tazminroshangaran.ir Open in urlscan Pro
62.3.41.235  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://tokobundo.my.id/aspx.htm Page URL
2. https://tazminroshangaran.ir/wp-admin/maint/signin.htm Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	aspx.htm tokobundo.my.id/	131 B 663 B	600ms 417ms	Document text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tokobundo.my.id/aspx.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 742e344b7e49b76d-AMS content-encoding br content-type text/html date Tue, 30 Aug 2022 14:26:56 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" last-modified Mon, 29 Aug 2022 03:09:31 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JzFBI99TfbEeYNbKXI0moZq0ROoLZ1y3%2FXHzr2CMZm2k6NSLGAHhNk6BTkUAJekbcL1qpwAn2vY%2BoqMKLFtrnKemFCLyvCBKWd5NlgyQQ3GEDUM2gfS9s1jbcm3h1sQh8oUA35ZonOPVHvjNXqs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000
GET H2	200	Primary Request signin.htm Show response tazminroshangaran.ir/wp-admin/maint/	4 KB 1 KB	523ms 115ms	Document text/html	62.3.41.235 PARVASYSTEM
General Check archive.org Show headers Download Go to Full URL https://tazminroshangaran.ir/wp-admin/maint/signin.htm Requested by Host: tokobundo.my.id URL: https://tokobundo.my.id/aspx.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 62.3.41.235 , Iran, Islamic Republic Of, ASN60631 (PARVASYSTEM, IR), Reverse DNS s265.bitcommand.com Software LiteSpeed / Resource Hash 23cd787bd4cbc9fac8bf079ef48d02fa42e5638bb8033d0947fa355f79ef0786 Request headers Referer https://tokobundo.my.id/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-encoding br content-length 1133 content-type text/html date Tue, 30 Aug 2022 14:26:56 GMT etag "ea7-630c2bf7-650cad998e5e7a90;br" last-modified Mon, 29 Aug 2022 03:01:11 GMT server LiteSpeed vary Accept-Encoding,User-Agent
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	108ms 33ms	Script application/javascript	2001:4de0:ac18::1:a:1a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: tazminroshangaran.ir URL: https://tazminroshangaran.ir/wp-admin/maint/signin.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers accept-language nl-NL,nl;q=0.9 Referer https://tazminroshangaran.ir/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Tue, 30 Aug 2022 14:26:56 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15283" vary Accept-Encoding x-hw 1661869616.dop239.am5.t,1661869616.cds201.am5.hn,1661869616.cds255.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	122ms 49ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: tazminroshangaran.ir URL: https://tazminroshangaran.ir/wp-admin/maint/signin.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://tazminroshangaran.ir/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Tue, 30 Aug 2022 14:26:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 674, 718, 718 age 7196753 cdn-cachedat 2021-06-08 05:11:08 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid d57b249fbc897a386cb949167a1340aa cf-ray 742e3451fec6b776-AMS cdn-requestcountrycode US cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
stackpath.bootstrapcdn.com
tazminroshangaran.ir
tokobundo.my.id
2001:4de0:ac18::1:a:1a
2606:4700::6812:bcf
2a06:98c1:3121::c
62.3.41.235
23cd787bd4cbc9fac8bf079ef48d02fa42e5638bb8033d0947fa355f79ef0786
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de