b1u.980.mytemp.website
Open in
urlscan Pro
107.180.117.50
Malicious Activity!
Public Scan
Effective URL: https://b1u.980.mytemp.website/cgi/billing/home.php?newtoken=
Submission: On September 17 via api from BE — Scanned from US
Summary
TLS certificate: Issued by b1u.980.mytemp.website on July 14th 2024. Valid for: a year.
This is the only time b1u.980.mytemp.website was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 68.178.205.206 68.178.205.206 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 16 | 107.180.117.50 107.180.117.50 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
1 | 2606:4700:303... 2606:4700:3038::6815:ea90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 135.181.58.223 135.181.58.223 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 2 | 23.209.72.207 23.209.72.207 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2600:141b:1c0... 2600:141b:1c00:16::17c4:325 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 2600:141b:1c0... 2600:141b:1c00:2589::228b | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
26 | 6 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 206.205.178.68.host.secureserver.net
risingstarsyouthfootballcamp.com |
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 50.117.180.107.host.secureserver.net
b1u.980.mytemp.website |
ASN24940 (HETZNER-AS, DE)
PTR: white.hostingcolor.com
dispatching-centre.lasamericascargo.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-209-72-207.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN20940 (AKAMAI-ASN1, NL)
events.api.secureserver.net |
ASN20940 (AKAMAI-ASN1, NL)
csp.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
mytemp.website
1 redirects
b1u.980.mytemp.website |
80 KB |
6 |
secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 13374 csp.secureserver.net — Cisco Umbrella Rank: 13439 |
574 B |
3 |
lasamericascargo.com
dispatching-centre.lasamericascargo.com |
37 KB |
2 |
wsimg.com
1 redirects
img1.wsimg.com — Cisco Umbrella Rank: 10397 |
21 KB |
2 |
risingstarsyouthfootballcamp.com
2 redirects
risingstarsyouthfootballcamp.com |
532 B |
1 |
lr-in.com
cdn.lr-in.com — Cisco Umbrella Rank: 28832 |
178 KB |
26 | 6 |
Domain | Requested by | |
---|---|---|
16 | b1u.980.mytemp.website |
1 redirects
b1u.980.mytemp.website
|
4 | csp.secureserver.net |
img1.wsimg.com
|
3 | dispatching-centre.lasamericascargo.com |
b1u.980.mytemp.website
|
2 | events.api.secureserver.net |
img1.wsimg.com
|
2 | img1.wsimg.com |
1 redirects
b1u.980.mytemp.website
|
2 | risingstarsyouthfootballcamp.com | 2 redirects |
1 | cdn.lr-in.com |
b1u.980.mytemp.website
|
26 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
b1u.980.mytemp.website b1u.980.mytemp.website |
2024-07-14 - 2025-07-14 |
a year | crt.sh |
lr-in.com WE1 |
2024-09-02 - 2024-12-01 |
3 months | crt.sh |
dispatching-centre.lasamericascargo.com cPanel, Inc. Certification Authority |
2024-07-23 - 2024-10-21 |
3 months | crt.sh |
*.api.secureserver.net Starfield Secure Certificate Authority - G2 |
2024-07-15 - 2025-08-16 |
a year | crt.sh |
*.secureserver.net Starfield Secure Certificate Authority - G2 |
2023-10-10 - 2024-11-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://b1u.980.mytemp.website/cgi/billing/home.php?newtoken=
Frame ID: A16D969E73C04660E68DD86B1A4EEB52
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Verification | DHLPage URL History Show full URLs
-
https://risingstarsyouthfootballcamp.com/modules/cronjobs/classes/ende
HTTP 301
https://risingstarsyouthfootballcamp.com/modules/cronjobs/classes/ende/ HTTP 302
http://b1u.980.mytemp.website/cgi/billing/ HTTP 307
https://b1u.980.mytemp.website/cgi/billing/ HTTP 302
https://b1u.980.mytemp.website/cgi/billing/home.php?newtoken= Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://risingstarsyouthfootballcamp.com/modules/cronjobs/classes/ende
HTTP 301
https://risingstarsyouthfootballcamp.com/modules/cronjobs/classes/ende/ HTTP 302
http://b1u.980.mytemp.website/cgi/billing/ HTTP 307
https://b1u.980.mytemp.website/cgi/billing/ HTTP 302
https://b1u.980.mytemp.website/cgi/billing/home.php?newtoken= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
b1u.980.mytemp.website/cgi/billing/ Redirect Chain
|
75 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
b1u.980.mytemp.website/cgi/billing/assets/ |
405 KB 49 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logger-1.min.js
cdn.lr-in.com/ |
887 KB 178 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
b1u.980.mytemp.website/cgi/billing/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
col.png
b1u.980.mytemp.website/cgi/billing/assets/ |
682 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pak.png
b1u.980.mytemp.website/cgi/billing/assets/ |
380 B 433 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clan.png
b1u.980.mytemp.website/cgi/billing/assets/ |
475 B 528 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.png
b1u.980.mytemp.website/cgi/billing/assets/ |
469 B 522 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
foo.png
b1u.980.mytemp.website/cgi/billing/assets/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
b1u.980.mytemp.website/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
session-recorder.js
b1u.980.mytemp.website/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
card.js
dispatching-centre.lasamericascargo.com/js/ |
57 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
intlTelInput.js
dispatching-centre.lasamericascargo.com/js/ |
87 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scc-c2.min.js
img1.wsimg.com/signals/js/clients/scc-c2/ Redirect Chain
|
105 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-latin-400-normal.woff2
b1u.980.mytemp.website/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff2
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-all-400-normal.woff
b1u.980.mytemp.website/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.ttf
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 287 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 287 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.gif
dispatching-centre.lasamericascargo.com/images/ |
2 KB 2 KB |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| sessionHash number| visitId string| fingerprint function| openNav function| closeNav object| regeneratorRuntime object| __SDKCONFIG__ function| _LRLogger function| card function| Payment function| Card object| intlTelInputGlobals function| intlTelInput function| getRandomInt object| _trfd object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| scc-c2 object| _trfq4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
b1u.980.mytemp.website/ | Name: PHPSESSID Value: s23f2sm9v2l7n9obcoqjb8dp9h |
|
.mytemp.website/ | Name: _tccl_visitor Value: 1d8540d9-11a0-4868-b974-2ebb4cd1c602 |
|
.mytemp.website/ | Name: _tccl_visit Value: 1d8540d9-11a0-4868-b974-2ebb4cd1c602 |
|
.mytemp.website/ | Name: _scc_session Value: pc=1&C_TOUCH=2024-09-17T22:57:04.227Z |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b1u.980.mytemp.website
cdn.lr-in.com
csp.secureserver.net
dispatching-centre.lasamericascargo.com
events.api.secureserver.net
img1.wsimg.com
risingstarsyouthfootballcamp.com
107.180.117.50
135.181.58.223
23.209.72.207
2600:141b:1c00:16::17c4:325
2600:141b:1c00:2589::228b
2606:4700:3038::6815:ea90
68.178.205.206
18c4b9b4c27233b541a47300a4ee98239e1f8dec4bbcd9fabb6bdad12ca82025
381941fc8b5df86879d6e2fcf3392d281b796c33f430f045405a0e6af0e474b9
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756
5e9384547cb7d8449f13f2503225b41444e8f7064c8f3918a8de0585ff366743
691ff3918fb72cddc3abf2b84af0d66e0d2875b18b032ef6864923789c7e4077
90ed0771a0d53d8c5b07ab48d456545331d48c0ba4a6e571cdb85cfd2f64c910
a0b9419777f544b665051cae80f11bf8ff9f925072a9f062a3d82c383e6cdfde
b0dbd00f3650fa6b931e678a9d8f79a405d23c7adf111ab91b1a01a0e7109807
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b36e63b78f7ab077c9f74269deec4010ae803b687b27ca13e6aa58712520bb84
b8b7e6c193f0b11bece8c12b305cbf15130bc99b32ae92426eb747a3da3264d6
ba4bfe449d40da6f9b1d87265f5fc023a5b428d9ae26631fa8a405643a18d2a6
cae9d5adf2b0220c74a93b644c26d53e27c3a87f9b5d3fe57d06442e808074a2
eb6ca62c1e5d64c52be3ffa63c298dcda2483c04c4b17d1bfe605d134e52f91b