support-391647094929792.lmac.ca
Open in
urlscan Pro
173.254.29.80
Malicious Activity!
Public Scan
Effective URL: https://support-391647094929792.lmac.ca/confirm.html
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On November 24 via api from IT — Scanned from CA
Summary
TLS certificate: Issued by R3 on November 21st 2023. Valid for: 3 months.
This is the only time support-391647094929792.lmac.ca was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 173.254.29.80 173.254.29.80 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 172.253.122.94 172.253.122.94 | 15169 (GOOGLE) (GOOGLE) | |
2 | 172.253.115.147 172.253.115.147 | 15169 (GOOGLE) (GOOGLE) | |
1 | 64.185.227.156 64.185.227.156 | 18450 (WEBNX) (WEBNX) | |
9 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just2072.justhost.com
support-391647094929792.lmac.ca |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
lmac.ca
1 redirects
support-391647094929792.lmac.ca |
91 KB |
2 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
2 KB |
2 |
gstatic.com
www.gstatic.com |
187 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 3028 |
220 B |
0 |
support-391647094929792.com
Failed
support-391647094929792.com Failed |
|
9 | 5 |
Domain | Requested by | |
---|---|---|
4 | support-391647094929792.lmac.ca |
1 redirects
support-391647094929792.lmac.ca
|
2 | www.google.com |
support-391647094929792.lmac.ca
|
2 | www.gstatic.com |
support-391647094929792.lmac.ca
www.google.com |
1 | api.ipify.org |
support-391647094929792.lmac.ca
|
0 | support-391647094929792.com Failed |
support-391647094929792.lmac.ca
|
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.support-391647094929792.lmac.ca R3 |
2023-11-21 - 2024-02-19 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2023-02-07 - 2024-02-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://support-391647094929792.lmac.ca/confirm.html
Frame ID: CD850ADBF3DB1287E1984336C914B9D0
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
BUSINESS SUITEPage URL History Show full URLs
-
https://support-391647094929792.lmac.ca/
HTTP 302
https://support-391647094929792.lmac.ca/confirm.html Page URL
Detected technologies
reCAPTCHA (Captchas) ExpandDetected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://support-391647094929792.lmac.ca/
HTTP 302
https://support-391647094929792.lmac.ca/confirm.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
confirm.html
support-391647094929792.lmac.ca/ Redirect Chain
|
135 KB 56 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__vi.js
www.gstatic.com/recaptcha/releases/uEf7E1417z6GNSkRx7AyL8K8/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
support-391647094929792.lmac.ca/ |
146 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
24 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 908 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
20 B 220 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fbbHandler.php
support-391647094929792.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Segoe.73e9cd89613cc1d9a962.ttf
support-391647094929792.lmac.ca/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ |
465 KB 187 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- support-391647094929792.com
- URL
- http://support-391647094929792.com/fbbHandler.php?data=%3Cbr%3E%3Cp%20style%3D%27color%3A%20red%27%3EDetected%20that%20a%20server%20is%20using%20this%20source%20code%20illegally%3C%2Fp%3E%3Cbr%3E
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture boolean| isFirstLoginInput boolean| requestRatioSelected function| uploadFile function| inputChanger function| nextButton function| moveTab function| modalSetting function| saveInfo object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
support-391647094929792.com
support-391647094929792.lmac.ca
www.google.com
www.gstatic.com
support-391647094929792.com
172.253.115.147
172.253.122.94
173.254.29.80
64.185.227.156
0c3080006f258b8abef02301a3dfe6e6f2c280ec38129b4f02abdf724be97ee9
4970c7161d03503a3eb5ec49e4190a03445c50cd5a9081714bd13183d2d948a7
5b1f89c63b9a87f0a0b2737a0789cf18c8b3786302e2c7dd56fa1d2ebc7bfde2
68d6f5e6353b7af3f62a7458c547270de36d2f2a8af194f0337252513e518270
af29425cec892b25a01c7c6d44239a1230fc46a5728d853fe42aa1ae81be40ce
c220e023d96c314f9aaea30f093ce0c1fd03b58a81331fa451ffb6f1355c397a
cc8b1a0c0827d63eec2c7b9a30d4794ea64fe479cab57c61e86a9d6ad339e4d5
e37853993ce02f2f6249ecfbf554c4d36db8423a1b5d1cf2f0f132b743a0e26c