staging-live-handelsblatt-com.hmg.systems
Open in
urlscan Pro
199.16.172.1
Malicious Activity!
Public Scan
Effective URL: https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/index.php
Submission: On November 22 via manual from ES — Scanned from ES
Summary
TLS certificate: Issued by R3 on November 17th 2023. Valid for: 3 months.
This is the only time staging-live-handelsblatt-com.hmg.systems was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Correos (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 50.19.194.245 50.19.194.245 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 2606:4700:440... 2606:4700:4400::ac40:944b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 32 | 199.16.172.1 199.16.172.1 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
32 | 2 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-50-19-194-245.compute-1.amazonaws.com
rb.gy |
ASN13335 (CLOUDFLARENET, US)
myworkspace8fd34.myclickfunnels.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
hmg.systems
1 redirects
staging-live-handelsblatt-com.hmg.systems |
313 KB |
1 |
gstatic.com
www.gstatic.com |
2 KB |
1 |
myclickfunnels.com
1 redirects
myworkspace8fd34.myclickfunnels.com |
1 KB |
1 |
rb.gy
1 redirects
rb.gy — Cisco Umbrella Rank: 122589 |
184 B |
32 | 4 |
Domain | Requested by | |
---|---|---|
32 | staging-live-handelsblatt-com.hmg.systems |
1 redirects
staging-live-handelsblatt-com.hmg.systems
|
1 | www.gstatic.com |
staging-live-handelsblatt-com.hmg.systems
|
1 | myworkspace8fd34.myclickfunnels.com | 1 redirects |
1 | rb.gy | 1 redirects |
32 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tls.automattic.com R3 |
2023-11-17 - 2024-02-15 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/index.php
Frame ID: 4E998676BA94CAE82621BABFEF2173F6
Requests: 32 HTTP requests in this frame
Screenshot
Page Title
DetalleDetallePage URL History Show full URLs
-
https://rb.gy/bfrydn?correos
HTTP 301
https://myworkspace8fd34.myclickfunnels.com/ebcc7?correos= HTTP 302
https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/ HTTP 302
https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/index.php Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
PHP (Programming Languages) Expand
Detected patterns
- \.php(?:$|\?)
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Ahoy (Analytics) Expand
Detected patterns
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rb.gy/bfrydn?correos
HTTP 301
https://myworkspace8fd34.myclickfunnels.com/ebcc7?correos= HTTP 302
https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/ HTTP 302
https://staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/ Redirect Chain
|
793 KB 68 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iconfont.css
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/font/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
correos-ui-kit.css
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/css/ |
149 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animista.css
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/css/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clientlib-base.min.7d250654d6a4ba422176cd385b93bb36.css
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clientlib-react.min.43091e600ff5d0e3d65a5590bfe00a1d.css
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=el_main_css.html
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/css/ |
31 KB 5 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.png
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logocornamusa.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.js
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.js
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resourceconfig.js
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apple_store.jpg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
11 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google_play.jpg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
12 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
huawei.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
25 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-mastercard.png
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal.svg.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
maestro.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
visa.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log%20amex.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3c.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ico-splash.svg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-regular-webfont.woff2
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iconfont.woff2
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
2 KB 3 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-bold-webfont.woff2
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-light-webfont.woff2
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Banner-Correos-Market-modulo-localizador-Correos-1440x960.jpg
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/img/ |
160 KB 160 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-bold-webfont.woff
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-regular-webfont.woff
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cartero-light-webfont.woff
staging-live-handelsblatt-com.hmg.systems/wp-content/plugins/comos/auth/files/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Correos (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| generateSessionTitle function| formatMonth function| generateDate5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
myworkspace8fd34.myclickfunnels.com/ | Name: ahoy_visitor Value: 0235b84e-490a-4e86-8f23-537a3d129794 |
|
myworkspace8fd34.myclickfunnels.com/ | Name: ahoy_visit Value: 1d4d2897-f046-4928-b4e0-d0e2ea79a4ef |
|
.myclickfunnels.com/ | Name: _cf_session Value: gYTefw84D8ZFywGsNvuPQjrKPIUIKPkryKKW1ZIjVkACWoD1gN3iELUbglOtsZsC2OgKHQZH5gs%2FXY%2FPpy0sMKEWfDdQ6jKZhWkzYDHDlCujJpyezChvKSP30MwcGczwIT6ly0Sb%2F8jXClD52me%2Btof7MoWXveCG5d4oNZRBsucNKD71gT07jOy2gt%2BgnV1Wj99BRD8nAFtnjAdVR5Fa9Ss4qaNmKLahvntdAkvRzzC5Zo%2B8YVwh9Effi4gDMd5c8Q4ayi04y11h2OCguNAOT2JFZw15l9uXglJs7AFF9lfmBZz0%2F%2F%2Bhn%2BEKQgz890uWNpgefoNGEclUwyy2rPxUt1BsKHrUWiMJPOiMA1oyt1uJRjXpyWKo2HcfTF2Oo%2B1RvCGgNfDavQ%3D%3D--6t98l2nqb94p7T82--yDKz2x8mZPkpBDDb%2BhHopA%3D%3D |
|
.myclickfunnels.com/ | Name: __cf_bm Value: 3QKwsQ25KPR9rfLcb22tjfEu4F5BFzdjs.cpda4s4Po-1700637536-0-ATa8QuPKijR/JrJp7hccTm0zLCad35jcUZbgwH9Epbg74zt2VOvXKOnud7RtBrhankn2bxvSHO9k5Pl5EUXEA58= |
|
staging-live-handelsblatt-com.hmg.systems/ | Name: PHPSESSID Value: a42d842a62ce6566c1c8827cda8ea74e |
12 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
myworkspace8fd34.myclickfunnels.com
rb.gy
staging-live-handelsblatt-com.hmg.systems
www.gstatic.com
199.16.172.1
2606:4700:4400::ac40:944b
2a00:1450:4001:80b::2003
50.19.194.245
20f1ce6085971b298a643c6e862c84960a266d3a808c0a75ed56470ad342d83b
274f49413e4e9e8d824040c60f5d7173350159a3eb21545a5f95b09098190fee
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e4b959315454053c9aca9c2cbf19a4fe9900e48fdb8efd94defb058dbed6eb5
509066150aa1da2b163e681cff62f67f0becd0bb65cded95be964371835798f6
5226c2b8880fef53679eeeeca0db47961bf4b1992b4071d21ea858981835ec78
6a904e947ed345633c02c2cf493d4e3a80ff4e519b0c3b8cc579021f6f0a82ae
9ca4b4430d80704711911dfc8604b4c12f6697c462cdfa1a52c0ed47c09f99da
b69e335aab45b08413d66b5bc09ebdd09244e58928f888214460337b3eadb8b7
bd54acf0ac29ac4ffecb9514f4f8efbd03e57eaf0c09129d201727065628efee
bda17ffead5e3809b288330e7aa2d2b689c45cfadcef8249416d07afe34477a7
c2f413765fb79b4a415bbc93cd26ef84b0074efd49addb1b01c37df875ffece8
d5d187547aec82de026b6873fcfc654738818d8684e2f33d9d4b4e71dc6d041e
dae58e3a35038fe1508d4ce16805960f8722fef2f68de4da845b9f48b9e969df
dc15eae8bcd7f1faac23c286de275c7ae0aa3f1896a8f659e363af3ca07a78f0
e640bec07c49caa12aa52e1850b6c2a19a6488a7969f9d23e01044e4cee1f246
e6ad4ef6001b62d0763c635d9ef8c13e2222965a5026d11505793d87b1de4b84
fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519
fcf7819345a998f0a393225aaa7c5fa39809416d1f6e36c08f0c3509b88e2f54
fcfc8cc1cc9eabeec7331c783d11c4800a975a076e6b870a3dd9be372cb8111d