Phishing facebook link explanation question

Phishing facebook link explanation question

So I received a link which looks like a fb video, here how it looks:

[https://i.imgur.com/Kit1R8p.png](https://i.imgur.com/Kit1R8p.png)

the href is:

[https://l.facebook.com/l.php?u=https%3A%2F%2Fssur.cc%2FyxYKt%3Ffbclid%3DIwAR0onXlATBTk2Yd3DG8WyFrqG1AsZSCN6LIh8nl2blZ29yY7X7hOI5zXu60&h=AT26Oy-3ZxcmgPhw6YoM_C_pAaSuvNzqWdYmqOJwu0EaLzoveyQDIAJEVp5rHph4nLnzO4QBUQxmm09-s9RSJtOTyVi2Zlu8n68jOABXKhRHWY5U0juiuHVk1dHyp0yv](https://l.facebook.com/l.php?u=https%3A%2F%2Fssur.cc%2FyxYKt%3Ffbclid%3DIwAR0onXlATBTk2Yd3DG8WyFrqG1AsZSCN6LIh8nl2blZ29yY7X7hOI5zXu60&h=AT26Oy-3ZxcmgPhw6YoM_C_pAaSuvNzqWdYmqOJwu0EaLzoveyQDIAJEVp5rHph4nLnzO4QBUQxmm09-s9RSJtOTyVi2Zlu8n68jOABXKhRHWY5U0juiuHVk1dHyp0yv)

which then redirects you to:

[https://static-eu.insales.ru/files/1/5308/14455996/original/uujajsjdf11111__37_.html#0.8331397446062021](https://static-eu.insales.ru/files/1/5308/14455996/original/uujajsjdf11111__37_.html#0.8331397446062021)

now when i checked its source code i found very simple but sophisticated phising method.. thought i would share it with you all.. just 2 things i didn’t understand:

1. can someone provide the href for the inital url before it’s direct us to the second url i just struggle to convert all the spaces in the url to the actual clean url, so i can inspect its code.
2. how exactly the src html in the second url gets to display the fb phising page, what’s the mechanism behind it, e.g. how it’s called / how it’s works?

Leave a Comment

Your email address will not be published. Required fields are marked *