wgltracking.com
Open in
urlscan Pro
2606:4700:4400::6812:25fa
Malicious Activity!
Public Scan
Submission: On May 17 via api from US — Scanned from US
Summary
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on May 16th 2023. Valid for: a year.
This is the only time wgltracking.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Walmart (Retail)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:440... 2606:4700:4400::6812:25fa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 151.101.193.74 151.101.193.74 | 54113 (FASTLY) (FASTLY) | |
1 5 | 20.242.10.199 20.242.10.199 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 104.106.250.62 104.106.250.62 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
15 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
beacon.walmartlabs.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-106-250-62.deploy.static.akamaitechnologies.com
b.wal.co |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
walmartimages.com
i5.walmartimages.com — Cisco Umbrella Rank: 4309 |
349 KB |
5 |
walmartlabs.com
1 redirects
beacon.walmartlabs.com |
4 KB |
3 |
wgltracking.com
wgltracking.com |
8 KB |
1 |
wal.co
b.wal.co — Cisco Umbrella Rank: 7745 |
29 KB |
15 | 4 |
Domain | Requested by | |
---|---|---|
7 | i5.walmartimages.com |
wgltracking.com
i5.walmartimages.com |
5 | beacon.walmartlabs.com |
1 redirects
i5.walmartimages.com
|
3 | wgltracking.com |
i5.walmartimages.com
|
1 | b.wal.co |
wgltracking.com
|
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cf-prod.wgltracking.com GlobalSign RSA OV SSL CA 2018 |
2023-05-16 - 2024-06-16 |
a year | crt.sh |
fa-prod.walmartimages.com GlobalSign RSA OV SSL CA 2018 |
2023-02-06 - 2024-03-09 |
a year | crt.sh |
beacon.walmart.com GlobalSign RSA OV SSL CA 2018 |
2023-03-22 - 2024-04-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wgltracking.com/
Frame ID: 3FDB4DEB9EF5F502766F2B9104F1CCF3
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://beacon.walmartlabs.com/rum.js?mode=release&bh=beacon.lot.walmartlabs.com&bd=beacon.walmartlabs.com&pv_id=55ab3266-6e82-4263-9576-f2e3d0ae799a HTTP 302
- https://b.wal.co/rum.js;yXXPH3Ab5qvSw4xmG5kV3lbX-I4?bh=beacon.lot.walmartlabs.com
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
wgltracking.com/ |
12 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ft.js
i5.walmartimages.com/dfw/63fd9f59-c534/7237d572-0c98-4eab-974b-3b694e72f5ba/v1/ |
16 B 695 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BogleWeb_subset.css
i5.walmartimages.com/dfw/63fd9f59-7a1b/1399b31b-559f-4202-b08a-1e41342cedba/v1/ |
2 KB 757 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.style.b895e42e857305b4f4cd.css
i5.walmartimages.com/dfw/63fd9f59-aa11/7ac6848b-b029-4801-a96c-632f94a3c55b/v1/ |
187 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.bundle.b895e42e857305b4f4cd.js
i5.walmartimages.com/dfw/63fd9f59-aa11/7ac6848b-b029-4801-a96c-632f94a3c55b/v1/ |
965 KB 197 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
drivingDetails
wgltracking.com/api/ |
159 B 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
drivingDetails
wgltracking.com/api/ |
151 B 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.js
beacon.walmartlabs.com/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e5c990b4c4fe6e87f4f78546882216a7.svg
i5.walmartimages.com/dfw/63fd9f59-aa11/7ac6848b-b029-4801-a96c-632f94a3c55b/v1/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.js;yXXPH3Ab5qvSw4xmG5kV3lbX-I4
b.wal.co/ Redirect Chain
|
87 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.gif
beacon.walmartlabs.com/ |
68 B 569 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.gif
beacon.walmartlabs.com/ |
68 B 442 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2f021ef63b342bd3979feb55a874b3a5.svg
i5.walmartimages.com/dfw/63fd9f59-aa11/7ac6848b-b029-4801-a96c-632f94a3c55b/v1/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c1678b46f7dd3f50ceac94ed4e0ad01a.ttf
i5.walmartimages.com/dfw/63fd9f59-aa11/7ac6848b-b029-4801-a96c-632f94a3c55b/v1/ |
263 KB 124 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rum.gif
beacon.walmartlabs.com/ |
68 B 522 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Walmart (Retail)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _wml function| _lload function| _Dyn object| _exp object| __core-js_shared__ object| _bcq boolean| isNode object| _bcc function| BOOMR_check_doc_domain object| jsonPath string| s_account object| BOOMR object| privPrefData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
wgltracking.com/ | Name: TS01cc7ea9 Value: 012737dac219a797ce7c21e6869cd8668f6d9433b23840a4680da3b35d91e2798b8d2483867ba3a38b8805f525d6a5e91c64046bbf |
|
wgltracking.com/ | Name: x-csrf-jwt Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoiY29va2llIiwidXVpZCI6IjBmYTQ4NDcwLWY0YzgtMTFlZC04OThiLTMzNTdjOGUzNGJkMyIsImlhdCI6MTY4NDMzNzU2MSwiZXhwIjoxNjg0MzM4NzYxfQ.mH2JBtnF-LCoeagGpMVXs3PzK-MJav-Eb6Lp8dGY0mY |
|
wgltracking.com/ | Name: LOT_DeliveryToken Value: eyJraWQiOiI5MWI5ZGIxZC00YWM3LTRlZGUtYjU1MS03YmNjNWQxODkxOTAiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..KGwYzWIj_fk0PF__.TlPqYLtbOuLdg7B4A4DtEkiL3qnvRsnlrrnTu9FJwNFERrUiA1wg7ZnftO95GJkitTSVOwDNASt40w0n0cAS4QqdGhLpcFwsp-K4pJUaMoiu9fqgLeXq2aJQxssSrKAdiIQTMcka0C9zeFyWtZTXP-NtfGhQB9SKPwTQkMGQVxGAQ0Y3fFpBkDcrRlseomuz6iiQzezlycsi1Avpa2IERHmGcpOx1XcB0lSOCIgjilMs3x6axg_yKMdTBwOL4WpPvqf4aPTiEsfuvR8HY2w9CfQm-Gtt3PFL-PNXUySqCzP7WDPv33ZGDkhgyJhE-2H3tq7imiqEqz4TN-MN_HCdgsoKXch8QPNlsq_IHtiNa9eoZ0yLNIJxl8HHAAamBjGksADBG-5vaUjB1MaWKSA-5yL-0U3F6acLdofIFMnoZhqQM0Tdg2mRGYSXp3RIxwDi07vIf6mF7BMswljuGOenaOky8qZNejJOhiXKmXNxkflsjrOnqJS-xdUbXJIK0i4NIk_LUM75KRJ0KH6E17YDLEqJJjruZEb55WAXjxHaecP10P7MHLfb94-wZvPEUr45NF90P62przMyXbI-9Qum202BrVk9znlMqdAEPoz0yCdvg3hhgvHDRLQQy29zVYsywNoCU80Sl3x4a-dy1tVchOEpV-TUYj-WSCMCeUe06epm6dI-oIs2kV5WuRQQdfyI51TEY7MZSS1SMlRjZcV00EN_QhVQAN-NrHnqspURfY9NB_3VcDu1jRnAGj-leq6x7QSRc_oi5LOmcJNR4kvDDvxWkJPuBRHtEHMBOfGGqV3o4UqtjSFNIGSgBD-XJ_Q.jcSGcRF_GvvGT2MlkZrNsw |
|
wgltracking.com/ | Name: TSe3289311027 Value: 0867512d68ab2000489c83e9ed29ac444efb7e3c338f7bbc0ce9199cd03bba02cc5635e350522fc408a7b8424911300084cab44ebe03855ed5845624553114ad2d3674daa69b4d9079279ed737e2a26867f4a11c6b879f2be29d3ca68e7f44fe |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.wal.co
beacon.walmartlabs.com
i5.walmartimages.com
wgltracking.com
104.106.250.62
151.101.193.74
20.242.10.199
2606:4700:4400::6812:25fa
06718277ef52b0cb816a5d767e4c9742d08da62ba6e498c35d83226d4a573e19
11d1829351eb56e01906a74006b13a1a6caa8cbdb8879e76d10fb4e116781bc2
26160a7ac91afffbbea0e6f3bfc5519359e0ed7164682519d2dd70e269d21805
350cfa2e699ec58d4c77ce8e21feb84591c70bd7794404bc462b6d5ba5cdf680
43fe0205f59729870e682f47b50bc60954f169a293c40ffa0c350f0c32adfddb
4d32f9a77c7d343a489f016b24a860009500750b359d0d9a69f01bde69491237
794c174895cf67055084d4206dbbcab2ca290b13b96922faf2c0e9211b443e38
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
b4eb0eafe74a08bee39fb39e79bd3817dae07798cfa94465e4ec8d1ba8596b96
b8cc583abf31e3b19d31e4b1dcbc17da8f83823d982ffcad69d1bf568339e162
c9868de61ff2bab0b5a3a6d01c4b76f299459f08c6ae2f2c0383b4f9f6bedbf3
d3589041f89f3222acd1850167feb31f1be46af9cd2a7185e83ea344aac03d52
e6508cebce2be2d76a31c956f9a583b3bc25056a6d859409eca8106a86e1a520