viatgesemocions.com Open in urlscan Pro
82.223.109.86 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yz...
Effective URL:
https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yz...
Submission: On August 01 via manual (August 1st 2024, 9:25:24 am UTC) — Scanned from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 82.223.109.86, located in Spain and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is viatgesemocions.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 21st 2023. Valid for: a year.

This is the only time viatgesemocions.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	82.223.109.86 82.223.109.86	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.21.234.231 104.21.234.231	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1408:c40... 2600:1408:c400:385::523	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	139.71.16.29 139.71.16.29	6307 (AMERICAN-...) (AMERICAN-EXPRESS)
3	23.13.151.36 23.13.151.36	16625 (AKAMAI-AS) (AKAMAI-AS)
9	6

1 82.223.109.86 (Spain)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: venus.compsaonline.com

viatgesemocions.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.21.234.231 (None, )

ASN13335 (CLOUDFLARENET, US)

rawcdn.githack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:385::523 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

res.cloudinary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.71.16.29 (United States)

ASN6307 (AMERICAN-EXPRESS, US)
PTR: cdaas2.americanexpress.com

cdaas.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.13.151.36 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-13-151-36.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	aexp-static.com www.aexp-static.com — Cisco Umbrella Rank: 17513	108 KB
2	githack.com rawcdn.githack.com — Cisco Umbrella Rank: 111045	71 KB
1	americanexpress.com cdaas.americanexpress.com — Cisco Umbrella Rank: 49455	11 KB
1	cloudinary.com res.cloudinary.com — Cisco Umbrella Rank: 4280	68 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	27 KB
1	viatgesemocions.com viatgesemocions.com	4 KB
9	6

	Domain	Requested by
3	www.aexp-static.com	rawcdn.githack.com
2	rawcdn.githack.com	viatgesemocions.com
1	cdaas.americanexpress.com	rawcdn.githack.com
1	res.cloudinary.com	viatgesemocions.com
1	cdnjs.cloudflare.com	viatgesemocions.com
1	viatgesemocions.com
9	6

This site contains no links.

Subject Issuer	Validity	Valid
viatgesemocions.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-21` - `2024-08-10`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
githack.com WE1	`2024-06-27` - `2024-09-25`	3 months	crt.sh
*.cloudinary.com Go Daddy Secure Certificate Authority - G2	`2023-12-18` - `2025-01-13`	a year	crt.sh
cdaas.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2023-10-11` - `2024-10-09`	a year	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2024-03-06` - `2025-03-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
Frame ID: 7801179891ACE297F26B14D5C8FDF2A5
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authentiation | 1 - 2

Page URL History Show full URLs

http://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6n... HTTP 307
https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6n... Page URL

Detected technologies

Amex Express Checkout (Payment processors) Expand

Overall confidence: 100%
Detected patterns

aexp-static\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

290 kB
Transfer

809 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo HTTP 307
https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
viatgesemocions.com/welcome/
Redirect Chain

http://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo

11 KB
4 KB

827ms
223ms

Document
text/html

82.223.109.86
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 82.223.109.86 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: venus.compsaonline.com
Software: nginx / PleskLin
Resource Hash: eddd6a0639b294a3038c897ecdc2332fb5034a52b42be86d4ea08af5dc056c08

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Thu, 01 Aug 2024 09:25:18 GMT
etag: W/"6662fcf0-2a15"
last-modified: Fri, 07 Jun 2024 12:28:32 GMT
server: nginx
x-powered-by: PleskLin

Redirect headers

Location: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/ 85 KB
27 KB 161ms
83ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: viatgesemocions.com
URL: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://viatgesemocions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 09:25:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 661104
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27446
last-modified: Tue, 29 Aug 2023 04:36:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64ed75bb-6b36"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0ateSpuOpoW32jv%2FWvERkSS2suaJ59OfhBaAUbb9rcQ4oOnyOOB5Yeod%2FU2sTQx8e4aCnvUK7bl6vnw%2BxlteKeE%2B08czZEnM29jKzYPwgf%2FgUSdjylmUvCSFsHbyghrJ71n1LoM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ac4c7b58b239657-SJC
expires: Tue, 22 Jul 2025 09:25:18 GMT

GET
H3 200 oce-min.css
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/ 285 KB
48 KB 224ms
81ms Stylesheet
text/css 104.21.234.231
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css
Requested by: Host: viatgesemocions.com
URL: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.234.231 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22ac73d718eefac83c6f65ec81fb08c201cda95fa7bb753407059f48df09e147

Request headers

Referer: https://viatgesemocions.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fastly-request-id: a04e34bc16881cd8a532c1530fb20ebe6e83b23f
date: Thu, 01 Aug 2024 09:25:18 GMT
content-encoding: gzip
via: 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62815
x-cache: MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 48677
x-served-by: cache-hel1410022-HEL
server: cloudflare
x-github-request-id: D4D2:355A07:7A67EB:80AD3E:66A0EC9D
x-timer: S1721822365.175661,VS0,VE261
etag: W/"58070408e19e0d997d1cd2ac1dd1e10e18e3f485a00e53d104893719c98df2e0"
source-age: 0
vary: Authorization,Accept-Encoding,Origin
x-githack-cache-status: MISS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kzIui%2B1%2FQYpKm%2BHvQ8N1CjY7EfB%2F3I8Xlro6rNXoNSYlj9nKPuitf9JkeiTw4US%2BtLa%2BjuxA8joHVcO6pgyRYLtOg%2BV0x7dDWn%2FS7wvK1up4CMqnG1z2dfWJuGc5NUpHXBc2RqE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8ac4c7b5eba5aba3-SJC-PIG
x-cache-hits: 0

GET
H3 200 oce-fonts.css
rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/ 207 KB
23 KB 295ms
154ms Stylesheet
text/css 104.21.234.231
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Requested by: Host: viatgesemocions.com
URL: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.234.231 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18f3644f71d444e98a23bcccbd33e41a5dd356642e195559227879f10a182b19

Request headers

Referer: https://viatgesemocions.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fastly-request-id: 3c1e932b6a496401197b3a1829ce7e8cf951c5f3
date: Thu, 01 Aug 2024 09:25:18 GMT
content-encoding: gzip
via: 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 62815
x-cache: MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 22300
x-served-by: cache-hel1410023-HEL
server: cloudflare
x-github-request-id: 81C9:7A6E8:77E950:7E2D6E:66A0EC9D
x-timer: S1721822366.514760,VS0,VE222
etag: W/"c408e28284057fe7f3c7b84b6e9edcbc528d33d19d43196d8f74f1e25da59d31"
source-age: 0
vary: Authorization,Accept-Encoding,Origin
x-githack-cache-status: MISS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H5xkVVH0QTJMGpk8iWzQXaMokflMBPyZY3WY7b8udLo7P1iFZjB0GOwh6rudGiKVEU9Dv0KToYxE3ga7xCRR261nLZjJi0nZrFSij6rNnc2RpuKv%2Bi0MD0eYmuj%2BVxp6MROkan4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000, public, immutable
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8ac4c7b5eba2aba3-SJC-PIG
x-cache-hits: 0

GET
H2 200 oce-font.css
res.cloudinary.com/bwxfzlb9iu0ml9/raw/upload/v1714406473/assets/contents/ 103 KB
68 KB 637ms
143ms Stylesheet
text/css 2600:1408:c400:385::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://res.cloudinary.com/bwxfzlb9iu0ml9/raw/upload/v1714406473/assets/contents/oce-font.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2600:1408:c400:385::523 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

9dd6d1e570bb272ca7ff939832eda05c576213037bd6b845daf5be8f4ee3bbff

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://viatgesemocions.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 09:25:18 GMT
content-encoding: br
strict-transport-security: max-age=604800
last-modified: Mon, 29 Apr 2024 16:03:59 GMT
server: Cloudinary
etag: W/"9a3613abcbf580ee02944d3003da9cf5"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error
cache-control: private, no-transform, immutable, max-age=2592000
server-timing: cld-akam;dur=22;start=2024-08-01T09:25:18.765Z;desc=miss,rtt;dur=117,cloudinary;dur=151;start=2024-07-09T12:25:36.061Z
accept-ranges: bytes
timing-allow-origin: *
content-length: 69526

GET
H/1.1 200
OK amex-desktop-logo.png
cdaas.americanexpress.com/myca/oce/latest/content/images/common/ 11 KB
11 KB 616ms
154ms Image
image/png 139.71.16.29
AMERICAN-EXPRESS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdaas.americanexpress.com/myca/oce/latest/content/images/common/amex-desktop-logo.png
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 139.71.16.29 , United States, ASN6307 (AMERICAN-EXPRESS, US),
Reverse DNS: cdaas2.americanexpress.com
Software: /
Resource Hash: 610166ddd2d965283356d314f592522c1907a5334cec1daa0874fc61639a667c

Request headers

Referer: https://rawcdn.githack.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 01 Aug 2024 09:25:19 GMT
Last-Modified: Mon, 22 Jul 2024 22:49:52 GMT
ETag: "669ee210-2b7e"
Vary: Origin
Content-Type: image/png
Cache-Control: max-age=31536000, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 11134

GET
H2 200 0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
www.aexp-static.com/nav/ngn/fonts/ 37 KB
37 KB 581ms
129ms Font
font/woff 23.13.151.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.151.36 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-151-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://viatgesemocions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 09:25:19 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-943d"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37949
expires: Fri, 27 Nov 2020 03:31:12 GMT

GET
H2 200 3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
www.aexp-static.com/nav/ngn/fonts/ 36 KB
37 KB 730ms
279ms Font
font/woff 23.13.151.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.151.36 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-151-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://viatgesemocions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 09:25:19 GMT
last-modified: Wed, 15 Aug 2018 20:46:09 GMT
etag: "5b749111-9121"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=15552000
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
content-length: 37153
expires: Mon, 25 Jan 2021 11:07:20 GMT

GET
H2 200 dls-icons.woff
www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/ 34 KB
34 KB 832ms
381ms Font
font/woff 23.13.151.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.aexp-static.com/cdaas/one/statics/axp-dls/5.10.1/package/dist/iconfont/dls-icons.woff?v=5.10.1
Requested by: Host: rawcdn.githack.com
URL: https://rawcdn.githack.com/tokenaxp/min/419ad35709f1ea82983b9460c208f1d99fa1f4d5/oce-fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.13.151.36 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-13-151-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08

Request headers

Referer: https://rawcdn.githack.com/
Origin: https://viatgesemocions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 09:25:19 GMT
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "1dc09d84-87c4"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
timing-allow-origin: *
content-length: 34756

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://viatgesemocions.com/welcome/?visitor=172341302059&sid=wh1fxon54twl5ey2y5lu1ej02whx8bj3t8fvzs2e6ntg6y7jnbep8wwy9ja5yzxhd6vhlgrpt4rtqomeooq85tc282n5xza6ztft8zcuj8vrbgv2itt3flj9lnu4tbdpaxdo Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdaas.americanexpress.com
cdnjs.cloudflare.com
rawcdn.githack.com
res.cloudinary.com
viatgesemocions.com
www.aexp-static.com
104.17.24.14
104.21.234.231
139.71.16.29
23.13.151.36
2600:1408:c400:385::523
82.223.109.86
18f3644f71d444e98a23bcccbd33e41a5dd356642e195559227879f10a182b19
22ac73d718eefac83c6f65ec81fb08c201cda95fa7bb753407059f48df09e147
3ab0045c7cec2bd10b33c094d7ff82145efe1e75345bc49166dc5236db831b08
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
610166ddd2d965283356d314f592522c1907a5334cec1daa0874fc61639a667c
9dd6d1e570bb272ca7ff939832eda05c576213037bd6b845daf5be8f4ee3bbff
eddd6a0639b294a3038c897ecdc2332fb5034a52b42be86d4ea08af5dc056c08
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

viatgesemocions.com Open in urlscan Pro 82.223.109.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

17 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

290 kBTransfer

809 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

viatgesemocions.com Open in urlscan Pro
82.223.109.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

290 kB
Transfer

809 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!