urlscan.io logo urlscan.io
SecurityTrails logo

junkremovalstg.wpengine.com Open in urlscan Pro
35.193.194.140  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Effective URL: https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Submission: On August 15 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 5 domains to perform 6 HTTP transactions. The main IP is 35.193.194.140, located in United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is junkremovalstg.wpengine.com.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on August 2nd 2024. Valid for: a year.
This is the only time junkremovalstg.wpengine.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 35.193.194.140 396982 (GOOGLE-CL...)
1 152.199.4.33 15133 (EDGECAST)
1 2a04:4e42:600... 54113 (FASTLY)
6 4
Apex Domain
Subdomains		 Transfer
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
31 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661
35 KB
1 wpengine.com
junkremovalstg.wpengine.com
45 KB
0 clearbit.com Failed
logo.clearbit.com Failed
0 cwbholding.com Failed
mgmnt.scr.cwbholding.com Failed
6 5
Domain Requested by
1 code.jquery.com junkremovalstg.wpengine.com
1 ajax.aspnetcdn.com junkremovalstg.wpengine.com
1 junkremovalstg.wpengine.com
0 logo.clearbit.com Failed
0 mgmnt.scr.cwbholding.com Failed
6 5

This site contains no links.

Subject Issuer Validity Valid
*.wpengine.com
RapidSSL TLS RSA CA G1		 2024-08-02 -
2025-09-02		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2024-06-06 -
2025-06-06		 a year crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Frame ID: 84E2F41FD3C141489CE563701FF61557
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

P****** : Sign In Session

Page URL History Show full URLs

  1. http://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx HTTP 307
    https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

50 %
HTTPS

33 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

111 kB
Transfer

351 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx HTTP 307
    https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request json.html
junkremovalstg.wpengine.com/wp-content/themes/seotheme/
Redirect Chain
  • http://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
  • https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
66 KB
45 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.193.194.140 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
140.194.193.35.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
2fd21bd197392dcba4a04a830e6424ba33275509dbdbcb8a796234a21d8156fc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-type
text/html
date
Thu, 15 Aug 2024 22:58:17 GMT
etag
W/"10842-61e6187bc0d86-gzip"
last-modified
Mon, 29 Jul 2024 11:54:58 GMT
server
nginx
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
MISS
x-cache-group
normal
x-cacheable
SHORT
x-powered-by
WP Engine

Redirect headers

Location
https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Non-Authoritative-Reason
HttpsUpgrades
bootstrap.min.css
ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/ 		152 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/bootstrap.min.css
Requested by
Host: junkremovalstg.wpengine.com
URL: https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.4.33 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (laa/7B9A) /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://junkremovalstg.wpengine.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Thu, 15 Aug 2024 22:58:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
12400859
x-cache
HIT
content-length
35484
x-xss-protection
1; mode=block
last-modified
Mon, 04 Mar 2019 19:22:27 GMT
server
ECAcc (laa/7B9A)
etag
"bd1f889abfd2d41:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
jquery-3.6.4.min.js
code.jquery.com/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.4.min.js
Requested by
Host: junkremovalstg.wpengine.com
URL: https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Request headers

Referer
https://junkremovalstg.wpengine.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Thu, 15 Aug 2024 22:58:18 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
3853995
x-cache
HIT, HIT
content-length
31011
x-served-by
cache-lga21953-LGA, cache-lax-kwhp1940098-LAX
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1723762698.196906,VS0,VE0
etag
W/"28feccc0-15ec3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
156205, 29232
truncated
/ 		555 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93f553f07040ccaa21c9fa7c4ec02e97aff4999acee2bd4bdf9860100a1ea08a

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		15 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aba082654ed9a884ee14954d8a4085aff721d03989fcc16934f4d03cf6a55229

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b4e7ff4c0ce6fdd93c9cb43548a3c90a99a5b096de4892bb9d21462bd48c5e74

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
application/x-javascript
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a6beae164a3397dd506f59af5261bb7662b9344a3225c0f4d7f857f54f4db13

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
screen.php
mgmnt.scr.cwbholding.com/console/shot/ 		0
0
www.p******.n**.mx
logo.clearbit.com/ 		0
0
www.p******.n**.mx
logo.clearbit.com/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mgmnt.scr.cwbholding.com
URL
https://mgmnt.scr.cwbholding.com/console/shot/screen.php?site=p******.n**.mx
Domain
logo.clearbit.com
URL
https://logo.clearbit.com/www.p******.n**.mx
Domain
logo.clearbit.com
URL
https://logo.clearbit.com/www.p******.n**.mx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| tgc string| mtr string| dri

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://junkremovalstg.wpengine.com/wp-content/themes/seotheme/json.html?f******************@p******.n**.mx
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o