healthyfoodeats.com Open in urlscan Pro
2a06:2ec0:1::149  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request personal.html Show response healthyfoodeats.com/wp-admin/F/FirstCitizens/	6 KB 2 KB	55ms 28ms	Document text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash 153b57214f33651b6d723dea55858b487dc4f38b104555cbec5b17aeef42fb3e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers accept-ranges bytes connection Upgrade content-encoding gzip content-length 1845 content-type text/html date Sat, 10 Jun 2023 07:14:43 GMT etag "1713-5f3b8ca3bc500-gzip" last-modified Thu, 02 Feb 2023 14:57:56 GMT server Apache/2 upgrade h2,h2c vary Accept-Encoding,User-Agent
GET H/1.1	200 OK	app.css healthyfoodeats.com/wp-admin/F/FirstCitizens/css/	94 KB 18 KB	31ms 31ms	Stylesheet text/css	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/app.css Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash 722e0f8219375018d795921485032e970952ab5ab3c5d534b024e1693d7f982f Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip last-modified Thu, 02 Feb 2023 14:53:48 GMT server Apache/2 etag "178e4-5f3b8bb739700-gzip" vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/css connection Upgrade accept-ranges bytes content-length 17825
GET H/1.1	200 OK	highcontrast-23d6f5c394031f2b7a197598ef562da5.css healthyfoodeats.com/wp-admin/F/FirstCitizens/css/	969 KB 122 KB	102ms 76ms	Stylesheet text/css	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash 5fe9be1ee622cde0915ad2e0fd99a1aec935c971201dcbe8ddc63427fc8d103e Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip last-modified Mon, 23 May 2022 12:00:44 GMT server Apache/2 etag "f22ff-5dfac96fbb300-gzip" vary Accept-Encoding,User-Agent transfer-encoding chunked upgrade h2,h2c content-type text/css connection Upgrade accept-ranges bytes
GET H/1.1	200 OK	theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css healthyfoodeats.com/wp-admin/F/FirstCitizens/css/	934 KB 122 KB	74ms 47ms	Stylesheet text/css	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash 44b62296dd491bc6b05441bd4dfc79d12d979d033f5103a176c223c6e87b6823 Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip last-modified Thu, 02 Feb 2023 14:53:36 GMT server Apache/2 etag "e99a2-5f3b8babc7c00-gzip" vary Accept-Encoding,User-Agent transfer-encoding chunked upgrade h2,h2c content-type text/css connection Upgrade accept-ranges bytes
GET H/1.1	200 OK	tecton-590048df214033d1c1591d552a32c9af.css healthyfoodeats.com/wp-admin/F/FirstCitizens/css/	8 KB 2 KB	68ms 42ms	Stylesheet text/css	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/tecton-590048df214033d1c1591d552a32c9af.css Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash fbb5d60b0e8fbf3ce2eeb2479ad9ef6744585303f9ee0bf27c62b35a0a2dc30a Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip last-modified Thu, 02 Feb 2023 14:53:42 GMT server Apache/2 etag "1f56-5f3b8bb180980-gzip" vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/css connection Upgrade accept-ranges bytes content-length 1669
GET H/1.1	200 OK	mask.js Show response healthyfoodeats.com/wp-admin/F/FirstCitizens/js/	146 KB 31 KB	62ms 36ms	Script application/javascript	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/js/mask.js Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / Resource Hash 3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237 Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip last-modified Wed, 02 Mar 2022 22:50:54 GMT server Apache/2 etag "24645-5d9441d2c4f80-gzip" vary Accept-Encoding,User-Agent upgrade h2,h2c content-type application/javascript connection Upgrade accept-ranges bytes content-length 31263
GET H/1.1	500 Internal Server Error	desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg healthyfoodeats.com/wp-admin/F/FirstCitizens/img/	3 KB 3 KB	85ms 85ms	Image text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Show image Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / PHP/8.0.27 Resource Hash b16c98f0f434bd92d799e7cb7157553f6d8815d7c06fcfe2567b7540d895de05 Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/personal.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip server Apache/2 x-powered-by PHP/8.0.27 vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 connection Upgrade content-length 1103 expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	logo_large-5741abb9675d37b6178ac83becc79b17.png cdn1.onlineaccess1.com/cdn/depot/3397/1069/d156970adc960ccc43e0f0d4d553bb92/assets/images/logos/	7 KB 7 KB	646ms 588ms	Image image/png	192.0.54.4 Q2HOLDINGS
General Check archive.org Show headers Download Go to Show image Full URL https://cdn1.onlineaccess1.com/cdn/depot/3397/1069/d156970adc960ccc43e0f0d4d553bb92/assets/images/logos/logo_large-5741abb9675d37b6178ac83becc79b17.png Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/theme-q2-c78f9a6334979dc02a4414cf3a8779e5.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US), Reverse DNS Software cloudflare / Resource Hash 3133f88ff2d288957e9708cab68a2dd2f25f46177603d9accb70b22bc7601888 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language nl-NL,nl;q=0.9 Referer http://healthyfoodeats.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:44 GMT content-encoding gzip cf-cache-status HIT last-modified Fri, 24 Mar 2023 16:13:06 GMT server cloudflare strict-transport-security max-age=15552000; includeSubDomains; preload etag W/"641dcc12-1a27" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control max-age=315360000 timing-allow-origin * access-control-allow-headers * cf-ray 7d4fd1aea8391e79-AMS expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	500 Internal Server Error	OpenSans-Regular.woff healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/	0 0	90ms 90ms	Font text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Regular.woff Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / PHP/8.0.27 Resource Hash Request headers Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Origin http://healthyfoodeats.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip server Apache/2 x-powered-by PHP/8.0.27 vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 connection Upgrade content-length 1103 expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	500 Internal Server Error	OpenSans-Semibold.woff healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/	0 0	91ms 91ms	Font text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Semibold.woff Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / PHP/8.0.27 Resource Hash Request headers Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Origin http://healthyfoodeats.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip server Apache/2 x-powered-by PHP/8.0.27 vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 connection Upgrade content-length 1103 expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	500 Internal Server Error	OpenSans-Regular.ttf healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/	0 0	84ms 84ms	Font text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Regular.ttf Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / PHP/8.0.27 Resource Hash Request headers Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Origin http://healthyfoodeats.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip server Apache/2 x-powered-by PHP/8.0.27 vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 connection Upgrade content-length 1103 expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	500 Internal Server Error	OpenSans-Semibold.ttf healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/	0 0	75ms 75ms	Font text/html	2a06:2ec0:1::149 AS-ZXCS
General Check archive.org Show headers Download Go to Full URL http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Semibold.ttf Requested by Host: healthyfoodeats.com URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Protocol HTTP/1.1 Server 2a06:2ec0:1::149 , Netherlands, ASN206281 (AS-ZXCS, NL), Reverse DNS Software Apache/2 / PHP/8.0.27 Resource Hash Request headers Referer http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/highcontrast-23d6f5c394031f2b7a197598ef562da5.css Origin http://healthyfoodeats.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Sat, 10 Jun 2023 07:14:43 GMT content-encoding gzip server Apache/2 x-powered-by PHP/8.0.27 vary Accept-Encoding,User-Agent upgrade h2,h2c content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 connection Upgrade content-length 1103 expires Wed, 11 Jan 1984 05:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: First Citizens Bank (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| IMask object| element object| maskOptions object| mask

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cdn1.onlineaccess1.com/	1970-01-20 12:26:50	Name: __cflb Value: 02DiuDJZwTATiSnybBeVDKjTCUZYfphxGm3EambRBpHnQ
			.onlineaccess1.com/	1969-12-31 23:59:59	Name: __cfruid Value: e7b7ca94a282de316db681197088d766389c7b59-1686381284

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/img/desktop-background-31261c4b72eb487c279e9a1b57d9f095.jpg Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Regular.woff Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Semibold.woff Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Semibold.ttf Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)
network	error	URL: http://healthyfoodeats.com/wp-admin/F/FirstCitizens/css/fonts/OpenSans/OpenSans-Regular.ttf Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn1.onlineaccess1.com
healthyfoodeats.com
192.0.54.4
2a06:2ec0:1::149
153b57214f33651b6d723dea55858b487dc4f38b104555cbec5b17aeef42fb3e
3133f88ff2d288957e9708cab68a2dd2f25f46177603d9accb70b22bc7601888
3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237
44b62296dd491bc6b05441bd4dfc79d12d979d033f5103a176c223c6e87b6823
5fe9be1ee622cde0915ad2e0fd99a1aec935c971201dcbe8ddc63427fc8d103e
722e0f8219375018d795921485032e970952ab5ab3c5d534b024e1693d7f982f
b16c98f0f434bd92d799e7cb7157553f6d8815d7c06fcfe2567b7540d895de05
fbb5d60b0e8fbf3ce2eeb2479ad9ef6744585303f9ee0bf27c62b35a0a2dc30a