tosetofftrips.com Open in urlscan Pro
119.18.54.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://tosetofftrips.com/apps/secure/indexs.php
Submission: On August 14 via manual (August 14th 2021, 3:52:47 am UTC) from IN

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 119.18.54.35, located in India and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is tosetofftrips.com.
TLS certificate: Issued by R3 on June 19th 2021. Valid for: 3 months.

This is the only time tosetofftrips.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	119.18.54.35 119.18.54.35	394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	3

8 119.18.54.35 (India)

ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)

tosetofftrips.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	tosetofftrips.com tosetofftrips.com	117 KB
2	cloudflare.com cdnjs.cloudflare.com	69 KB
10	2

	Domain	Requested by
8	tosetofftrips.com	tosetofftrips.com
2	cdnjs.cloudflare.com	tosetofftrips.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
tosetofftrips.com R3	`2021-06-19` - `2021-09-17`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://tosetofftrips.com/apps/secure/indexs.php
Frame ID: 067EBAC0A504DFDBC49E16A68F0FF4CD
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

202 kB
Transfer

549 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request indexs.php Show response
tosetofftrips.com/apps/secure/ 9 KB
3 KB 3234ms
2716ms Document
text/html 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: af32dd61a7a818af56fba7005751bf84c5137b7f952ae9bba83b566374ed33ff

Request headers

:method: GET
:authority: tosetofftrips.com
:scheme: https
:path: /apps/secure/indexs.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:18 GMT
server: nginx/1.19.10
content-type: text/html; charset=UTF-8
content-length: 3367
vary: Accept-Encoding
content-encoding: gzip
x-server-cache: false

GET
H2 200 style.css
tosetofftrips.com/apps/secure/css/ 4 KB
1 KB 1559ms
1558ms Stylesheet
text/css 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/css/style.css
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 86faeab09e16d426a818bb33e89eb231d3c005905ecfa88e11365e50768e3b1c

Request headers

:path: /apps/secure/css/style.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:20 GMT
content-encoding: gzip
last-modified: Mon, 28 Oct 2019 17:43:22 GMT
server: nginx/1.19.10
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1143

GET
H2 404 jquery.mobile.css
tosetofftrips.com/css/ 0
0 6486ms
6486ms Stylesheet
text/html 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/css/jquery.mobile.css?v=19.12.00
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

:path: /css/jquery.mobile.css?v=19.12.00
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 14 Aug 2021 03:52:25 GMT
content-encoding: gzip
server: nginx/1.19.10
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
set-cookie: PHPSESSID=a371c15d64d4cad67a02a484dcbbe4e2; path=/
link: <https://tosetofftrips.com/wp-json/>; rel="https://api.w.org/"
content-length: 16966
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 desktop-tablet.combined.css
tosetofftrips.com/apps/secure/css/ 192 KB
65 KB 2561ms
2561ms Stylesheet
text/css 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/css/desktop-tablet.combined.css
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 1f3fd405c64b807d88a6f32a0b972c38e9ca66f3380ca051d7c8038c5b96b880

Request headers

:path: /apps/secure/css/desktop-tablet.combined.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:21 GMT
content-encoding: gzip
last-modified: Mon, 28 Oct 2019 17:43:22 GMT
server: nginx/1.19.10
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 archer.css
tosetofftrips.com/apps/secure/css/ 21 KB
16 KB 2412ms
2412ms Stylesheet
text/css 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/css/archer.css
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: addf96fe07895d750d00834b2cf4e66bd6cfb25364a40bde81c8464e00698947

Request headers

:path: /apps/secure/css/archer.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:21 GMT
content-encoding: gzip
last-modified: Mon, 28 Oct 2019 17:43:22 GMT
server: nginx/1.19.10
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 masthead-img-logo.svg
tosetofftrips.com/apps/secure/images/ 6 KB
6 KB 2562ms
2562ms Image
image/svg+xml 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tosetofftrips.com/apps/secure/images/masthead-img-logo.svg
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 5f7d5fb148b72d2c8c3a459d94eb65d1c927da54c1ecb43f9bddfe6449730cfe

Request headers

:path: /apps/secure/images/masthead-img-logo.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:21 GMT
content-length: 5740
last-modified: Wed, 27 Nov 2019 20:59:36 GMT
server: nginx/1.19.10
accept-ranges: bytes
x-server-cache: false
content-type: image/svg+xml

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ 256 KB
64 KB 24ms
12ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/jquery.js

Requested by

Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://tosetofftrips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 646846
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 64839
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-40023"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xf2lZFutOdJAdTM%2FW7MRccajXUc%2FkP8QG%2FID%2B7jn%2F2clvL0ECATOHE7ro1n3cEEhH1CgCV8fOwk2ClLWhiWezl5rjQiTH8X3Ed%2FFYXlj231fdzSra1ctyuKAp5MKP9Qfp4z%2FvgknYQ%2FAKVdBf%2FkOaShz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 67e73ace0fb04e1f-FRA
expires: Thu, 04 Aug 2022 03:52:18 GMT

GET
H2 200 jquery.mask.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 20 KB
5 KB 24ms
11ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js

Requested by

Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://tosetofftrips.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 623132
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4517
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-4e98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OqFLMeu5vMHq%2FLjBtXZDnJKF6iSTrtjI%2BI%2BV49XGyGgyOZxZMLfaUwFJc3xYFVCnfL1Hg13aKHR95FrcZ76dSH6wkFALh3bhsVNMMX6g7h8SeImf7hrAXh4GyRkhRsJ93788U4SUwK4rSuWR5b7NhHs3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 67e73ace0fb24e1f-FRA
expires: Thu, 04 Aug 2022 03:52:18 GMT

GET
DATA 200
OK truncated
/ 428 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03de4b9cf46dd5570223a4f4b3f57a02b609fc53430d95c2f265e8b6368713a3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 404 myriad.woff2
tosetofftrips.com/apps/secure/javascript/ 0
0 3070ms
3070ms Font
text/html 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/javascript/myriad.woff2
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash

Request headers

sec-fetch-mode: cors
origin: https://tosetofftrips.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: PHPSESSID=a371c15d64d4cad67a02a484dcbbe4e2
:path: /apps/secure/javascript/myriad.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://tosetofftrips.com
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 14 Aug 2021 03:52:28 GMT
content-encoding: gzip
server: nginx/1.19.10
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://tosetofftrips.com/wp-json/>; rel="https://api.w.org/"
content-length: 16966
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
DATA 200
OK truncated
/ 16 KB
16 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e96b46a59ee68d66d600ccd8ce06ac4144a225e5125a8ad23ddaf024e09d71eb

Request headers

Origin: https://tosetofftrips.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff

GET
H2 200 awe.woff
tosetofftrips.com/apps/secure/javascript/ 25 KB
25 KB 2604ms
2604ms Font
font/woff 119.18.54.35
PUBLIC-DOMAIN-REG...

General

Check archive.org

Show headers Download Go to

Full URL: https://tosetofftrips.com/apps/secure/javascript/awe.woff
Requested by: Host: tosetofftrips.com
URL: https://tosetofftrips.com/apps/secure/indexs.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 119.18.54.35 , India, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
Software: nginx/1.19.10 /
Resource Hash: 8bb7974183ff975132235b0da28f9eb00d607ce863ed24ae71219ec96a38b5ef

Request headers

sec-fetch-mode: cors
origin: https://tosetofftrips.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: PHPSESSID=a371c15d64d4cad67a02a484dcbbe4e2
:path: /apps/secure/javascript/awe.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: tosetofftrips.com
referer: https://tosetofftrips.com/apps/secure/indexs.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://tosetofftrips.com
Referer: https://tosetofftrips.com/apps/secure/indexs.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 03:52:30 GMT
content-length: 25244
last-modified: Mon, 09 Dec 2019 21:07:20 GMT
server: nginx/1.19.10
accept-ranges: bytes
x-server-cache: false
content-type: font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
tosetofftrips.com
119.18.54.35
2606:4700::6810:135e
03de4b9cf46dd5570223a4f4b3f57a02b609fc53430d95c2f265e8b6368713a3
1f3fd405c64b807d88a6f32a0b972c38e9ca66f3380ca051d7c8038c5b96b880
5f7d5fb148b72d2c8c3a459d94eb65d1c927da54c1ecb43f9bddfe6449730cfe
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
86faeab09e16d426a818bb33e89eb231d3c005905ecfa88e11365e50768e3b1c
8bb7974183ff975132235b0da28f9eb00d607ce863ed24ae71219ec96a38b5ef
addf96fe07895d750d00834b2cf4e66bd6cfb25364a40bde81c8464e00698947
af32dd61a7a818af56fba7005751bf84c5137b7f952ae9bba83b566374ed33ff
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
e96b46a59ee68d66d600ccd8ce06ac4144a225e5125a8ad23ddaf024e09d71eb

tosetofftrips.com Open in urlscan Pro 119.18.54.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

202 kBTransfer

549 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

0 Cookies

Indicators

tosetofftrips.com Open in urlscan Pro
119.18.54.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

202 kB
Transfer

549 kB
Size

0
Cookies

10 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!