fash.com.sa Open in urlscan Pro
212.76.85.19 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/AoxPSkHAS8
Effective URL:
https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Submission: On August 20 via api (August 20th 2024, 5:17:17 pm UTC) — Scanned from GB

Summary HTTP 9 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 9 HTTP transactions. The main IP is 212.76.85.19, located in Yanbu, Saudi Arabia and belongs to SAHARANET-AS Sahara Net Main NOC AS, SA. The main domain is fash.com.sa.
TLS certificate: Issued by R11 on July 20th 2024. Valid for: 3 months.

This is the only time fash.com.sa was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Intuit (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	93.184.221.165 93.184.221.165	15133 (EDGECAST) (EDGECAST)
2	77.92.134.43 77.92.134.43	42910 (PREMIERDC...) (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH)
1	212.76.85.19 212.76.85.19	41176 (SAHARANET...) (SAHARANET-AS Sahara Net Main NOC AS)
4	34.75.151.117 34.75.151.117	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9	5

1 93.184.221.165 (London, United Kingdom)

ASN15133 (EDGECAST, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 77.92.134.43 (Turkey)

ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR)
PTR: posta2.hangiacente.com

metintan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.76.85.19 (Yanbu, Saudi Arabia)

ASN41176 (SAHARANET-AS Sahara Net Main NOC AS, SA)
PTR: sw6.saharanet.com

fash.com.sa	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.75.151.117 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 117.151.75.34.bc.googleusercontent.com

1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	replit.dev 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	2 MB
2	metintan.com metintan.com	2 KB
1	fash.com.sa fash.com.sa	532 KB
1	t.co t.co — Cisco Umbrella Rank: 979	561 B
0	swedbank.lt Failed www.swedbank.lt Failed
9	5

	Domain	Requested by
4	1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev	fash.com.sa
2	metintan.com	t.co
1	fash.com.sa
1	t.co
0	www.swedbank.lt Failed
9	5

This site contains links to these domains. Also see Links.

Domain
quickbooks.intuit.com
mailchimp.com
turbotax.intuit.com
accounts-help.intuit.com
glam.app.intuit.com
www.intuit.com
www.google.com
security.intuit.com
help.quickbooks.intuit.com
accounts.intuit.com

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-08` - `2025-05-07`	a year	crt.sh
metintan.com R11	`2024-07-26` - `2024-10-24`	3 months	crt.sh
fash.com.sa R11	`2024-07-20` - `2024-10-18`	3 months	crt.sh
*.worf.replit.dev R10	`2024-07-26` - `2024-10-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Frame ID: 57C3A008C01F642468DD5EECAD6AD48D
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QuickBooks Online Login: Sign in to Access Your QuickBooks Account

Page URL History Show full URLs

https://t.co/AoxPSkHAS8 Page URL
https://metintan.com/teklifform/red/wx.htm Page URL
https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

2900 kB
Transfer

2942 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://quickbooks.intuit.com/

Search URL Search Domain Scan URL

URL: https://mailchimp.com/

Search URL Search Domain Scan URL

URL: https://turbotax.intuit.com/

Search URL Search Domain Scan URL

URL: https://accounts-help.intuit.com/app/intuit/1995107
Title: Intuit Account

Search URL Search Domain Scan URL

URL: https://glam.app.intuit.com/app/guesttos?glocale=en_us
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.intuit.com/privacy/statement/
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/policies/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/policies/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.intuit.com/legal/
Title: Legal

Search URL Search Domain Scan URL

URL: https://security.intuit.com/
Title: Security

Search URL Search Domain Scan URL

URL: https://help.quickbooks.intuit.com/en_US/contact?pageContext=login
Title: Support

Search URL Search Domain Scan URL

URL: https://accounts.intuit.com/terms-of-service
Title: Software License Agreement

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/AoxPSkHAS8 Page URL
https://metintan.com/teklifform/red/wx.htm Page URL
https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/init.php HTTP 0
https://www.swedbank.lt/private

9 HTTP transactions
17 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 AoxPSkHAS8 Show response
t.co/ 283 B
561 B 252ms
151ms Document
text/html 93.184.221.165
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/AoxPSkHAS8

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_f /

Resource Hash

7739cb9f864ef8454a2ced7c8d654b0f58dec4931beebadf7f7b437f9cfecf90

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 190
content-type: text/html; charset=utf-8
date: Tue, 20 Aug 2024 17:17:09 GMT
expires: Tue, 20 Aug 2024 17:22:09 GMT
perf: 7402827104
server: tsa_f
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: a061d386e772ba993992d691b7e93a29f766ebb6d53657cff5927f41dbe56b27
x-response-time: 118
x-transaction-id: a3542bb3847da9e2
x-xss-protection: 0

GET
H2 200 wx.htm Show response
metintan.com/teklifform/red/ 108 B
300 B 373ms
154ms Document
text/html 77.92.134.43
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://metintan.com/teklifform/red/wx.htm
Requested by: Host: t.co
URL: https://t.co/AoxPSkHAS8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 77.92.134.43 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: posta2.hangiacente.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5dd7c2e06cbf610cf10ef5b6db14236d6c51b62586c5a354c2516835e7e80483

Request headers

Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 112
content-type: text/html
date: Tue, 20 Aug 2024 17:17:09 GMT
etag: "0918861ff3da1:0"
last-modified: Tue, 20 Aug 2024 16:35:54 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H2 200 Primary Request index.html Show response
fash.com.sa/wp-includes/cgi-/qbo.intuit.com/ 531 KB
532 KB 793ms
150ms Document
text/html 212.76.85.19
SAHARANET-AS Saha...

General

Check archive.org

Show headers Download Go to

Full URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 212.76.85.19 Yanbu, Saudi Arabia, ASN41176 (SAHARANET-AS Sahara Net Main NOC AS, SA),
Reverse DNS: sw6.saharanet.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2d6ee1def5db7bf17722e03e97491e57d68801bc15371ec4168ef57865d37a26

Request headers

Referer: https://metintan.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 543797
content-type: text/html
date: Tue, 20 Aug 2024 17:17:27 GMT
etag: "627863921ef3da1:0"
last-modified: Tue, 20 Aug 2024 16:32:39 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H2 404 favicon.ico
metintan.com/ 1 KB
1 KB 78ms
77ms Other
text/html 77.92.134.43
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://metintan.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 77.92.134.43 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: posta2.hangiacente.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://metintan.com/teklifform/red/wx.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Tue, 20 Aug 2024 17:17:09 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 1245
content-type: text/html

GET
DATA 200
OK truncated
/ 527 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2914873b554e478c32de29a12419313e80b29095402bf03a0193af382e1542e

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82ca8cd60e5ecda336a08c16ac17d81962736bb628814f35c10cb8c15aaab448

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a425f6304622d3a56fa1a47c518f9c421e4b6ca071acb6e4c26cd48a9b4f9d72

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 390 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e0407667016e9ef2ce75f20e0fdca6a4896f8b3dadb04bf0e4439c1a75de98d

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d3bd22b6db2516bc94148940e76db7ffe7a6cf3c4f3da9fe6526e72a38c36d26

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d1e4205c798359f751354ef999d11fda4113e4a8d1f8180c8e399f38387b7348

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 044541c8fb1fa2e3cff245f4c2ea764cd3afc339753914d4ea358b4db29e4efc

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 33 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ffa0a23d6d5606bdc5a8f99ebb867c2e3c2f58c3d7db895c6c92f145353dfd7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 882 KB
883 KB 541ms
178ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style2.css
Requested by: Host: fash.com.sa
URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: b116d95914c7935b7a4dfbdff2ed9068518250229ab8413f381a37edf2e95706

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 20 Aug 2024 17:17:11 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 99 KB
99 KB 493ms
128ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style3.css
Requested by: Host: fash.com.sa
URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: c4e5897973c043950a1c4638faf22ce4e0ba877df4047996bdd92a6f2024c20b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 20 Aug 2024 17:17:11 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 540 KB
541 KB 489ms
129ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style1.css
Requested by: Host: fash.com.sa
URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: 78a3ddbbbb78d5880d6df5cf9c19939d398187e62850d5ba174701dbcb5ab20f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 20 Aug 2024 17:17:11 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET
H/1.1 200
OK serveCSS.php Show response
1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/ 677 KB
678 KB 488ms
128ms Fetch
text/css 34.75.151.117
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/styles/serveCSS.php?file=style4.css
Requested by: Host: fash.com.sa
URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.75.151.117 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 117.151.75.34.bc.googleusercontent.com
Software: / PHP/8.2.0RC7
Resource Hash: 893b42db1bf7cf90bf8c6b4a073d2b8cb4981c067a0ef72512b1e43b5cc5062b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Tue, 20 Aug 2024 17:17:11 GMT
Host: 1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
X-Powered-By: PHP/8.2.0RC7
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Replit-Cluster: worf
Access-Control-Allow-Headers: Content-Type
X-Robots-Tag: none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex, none, noindex, noarchive, nofollow, nositelinkssearchbox, noimageindex

GET

private
www.swedbank.lt/
Redirect Chain

https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev/init.php
https://www.swedbank.lt/private

0
0

GET
DATA 200
OK truncated
/ 475 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e7f8cdeb6987f67c9c1d77af30a70856813c61b4e9b3043f0e57b5b9325d7a39

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a496f0a5fc51aac0cac43be7e4c6a81425194480f138a7a97e895071fd628260

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b406c35a6d317b896aef159ce69f94480e3e690a9e5f2bfab4fb8311b767a9b0

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 33 KB
33 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 677ad6e2848e0b6b1d7117e1d85577e77435749cfa5b3ed42d43694642bebf61

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 32 KB
32 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b59034d520321abc96ed69ffbe45f00feade7c66ac3bcf99e3ba51059f2a2a2

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d565ece548de79abdcab7ec7b6f87742353ab6f26debdbb8567d8461b32d338e

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8278b56794c389919d388951c5fa4dc07a388e16eb7055d675b0b916acc70e5

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f76664b1313cdfbbf1aeddd340deb2f070ff993bda8bba26395da7a8af6af6fd

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 710783f40197bb2d32cc23b00e16c2dfcbc66afc603e3acfcd84b4406b85d418

Request headers

Referer
Origin: https://fash.com.sa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: font/woff2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.swedbank.lt
URL: https://www.swedbank.lt/private

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Intuit (Financial)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.t.co/	1970-01-21 08:26:28	Name: muc Value: 1004cce5-f319-4953-bf6e-95a18d3b2cb8

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://metintan.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	warning	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: [DOM] Found 7 elements with non-unique id #idsTab-EMAIL_USER_ID: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o
recommendation	warning	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: [DOM] Found 8 elements with non-unique id #iux-identifier-first-international-email-user-id-input: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o %o
recommendation	verbose	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
security	error	URL: https://fash.com.sa/wp-includes/cgi-/qbo.intuit.com/index.html Message: Refused to connect to 'https://www.swedbank.lt/private' because it violates the following Content Security Policy directive: "connect-src 'self' data: https://1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1465ab03-9658-4034-8033-9432a0e7e953-00-1mvd01immaa1y.worf.replit.dev
fash.com.sa
metintan.com
t.co
www.swedbank.lt
www.swedbank.lt
212.76.85.19
34.75.151.117
77.92.134.43
93.184.221.165
044541c8fb1fa2e3cff245f4c2ea764cd3afc339753914d4ea358b4db29e4efc
2d6ee1def5db7bf17722e03e97491e57d68801bc15371ec4168ef57865d37a26
5dd7c2e06cbf610cf10ef5b6db14236d6c51b62586c5a354c2516835e7e80483
677ad6e2848e0b6b1d7117e1d85577e77435749cfa5b3ed42d43694642bebf61
6b59034d520321abc96ed69ffbe45f00feade7c66ac3bcf99e3ba51059f2a2a2
710783f40197bb2d32cc23b00e16c2dfcbc66afc603e3acfcd84b4406b85d418
7739cb9f864ef8454a2ced7c8d654b0f58dec4931beebadf7f7b437f9cfecf90
78a3ddbbbb78d5880d6df5cf9c19939d398187e62850d5ba174701dbcb5ab20f
82ca8cd60e5ecda336a08c16ac17d81962736bb628814f35c10cb8c15aaab448
893b42db1bf7cf90bf8c6b4a073d2b8cb4981c067a0ef72512b1e43b5cc5062b
9e0407667016e9ef2ce75f20e0fdca6a4896f8b3dadb04bf0e4439c1a75de98d
9ffa0a23d6d5606bdc5a8f99ebb867c2e3c2f58c3d7db895c6c92f145353dfd7
a425f6304622d3a56fa1a47c518f9c421e4b6ca071acb6e4c26cd48a9b4f9d72
a496f0a5fc51aac0cac43be7e4c6a81425194480f138a7a97e895071fd628260
b116d95914c7935b7a4dfbdff2ed9068518250229ab8413f381a37edf2e95706
b406c35a6d317b896aef159ce69f94480e3e690a9e5f2bfab4fb8311b767a9b0
c4e5897973c043950a1c4638faf22ce4e0ba877df4047996bdd92a6f2024c20b
c8278b56794c389919d388951c5fa4dc07a388e16eb7055d675b0b916acc70e5
d1e4205c798359f751354ef999d11fda4113e4a8d1f8180c8e399f38387b7348
d2914873b554e478c32de29a12419313e80b29095402bf03a0193af382e1542e
d3bd22b6db2516bc94148940e76db7ffe7a6cf3c4f3da9fe6526e72a38c36d26
d565ece548de79abdcab7ec7b6f87742353ab6f26debdbb8567d8461b32d338e
e7f8cdeb6987f67c9c1d77af30a70856813c61b4e9b3043f0e57b5b9325d7a39
f76664b1313cdfbbf1aeddd340deb2f070ff993bda8bba26395da7a8af6af6fd

fash.com.sa Open in urlscan Pro 212.76.85.19 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

4 Countries

2900 kBTransfer

2942 kBSize

1 Cookies

12 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 17 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

7 Console Messages

fash.com.sa Open in urlscan Pro
212.76.85.19 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

2900 kB
Transfer

2942 kB
Size

1
Cookies

9 HTTP transactions
17 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!