www.arabworldnewsnetwork.com Open in urlscan Pro
107.6.182.77  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request garcia.php Show response www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/	4 KB 5 KB	10429ms 10124ms	Document text/html	107.6.182.77 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol HTTP/1.1 Server 107.6.182.77 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS vm521.tmdcloud.eu Software Apache / Resource Hash 4c842224641dee6d16adcf65e004b2a6995e931911a48ceb6df2ef4c68891a57 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers Date Thu, 18 Nov 2021 01:23:51 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	screen.css acs4.3dsecure.no/mdpayacs/content/040/	3 KB 1 KB	853ms 36ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/screen.css Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:24:02 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-c14" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	gh-buttons.css acs4.3dsecure.no/mdpayacs/content/040/dk/	13 KB 3 KB	853ms 37ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:24:02 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-3290" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	commons.js Show response acs4.3dsecure.no/mdpayacs/content/	1 KB 823 B	854ms 38ms	Script application/javascript	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/commons.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:24:02 GMT content-encoding gzip last-modified Thu, 04 Oct 2018 00:56:30 GMT server nginx etag W/"1202-1538614590000" vary Accept-Encoding content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	853ms 37ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers
GET H/1.1	200 OK	date_time.js Show response www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/Autentisering_files/	823 B 1 KB	15ms 14ms	Script application/javascript	107.6.182.77 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/Autentisering_files/date_time.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol HTTP/1.1 Server 107.6.182.77 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS vm521.tmdcloud.eu Software Apache / Resource Hash c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Thu, 18 Nov 2021 01:24:02 GMT Last-Modified Wed, 17 Nov 2021 19:24:10 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 823
GET H2	200	Israel_Post_Logo.png logos-download.com/wp-content/uploads/2019/06/	188 KB 189 KB	81ms 27ms	Image image/png	2606:4700:e4::ac40:a716 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://logos-download.com/wp-content/uploads/2019/06/Israel_Post_Logo.png Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e4::ac40:a716 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / WordOps Resource Hash 51a24a187f57893ea3eb42100d659609111ad5b5c0cc66d1f392f3c385901286 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:24:03 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 233861 x-powered-by WordOps report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zgAp2O5OUrKT2lU2fTxWc5iKBI4CD4Xi%2Bt9T3%2BLf4tRB%2B%2Bo5DbCO1u7dGfuoiCy0RCqbMBmeupgZpJ%2F7KL%2B8x9uXzJUunEfBlI3QqgiLTlFT5FYyema%2FkWdRRkJdK52Ozf%2B%2FIqIdLCuRh7nekr1eOjA%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 192403 x-xss-protection 1; mode=block referrer-policy no-referrer, strict-origin-when-cross-origin last-modified Wed, 26 Jun 2019 20:04:03 GMT server cloudflare x-frame-options SAMEORIGIN etag "5d13cfb3-2ef93" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-download-options noopen content-type image/png access-control-allow-origin * cache-control max-age=315360000 accept-ranges bytes cf-ray 6afd659f399f0631-FRA expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	38ms 37ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers
GET H2	200	gh-icons.png acs4.3dsecure.no/mdpayacs/content/040/dk/	4 KB 4 KB	37ms 37ms	Image image/png	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Show image Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-icons.png Requested by Host: acs4.3dsecure.no URL: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:24:03 GMT last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag "614bbd7f-f6c" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3948

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| date_time function| onBodyLoad function| validate object| date number| year number| month object| months number| d number| day object| days string| h number| m string| s string| result

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
logos-download.com
www.arabworldnewsnetwork.com
107.6.182.77
185.42.168.133
2606:4700:e4::ac40:a716
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
4c842224641dee6d16adcf65e004b2a6995e931911a48ceb6df2ef4c68891a57
51a24a187f57893ea3eb42100d659609111ad5b5c0cc66d1f392f3c385901286
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb