origin: https://metax.nu-facepa.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 10:08:34 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 200 recaptcha__zh_cn.js Show response
www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/ 499 KB
198 KB 19ms
4ms Script
text/javascript 2404:6800:4003:c11::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vj7hFxe2iNgbe-u95xTozOXW/recaptcha__zh_cn.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c11::5e Singapore, Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d91a519e6b7a22437317cc5c88597d4da75f97adc091e87b1515bab4576314c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://metax.nu-facepa.com/
Origin: https://metax.nu-facepa.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sat, 02 Mar 2024 05:11:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 363430
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 202205
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 03:01:13 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 02 Mar 2025 05:11:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://metax.nu-facepa.com/css/Segoe.73e9cd89613cc1d9a962.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipgeolocation.io
api.ipify.org
metax.nu-facepa.com
www.google.com
www.gstatic.com
172.67.74.152
178.128.107.227
2404:6800:4003:c11::5e
2404:6800:4003:c1c::63
2606:4700:10::6814:3d7a
17dca9d54d6aaffb02851a377775e9e67a8c206c9766418279bc763bc2ce26a5
3f741874017027139a393adc60763051761b7c84eee06d142520f26c70ff540f
5b1f89c63b9a87f0a0b2737a0789cf18c8b3786302e2c7dd56fa1d2ebc7bfde2
c220e023d96c314f9aaea30f093ce0c1fd03b58a81331fa451ffb6f1355c397a
cc8b1a0c0827d63eec2c7b9a30d4794ea64fe479cab57c61e86a9d6ad339e4d5
d91a519e6b7a22437317cc5c88597d4da75f97adc091e87b1515bab4576314c3
f116bc57443b62f2a08eb9ed3f11f00623557a94f9a6762a6b9451a27fee2d7a
fe63aefd9623569a6f0a223d055078e414e26358a9c594c1671cbb5b58d7567c

metax.nu-facepa.com Open in urlscan Pro 178.128.107.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

277 kBTransfer

839 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

metax.nu-facepa.com Open in urlscan Pro
178.128.107.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

277 kB
Transfer

839 kB
Size

0
Cookies

7 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!