chunghwonow.wpengine.com Open in urlscan Pro
34.75.123.186 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.linkedin.com/slink?code=djx479_v???????sdkguisdguisduibvsduibvu5765677657654JHNV%20GGGGG93465896349GFBIU34T
Effective URL:
http://chunghwonow.wpengine.com/elertoa/
Submission: On March 24 via manual (March 24th 2023, 9:03:11 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 34.75.123.186, located in North Charleston, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is chunghwonow.wpengine.com.

This is the only time chunghwonow.wpengine.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chunghwa Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
11	34.75.123.186 34.75.123.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	2

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 34.75.123.186 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.123.75.34.bc.googleusercontent.com

chunghwonow.wpengine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wpengine.com chunghwonow.wpengine.com	96 KB
1	t.co t.co — Cisco Umbrella Rank: 507	630 B
1	linkedin.com 1 redirects www.linkedin.com — Cisco Umbrella Rank: 555	2 KB
12	3

	Domain	Requested by
11	chunghwonow.wpengine.com	t.co chunghwonow.wpengine.com
1	t.co
1	www.linkedin.com	1 redirects
12	3

This site contains links to these domains. Also see Links.

Domain
famous-manx.w5.wpsandbox.pro

Subject Issuer	Validity	Valid
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://chunghwonow.wpengine.com/elertoa/
Frame ID: A52A3C233D12685E4967C6BB30D20D27
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

信用卡付款頁面

Page URL History Show full URLs

https://www.linkedin.com/slink?code=djx479_v???????sdkguisdguisduibvsduibvu5765677657654JHNV%20GGGGG9... HTTP 301
https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz Page URL
http://chunghwonow.wpengine.com/elertoa/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

12
Requests

8 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

96 kB
Transfer

204 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://famous-manx.w5.wpsandbox.pro/A32Q0S/post/internet/Group/e6ff6/SSLAuthUI.html
Title: 背面後三碼檢查碼

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.linkedin.com/slink?code=djx479_v???????sdkguisdguisduibvsduibvu5765677657654JHNV%20GGGGG93465896349GFBIU34T HTTP 301
https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz Page URL
http://chunghwonow.wpengine.com/elertoa/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.linkedin.com/slink?code=djx479_v???????sdkguisdguisduibvsduibvu5765677657654JHNV%20GGGGG93465896349GFBIU34T HTTP 301
https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

7TPUSjEvpb
t.co/
Redirect Chain

https://www.linkedin.com/slink?code=djx479_v???????sdkguisdguisduibvsduibvu5765677657654JHNV%20GGGGG93465896349GFBIU34T
https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz

315 B
630 B

203ms
139ms

Document
text/html

104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 206
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Fri, 24 Mar 2023 21:03:05 GMT
expires: Fri, 24 Mar 2023 21:08:06 GMT
perf: 7626143928
referrer-policy: unsafe-url
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 209e25842b728899e69a575785983ac58ea5b6a04a039cf5a6bfefb22bcface8
x-response-time: 113
x-transaction-id: 2647bcd767fb7e81
x-xss-protection: 0

Redirect headers

cache-control: no-cache, no-store
content-encoding: gzip
content-security-policy: default-src *; connect-src 'self' *.licdn.com *.linkedin.com wss://*.linkedin.com dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.qualtrics.com *.adyen.com *.microsoft.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' *.linkedin.com teams.microsoft.com client.learningapp.microsoft.com
date: Fri, 24 Mar 2023 21:03:05 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz
pragma: no-cache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: sameorigin
x-li-fabric: prod-ltx1
x-li-pop: afd-prod-ltx1-x
x-li-proto: http/2
x-li-uuid: AAX3q7g8Hh2Wj+Jwk2aQeQ==
x-msedge-ref: Ref A: D23ED9CF624646A4B8E217641993F272 Ref B: FRAEDGE1117 Ref C: 2023-03-24T21:03:05Z

GET
H/1.1 200
OK Primary Request / Show response
chunghwonow.wpengine.com/elertoa/ 10 KB
4 KB 224ms
106ms Document
text/html 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://chunghwonow.wpengine.com/elertoa/
Requested by: Host: t.co
URL: https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: 9c21dd14141dfa8490764fb063466a14781b3a8a355cb8c491cf7f6a238bc548

Request headers

Referer: https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=600, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 24 Mar 2023 21:03:06 GMT
ETag: W/"282e-5db2d06b3a100-gzip"
Keep-Alive: timeout=20
Last-Modified: Sun, 27 Mar 2022 06:08:36 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
X-Cache: HIT: 1
X-Cache-Group: normal
X-Cacheable: SHORT
X-Powered-By: WP Engine

GET
H/1.1 200
OK bootstrap.css
chunghwonow.wpengine.com/elertoa/files/ 118 KB
20 KB 111ms
111ms Stylesheet
text/css 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://chunghwonow.wpengine.com/elertoa/files/bootstrap.css
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Content-Encoding: gzip
Last-Modified: Sun, 27 Mar 2022 04:05:50 GMT
Server: nginx
ETag: W/"623fe29e-1d970"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Keep-Alive: timeout=20

GET
H/1.1 200
OK style.css
chunghwonow.wpengine.com/elertoa/files/ 9 KB
3 KB 211ms
107ms Stylesheet
text/css 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://chunghwonow.wpengine.com/elertoa/files/style.css
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: a21e37f28e0471522fcbb0e6860b66a60a582246c4be912dc912b339c35f2ce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Content-Encoding: gzip
Last-Modified: Sun, 27 Mar 2022 04:05:54 GMT
Server: nginx
ETag: W/"623fe2a2-24c4"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Keep-Alive: timeout=20

GET
H/1.1 200
OK CTBC_W.jpg
chunghwonow.wpengine.com/elertoa/files/ 42 KB
43 KB 209ms
105ms Image
image/jpeg 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/CTBC_W.jpg
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 14832827e45f20f385f3584cb5c84441eb00df1be5aeb33882a5b4ab510ae2ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:05:56 GMT
Server: nginx
ETag: "623fe2a4-a972"
Vary: Accept-Encoding
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 43378

GET
H/1.1 200
OK cardtype_ss.png
chunghwonow.wpengine.com/elertoa/files/ 7 KB
8 KB 212ms
105ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/cardtype_ss.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: a5ca115514cbfc52924374b62761d7f0d1f8e510d08b32905f75b66b3a37b1e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:05:58 GMT
Server: nginx
ETag: "623fe2a6-1dbd"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 7613

GET
H/1.1 200
OK card.png
chunghwonow.wpengine.com/elertoa/files/ 399 B
750 B 213ms
106ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/card.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 39459e2db25db3f30b853a7b510629f766994c88eb2af780e77d4ffa71287ee0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:02 GMT
Server: nginx
ETag: "623fe2aa-18f"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 399

GET
H/1.1 200
OK Exclamation.png
chunghwonow.wpengine.com/elertoa/files/ 481 B
832 B 213ms
107ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/Exclamation.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: f35b4d8168065dde839d4ebb2bb3747b2734acdf3c85e0c28a163daa97c76d39

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:04 GMT
Server: nginx
ETag: "623fe2ac-1e1"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 481

GET
H/1.1 200
OK 3D_VISA.png
chunghwonow.wpengine.com/elertoa/files/ 4 KB
4 KB 106ms
106ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/3D_VISA.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1818f0c2ef6a363e915bd4c6c2c2cbeef0fcf60ff2da3e79cfe0d1c3bc9ff86b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:08 GMT
Server: nginx
ETag: "623fe2b0-1005"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 4101

GET
H/1.1 200
OK 3D_MASTER.png
chunghwonow.wpengine.com/elertoa/files/ 3 KB
3 KB 105ms
105ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/3D_MASTER.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 203dffbf9fb647ad3576ebc57c4005c1a0cb07cc740a911585b6ba70c8d20892

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:12 GMT
Server: nginx
ETag: "623fe2b4-c1a"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 3098

GET
H/1.1 200
OK 3D_JCB.png
chunghwonow.wpengine.com/elertoa/files/ 3 KB
3 KB 107ms
105ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/3D_JCB.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: eacf2b196015c40a02cf7849c614daaca5205159d7ac234ad90ea47fbb714041

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:22 GMT
Server: nginx
ETag: "623fe2be-be2"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 3042

GET
H/1.1 200
OK twca_ssl.png
chunghwonow.wpengine.com/elertoa/files/ 6 KB
6 KB 107ms
106ms Image
image/png 34.75.123.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://chunghwonow.wpengine.com/elertoa/files/twca_ssl.png
Requested by: Host: chunghwonow.wpengine.com
URL: http://chunghwonow.wpengine.com/elertoa/
Protocol: HTTP/1.1
Server: 34.75.123.186 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.123.75.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4a1d51361e6bfabde052f3b64166d7ab532241e0c634162ccd6220c76759642a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://chunghwonow.wpengine.com/elertoa/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Fri, 24 Mar 2023 21:03:06 GMT
Last-Modified: Sun, 27 Mar 2022 04:06:24 GMT
Server: nginx
ETag: "623fe2c0-173d"
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=20
Content-Length: 5949

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chunghwa Post (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-20 19:20:27	Name: bcookie Value: "v=2&da60facd-2133-4b5d-8a92-42cbccabae27"
.www.linkedin.com/	1970-01-20 19:20:27	Name: bscookie Value: "v=1&20230324210305419e21c6-8650-488d-8c94-3d42f1f1d742AQED1acVAws99QfOHee6xvXgqpkVYU5S"
.linkedin.com/	1970-01-20 14:54:03	Name: li_gc Value: MTswOzE2Nzk2OTE3ODU7MjswMjFRJArex5Z6PaNUFlp3Ugf2kBgu25h9RigHNORXfuGs5A==
.linkedin.com/	1970-01-20 10:36:18	Name: lidc Value: "b=TGST02:s=T:r=T:a=T:p=T:g=2983:u=1:x=1:i=1679691785:t=1679778185:v=2:sig=AQFpSMjhdAHMlan_dahn9DJEkpOsTrXg"
.t.co/	1970-01-20 20:05:06	Name: muc Value: 7cb6d3b2-4542-48a8-a093-862107fa2d79

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://t.co/7TPUSjEvpb???????hroiudzlonsdaznidadnaz Message: Unrecognized Content-Security-Policy directive 'referrer'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chunghwonow.wpengine.com
t.co
www.linkedin.com
104.244.42.133
2620:1ec:21::14
34.75.123.186
14832827e45f20f385f3584cb5c84441eb00df1be5aeb33882a5b4ab510ae2ed
1818f0c2ef6a363e915bd4c6c2c2cbeef0fcf60ff2da3e79cfe0d1c3bc9ff86b
203dffbf9fb647ad3576ebc57c4005c1a0cb07cc740a911585b6ba70c8d20892
39459e2db25db3f30b853a7b510629f766994c88eb2af780e77d4ffa71287ee0
4a1d51361e6bfabde052f3b64166d7ab532241e0c634162ccd6220c76759642a
9c21dd14141dfa8490764fb063466a14781b3a8a355cb8c491cf7f6a238bc548
a21e37f28e0471522fcbb0e6860b66a60a582246c4be912dc912b339c35f2ce0
a5ca115514cbfc52924374b62761d7f0d1f8e510d08b32905f75b66b3a37b1e1
eacf2b196015c40a02cf7849c614daaca5205159d7ac234ad90ea47fbb714041
f35b4d8168065dde839d4ebb2bb3747b2734acdf3c85e0c28a163daa97c76d39
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

chunghwonow.wpengine.com Open in urlscan Pro 34.75.123.186 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

8 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

96 kBTransfer

204 kBSize

5 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

5 Cookies

1 Console Messages

Security Headers

Indicators

chunghwonow.wpengine.com Open in urlscan Pro
34.75.123.186 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

96 kB
Transfer

204 kB
Size

5
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!