www.lagunaerp.com Open in urlscan Pro
198.54.114.219  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response www.lagunaerp.com/xmmbbcdbmd/	44 KB 18 KB	576ms 125ms	Document text/html	198.54.114.219 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://www.lagunaerp.com/xmmbbcdbmd/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.114.219 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server72-1.web-hosting.com Software LiteSpeed / Resource Hash b2efee470958791e1e3d6bc4b71b9d77379ef21af1ce667d2cbadf514b80c741 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers accept-ranges bytes content-encoding br content-length 18319 content-type text/html date Fri, 11 Oct 2024 04:31:51 GMT last-modified Tue, 08 Oct 2024 13:53:41 GMT server LiteSpeed vary Accept-Encoding x-turbo-charged-by LiteSpeed
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	191ms 30ms	Script application/javascript	2a04:4e42::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: www.lagunaerp.com URL: https://www.lagunaerp.com/xmmbbcdbmd/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.lagunaerp.com Referer https://www.lagunaerp.com/ Response headers content-encoding gzip etag W/"28feccc0-15851" age 3870349 x-cache HIT, HIT date Fri, 11 Oct 2024 04:31:51 GMT content-type application/javascript; charset=utf-8 last-modified Fri, 18 Oct 1991 12:00:00 GMT x-cache-hits 224765, 33799 x-served-by cache-lga21965-LGA, cache-yyz4570-YYZ vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=604800 x-timer S1728621111.363512,VS0,VE0 cross-origin-resource-policy cross-origin via 1.1 varnish, 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 30638 server nginx
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	291ms 94ms	Script text/javascript	2607:f8b0:400d:c07::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: www.lagunaerp.com URL: https://www.lagunaerp.com/xmmbbcdbmd/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c07::5f Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.lagunaerp.com/ Response headers content-encoding gzip age 94328 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Fri, 10 Oct 2025 02:19:43 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 10 Oct 2024 02:19:43 GMT last-modified Tue, 03 Mar 2020 19:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30028 x-xss-protection 0 server sffe
GET H3	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 16 KB	223ms 60ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: www.lagunaerp.com URL: https://www.lagunaerp.com/xmmbbcdbmd/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.lagunaerp.com/ Response headers cdn-status 200 content-encoding gzip cf-cache-status HIT etag W/"67176c242e1bdc20603c878dee836df3" age 18263440 x-content-type-options nosniff alt-svc h3=":443"; ma=86400 date Fri, 11 Oct 2024 04:31:51 GMT last-modified Mon, 25 Jan 2021 22:04:06 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding cdn-cache HIT cdn-cachedat 10/31/2023 18:58:40 cdn-requestpullcode 200 strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31919000 cdn-requestpullsuccess True timing-allow-origin * cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid f4f838df79fc133911a060d7c6bb0f5c cross-origin-resource-policy cross-origin cdn-pullzone 252412 cdn-proxyver 1.04 cf-ray 8d0c1f7a1ceb7cf4-EWR access-control-allow-origin * cdn-edgestorageid 1048 server cloudflare cdn-requestcountrycode DE
GET H2	200	apple-icon-57x57.png img6.wsimg.com/ux/favicon/	1 KB 2 KB	556ms 151ms	Other image/png	23.50.115.197 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://img6.wsimg.com/ux/favicon/apple-icon-57x57.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.50.115.197 Miami, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-50-115-197.deploy.static.akamaitechnologies.com Software / Resource Hash 9596eb45bcd79c94e78722504b256110a0fbb06606de24168c78045a6203b07a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.lagunaerp.com/ Response headers cache-control max-age=2592000 timing-allow-origin * etag "80f73695bcad51:0" accept-ranges bytes server-timing cdn-cache; desc=HIT, edge; dur=3, ak_p; desc="1728621111853_389151749_1016084068_290_1570_54_162_219";dur=1 access-control-allow-origin * content-length 1439 date Fri, 11 Oct 2024 04:31:52 GMT content-type image/png last-modified Mon, 13 Jan 2020 21:50:03 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GoDaddy (Online)

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| qy7 function| qy6 function| qy9 string| qy8 function| ___ string| se string| kghx193 function| und1 function| und2 string| k number| oh string| a string| c string| O string| kwee function| nem function| cNS function| ns9 function| u0 function| u1 function| u2 function| u3 function| nn function| ni function| ge string| tN string| s0 string| s1 string| s2 string| s3 object| f function| IIII function| IllI function| Ill1 function| I111 function| IIIl function| lll1 function| lII1 function| llll string| l11l string| l111 number| r number| d string| o string| Illl string| III1 string| Il11 string| I1ll string| I11l string| l1Il function| lIIl function| $ function| jQuery object| bootstrap string| u number| i4 number| i8 object| rec function| _f_c function| hd function| hw number| i6 function| he function| hh string| hwa function| atou function| utoa object| rea object| reb object| __ object| I1l1 object| lllI number| lI1I object| Il1l object| Il1I number| t number| m object| I1lI number| ctaL number| j number| x object| l1I1 object| lI11

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://www.lagunaerp.com/xmmbbcdbmd/index.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
img6.wsimg.com
stackpath.bootstrapcdn.com
www.lagunaerp.com
198.54.114.219
23.50.115.197
2606:4700::6812:acf
2607:f8b0:400d:c07::5f
2a04:4e42::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
9596eb45bcd79c94e78722504b256110a0fbb06606de24168c78045a6203b07a
b2efee470958791e1e3d6bc4b71b9d77379ef21af1ce667d2cbadf514b80c741