# losospl.github.io – Facebook-style login page captured by PhishDestroy | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/losospl.github.io/ Machine-readable companion: https://phishdestroy.io/domain/losospl.github.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-31 10:44:43 UTC - Last availability or vendor check: 2026-10-31 12:11:36 UTC - Stored record updated: 2026-10-31 15:22:28 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: PhishFeed - Google Safe Browsing stored result: flagged ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Facebook ## Stored infrastructure - Observed IP address: 185.199.108.153 - Registrar in stored WHOIS data: GitHub, Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1918e-104f-72bf-bc6b-29a91cf11d1e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/losospl.github.io - Certificate Transparency search: https://crt.sh/?q=%25.losospl.github.io - Web Archive lookup: https://web.archive.org/web/*/https://losospl.github.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records a Facebook-branded login page captured on losospl.github.io, with email or phone and password fields. The captured page on losospl.github.io presents itself as a Facebook login screen, with the page title "Facebook – log in or sign up" and a meta description inviting visitors to log in to start sharing and connecting with friends and family. The main interaction is a login form offering an "Email address or phone number" field, a "Password" field, a blue "Log In" button, a "Forgotten password?" link, and a green "Create New Account" button, alongside the slogan "Facebook helps you connect and share with the people in your life." The stored VirusTotal domain result reports 18 detections out of 92 engines. DNS8 reported "phishing"; ESET reported "phishing". Package revision: 93a11ff69ce792a738860b09262553f40e3f42608da7e4395962b9513e8f8cb7 Text generated (not scan time): 2026-10-31 12:17:15 Reviewed evidence snapshot: {"domain":"losospl.github.io","screenshot_available":true,"page_title":"Facebook – log in or sign up","original_meta_description":"Log in to Facebook to start sharing and connecting with your friends, family and people you know.","metadata_observed_on":"2026-10-31","virustotal":{"detections":18,"engines":92,"malicious":18,"suspicious":0,"retrieved_date":"2026-10-31","analysis_date":"2026-10-22","flagging_vendors":["DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","Netcraft","SOCRadar","Kaspersky","Seclookup","Gridinsoft","BitDefender","alphaMountain.ai","AILabs (MONITORAPP)","Forcepoint ThreatSeeker"],"vendor_labels":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","AILabs (MONITORAPP)":"phishing","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-31T11:15:42Z","final_host":"losospl.github.io","captured_on":"2026-10-31"},"virustotal_public_summary":"The stored VirusTotal domain result reports 18 detections out of 92 engines. DNS8 reported \"phishing\"; ESET reported \"phishing\".","page_paragraph_target_characters":520} Source facts (timestamps as stored): {"record_id":1719744,"first_recorded_at":"2026-10-31 11:44:43","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":18,"denominator":92,"malicious":18,"suspicious":0,"vendors":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","AILabs (MONITORAPP)":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-22T00:04:53Z","checked_at":"2026-10-31 12:15:27","fetched_at":"2026-10-31T11:15:21Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":18,"denominator":92,"malicious":null,"suspicious":null,"vendors":["AILabs (MONITORAPP)","alphaMountain.ai","BitDefender","CyRadar","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Netcraft","Seclookup","SOCRadar","Sophos","VIPRE","Webroot"],"observed_at":"2026-10-22 00:04:53","checked_at":"2026-10-31 12:15:27","fetched_at":"2026-10-31 11:15:27","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"flagged","verdict":1,"checked_at":"2026-10-31 12:15:28"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-31 12:30:19"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-10-31 13:11:36"}} ## Stored page captures - Primary capture: https://i.ibb.co/zhcmT6SD/761cee00663f.png Captured: 2026-10-31 10:44:43 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1918e-104f-72bf-bc6b-29a91cf11d1e.png Captured: 2026-10-31 10:44:43 UTC Source report: https://urlscan.io/result/01a1918e-104f-72bf-bc6b-29a91cf11d1e/ - URLScan capture 2: https://urlscan.io/screenshots/019e2373-f908-77f5-aae8-53e458c1f7c6.png Captured: 2026-10-31 10:39:41 UTC Source report: https://urlscan.io/result/019e2373-f908-77f5-aae8-53e458c1f7c6/ - URLScan · 2025-11-03: https://screenshots.phishdestroy.io/us/019a4891-7b48-771c-8e64-34e4c8790183.png Captured: 2025-11-03 07:14:50 UTC Source report: https://urlscan.io/result/019a4891-7b48-771c-8e64-34e4c8790183/ SHA-256: db1cfa5ad5311aa24e4eaa033b8c965c4c546ea8622abcb4b9b6a5410ceb9c77 - URLScan · 2025-11-12: https://screenshots.phishdestroy.io/us/019a78ec-21e4-728d-9a30-beb0dd18d015.png Captured: 2025-11-12 16:35:38 UTC Source report: https://urlscan.io/result/019a78ec-21e4-728d-9a30-beb0dd18d015/ SHA-256: db1cfa5ad5311aa24e4eaa033b8c965c4c546ea8622abcb4b9b6a5410ceb9c77 - URLScan · 2026-01-04: https://screenshots.phishdestroy.io/us/019b8a08-7e86-7658-91fd-ea61d08aebe9.png Captured: 2026-01-04 17:22:57 UTC Source report: https://urlscan.io/result/019b8a08-7e86-7658-91fd-ea61d08aebe9/ SHA-256: e2dda5d45bf4fdf7ea9ebda2c49f9fa5ed3f4445c6a4ced7a12570c3a57d278b - URLScan · 2026-03-16: https://screenshots.phishdestroy.io/us/019cf677-260e-73a9-881b-5264b14a4f64.png Captured: 2026-03-16 11:45:39 UTC Source report: https://urlscan.io/result/019cf677-260e-73a9-881b-5264b14a4f64/ SHA-256: db1cfa5ad5311aa24e4eaa033b8c965c4c546ea8622abcb4b9b6a5410ceb9c77 - URLScan · 2026-05-13: https://screenshots.phishdestroy.io/us/019e230f-94e5-726b-86bc-3d9a0f9e81b7.png Captured: 2026-05-13 20:38:17 UTC Source report: https://urlscan.io/result/019e230f-94e5-726b-86bc-3d9a0f9e81b7/ SHA-256: db1cfa5ad5311aa24e4eaa033b8c965c4c546ea8622abcb4b9b6a5410ceb9c77 - URLScan · 2026-10-31: https://screenshots.phishdestroy.io/us/01a19195-3c22-72f0-8058-f1302213e4c6.png Captured: 2026-10-31 10:50:44 UTC Source report: https://urlscan.io/result/01a19195-3c22-72f0-8058-f1302213e4c6/ SHA-256: d1032161a58712dac4f6cd354b53cd478cc38ce3615a7853b125073425576186 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/987d4a3a-23c6-40f3-81fa-29714e536b9f.png Captured: 2026-10-31 11:15:42 UTC Source report: https://radar.cloudflare.com/scan/987d4a3a-23c6-40f3-81fa-29714e536b9f SHA-256: ada40aa96620be372d431006dd594b720f2c166e664140c581d6b36d4570c9e6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-31T10:48:33Z", "uuid": "01a1918e-104f-72bf-bc6b-29a91cf11d1e", "scanned_at": "2026-10-31T10:42:55Z", "final_url": "https://losospl.github.io/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://losospl.github.io/", "from": "http://losospl.github.io/", "status": 307 } ], "ip": "185.199.111.153", "ptr": "cdn-185-199-111-153.github.com", "domains": [ "static.xx.fbcdn.net" ], "ips": [ "185.199.111.153" ], "asns": [ "54113" ], "countries": [ "US" ], "link_domains": [ "www.facebook.com", "facebook.com", "bn-in.facebook.com", "as-in.facebook.com", "hi-in.facebook.com", "ne-np.facebook.com", "id-id.facebook.com", "ar-ar.facebook.com", "zh-cn.facebook.com", "ms-my.facebook.com", "es-la.facebook.com", "pt-br.facebook.com", "messenger.com", "pay.facebook.com", "www.oculus.com", "portal.facebook.com", "l.facebook.com", "www.bulletin.com", "about.facebook.com", "developers.facebook.com" ], "social": [ "https://www.facebook.com/recover/initiate", "https://facebook.com/pages/create", "https://bn-in.facebook.com", "https://as-in.facebook.com", "https://hi-in.facebook.com", "https://ne-np.facebook.com", "https://id-id.facebook.com", "https://ar-ar.facebook.com", "https://zh-cn.facebook.com", "https://ms-my.facebook.com", "https://es-la.facebook.com", "https://pt-br.facebook.com", "https://facebook.com/reg", "https://facebook.com/login", "https://facebook.com/lite" ], "doc_hash": "b447347236b61c628db76ca59cdfa9c603aa6a64f10a05290a8278b22539a466", "script_hashes": [ "6f5ab941bbb674765e15673f47f3782602015213ff976a09c38921f96ea492c1" ], "globals": [ "_cstart", "envFlush", "Env", "__DEV__", "CavalryLogger", "now_inl", "__bigPipeFR", "__bigPipeCtor", "hiddenPass", "password" ], "tls": { "san": [ "*.github.com", "*.github.io", "*.githubusercontent.com", "github.com", "github.io", "githubusercontent.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "*.github.io", "protocol": "TLS 1.3", "valid_to": "2026-12-29T23:44:45Z", "valid_from": "2026-09-30T23:44:46Z" }, "domain_age_days": 1576, "apex_age_days": 1576, "tls_age_days": 30, "tls_valid_days": 89, "requests": 47, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 92, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "facebook" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Facebook" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "GitHub.com", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556952" } }, "cf": { "v": 1, "fetched_at": "2026-10-31T11:16:35Z", "uuid": "987d4a3a-23c6-40f3-81fa-29714e536b9f", "scanned_at": "2026-10-31T11:15:42Z", "final_url": "https://losospl.github.io/", "status": 200, "history": [ { "url": "https://losospl.github.io/", "status": 200 } ], "dom_hash": "cfad3ad2c597e1051b8448b0cdcc402092778dc884b89027ea512b9fdc845357", "doc_hash": "b447347236b61c628db76ca59cdfa9c603aa6a64f10a05290a8278b22539a466", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "losospl.github.io", "type": "A", "value": "185.199.110.153" }, { "name": "losospl.github.io", "type": "A", "value": "185.199.111.153" }, { "name": "losospl.github.io", "type": "A", "value": "185.199.108.153" }, { "name": "losospl.github.io", "type": "A", "value": "185.199.109.153" }, { "name": "losospl.github.io", "type": "AAAA", "value": "2606:50c0:8003::153" }, { "name": "losospl.github.io", "type": "AAAA", "value": "2606:50c0:8000::153" }, { "name": "losospl.github.io", "type": "AAAA", "value": "2606:50c0:8001::153" }, { "name": "losospl.github.io", "type": "AAAA", "value": "2606:50c0:8002::153" } ], "dnssec_valid": false, "ip": "127.0.1.24", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-03-08T19:12:48Z", "updated": "2026-08-12T09:08:04Z", "expires": "2027-03-08T19:12:48Z", "nameservers": [ "ns-692.awsdns-22.net", "ns-1622.awsdns-10.co.uk", "dns1.p05.nsone.net", "dns2.p05.nsone.net", "dns3.p05.nsone.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-31T11:15:21Z", "analysis_at": "2026-10-22T00:04:53Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 18, "suspicious": 0, "undetected": 30 }, "detections": { "DNS8": "phishing", "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "AILabs (MONITORAPP)": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "MarkMonitor Inc.", "created": "2013-03-08T19:41:10Z", "expires": "2027-03-08T19:12:48Z", "updated": "2026-08-12T09:08:04Z", "first_seen": "2023-09-28T16:45:29Z", "dns": [ { "ttl": 3600, "type": "CAA", "value": "digicert.com" }, { "ttl": 3600, "type": "CAA", "value": "sectigo.com" }, { "ttl": 3600, "type": "AAAA", "value": "2606:50c0:8001::153" }, { "ttl": 3600, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 3600, "type": "A", "value": "185.199.111.153" }, { "ttl": 3600, "type": "AAAA", "value": "2606:50c0:8003::153" }, { "ttl": 3600, "type": "A", "value": "185.199.109.153" }, { "ttl": 3600, "type": "A", "value": "185.199.110.153" }, { "ttl": 3600, "type": "CAA", "value": "digicert.com" }, { "ttl": 3600, "type": "A", "value": "185.199.108.153" }, { "ttl": 3600, "type": "CAA", "value": "sectigo.com" }, { "ttl": 3600, "type": "AAAA", "value": "2606:50c0:8000::153" }, { "ttl": 3600, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 3600, "type": "AAAA", "value": "2606:50c0:8002::153" } ], "dns_at": "2026-10-22T00:05:19Z", "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c", "cert": { "san": [ "*.github.com", "*.github.io", "*.githubusercontent.com", "github.com", "github.io", "githubusercontent.com" ], "issuer": "Let's Encrypt / YR1", "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8", "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856", "subject": "*.github.io", "valid_to": "2026-12-29T23:44:45Z", "valid_from": "2026-09-30T23:44:46Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-03-08T19:12:48Z", "updated": "2025-02-25T20:53:31Z", "expires": "2027-03-08T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "dns1.p05.nsone.net", "dns2.p05.nsone.net", "dns3.p05.nsone.net", "ns-1622.awsdns-10.co.uk", "ns-692.awsdns-22.net" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-31T11:08:13Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "count": 6, "domain": "losospl.github.io", "issuers": [ "letsencrypt.org", "sectigo.com", "digicert.com" ] }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "social_tags": { "ogUrl": "https://www.facebook.com/", "title": "Facebook – log in or sign up", "ogImage": "https://www.facebook.com/images/fb_icon_325x325.png", "ogSiteName": "Facebook", "description": "Log in to Facebook to start sharing and connecting with your friends, family and people you know.", "canonicalUrl": "https://www.facebook.com/" }, "trackers": { "requests": 36, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Facebook CDN", "company": "Meta", "country": "US", "category": "Hosting", "requests": 30 } ] }, "mixed_content": { "no_sri": [ "https://static.xx.fbcdn.net/rsrc.php/v3/yi/r/wTY5qBMkTkR.js", "https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/PvBFn7IF58H.js", "https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/UXJE_KFXmfT.js", "https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/ymUKktuYtLv.js", "https://static.xx.fbcdn.net/rsrc.php/v3/y3/r/MkXZ7P8-_wS.js", "https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/oXa106O6DQc.js", "https://static.xx.fbcdn.net/rsrc.php/v3/yK/r/VjGUU0v9sW1.js", "https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/TqFluosqNLr.js", "https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/9rqFBr5eUp5.js", "https://static.xx.fbcdn.net/rsrc.php/v3/y4/r/BJocMV4OuoF.js" ], "third_party_scripts": 23 }, "status": { "up": true, "code": 200, "timings": { "dns": 37, "tls": 41, "wait": 268, "connect": 20, "download": 42 }, "response_ms": 408 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 158569, "co2_grams": 0.0058, "cleaner_than": 12 }, "dns_server": { "ns": [ { "ip": "205.251.197.59", "host": "ns-1339.awsdns-39.org" }, { "ip": "205.251.198.86", "host": "ns-1622.awsdns-10.co.uk" }, { "ip": "205.251.193.137", "host": "ns-393.awsdns-49.com" }, { "ip": "205.251.194.180", "host": "ns-692.awsdns-22.net" }, { "ip": "198.51.44.5", "host": "dns1.p05.nsone.net" }, { "ip": "198.51.45.5", "host": "dns2.p05.nsone.net" }, { "ip": "198.51.44.69", "host": "dns3.p05.nsone.net" }, { "ip": "198.51.45.69", "host": "dns4.p05.nsone.net" } ], "zone": "github.io" }, "location": { "ip": "2606:50c0:8001::153", "asn": "54113", "org": "Fastly, Inc.", "city": "San Francisco", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "*.github.io" }, "dns": { "A": [ "185.199.111.153", "185.199.108.153", "185.199.110.153", "185.199.109.153" ], "AAAA": [ "2606:50c0:8003::153", "2606:50c0:8001::153", "2606:50c0:8002::153", "2606:50c0:8000::153" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31556952", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31556952", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2606:50c0:8000::153", "family": 6 }, "redirects": { "chain": [ "https://losospl.github.io" ] }, "linked_pages": { "external": [ "https://www.facebook.com/recover/initiate/", "https://facebook.com/pages/create/", "https://bn-in.facebook.com/", "https://as-in.facebook.com/", "https://hi-in.facebook.com/", "https://ne-np.facebook.com/", "https://id-id.facebook.com/", "https://ar-ar.facebook.com/", "https://zh-cn.facebook.com/", "https://ms-my.facebook.com/", "https://es-la.facebook.com/", "https://pt-br.facebook.com/", "https://facebook.com/reg/", "https://facebook.com/login/", "https://messenger.com/", "https://facebook.com/lite/", "https://www.facebook.com/watch/", "https://facebook.com/places/", "https://facebook.com/games/", "https://facebook.com/marketplace/", "https://pay.facebook.com/", "https://www.oculus.com/", "https://portal.facebook.com/", "https://l.facebook.com/l.php", "https://www.bulletin.com/" ], "external_count": 42, "internal_count": 1 }, "headers": { "headers": { "server": "GitHub.com", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556952" } } } } ```