urlscan.io logo urlscan.io
SecurityTrails logo

coplinhealth.local-user.com Open in urlscan Pro
208.109.19.66  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://coplinhealth.local-user.com/
Effective URL: https://coplinhealth.local-user.com/
Submission: On April 30 via api from HU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 21 HTTP transactions. The main IP is 208.109.19.66, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is coplinhealth.local-user.com.
TLS certificate: Issued by R3 on April 29th 2024. Valid for: 3 months.
This is the only time coplinhealth.local-user.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ADP (Online)

Domain & IP information

IP Address AS Autonomous System
2 208.109.19.66 398101 (GO-DADDY-...)
16 170.146.92.153 14299 (ADP1)
21 3
Apex Domain
Subdomains		 Transfer
16 mykplan.com
www.mykplan.com — Cisco Umbrella Rank: 216355 Failed
283 KB
2 local-user.com
coplinhealth.local-user.com
5 KB
0 googletagmanager.com Failed
www.googletagmanager.com Failed
21 3
Domain Requested by
16 www.mykplan.com coplinhealth.local-user.com
www.mykplan.com
2 coplinhealth.local-user.com
0 www.googletagmanager.com Failed coplinhealth.local-user.com
21 3

This site contains links to these domains. Also see Links.

Domain
www.mykplan.com
netsecure.adp.com
privacy.adp.com
Subject Issuer Validity Valid
coplinhealth.local-user.com
R3		 2024-04-29 -
2024-07-28		 3 months crt.sh
mykplan.com
DigiCert SHA2 Extended Validation Server CA		 2023-09-28 -
2024-09-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://coplinhealth.local-user.com/
Frame ID: 273FAE5176C97F265EA76C2BFBB94A59
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | ADP

Page URL History Show full URLs

  1. http://coplinhealth.local-user.com/ HTTP 307
    https://coplinhealth.local-user.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

340 kB
Transfer

678 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://coplinhealth.local-user.com/ HTTP 307
    https://coplinhealth.local-user.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
coplinhealth.local-user.com/
Redirect Chain
  • http://coplinhealth.local-user.com/
  • https://coplinhealth.local-user.com/
19 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://coplinhealth.local-user.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
208.109.19.66 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
66.19.109.208.host.secureserver.net
Software
Apache / PHP/7.4.33
Resource Hash
cf208d3bd8f28d1764ad24f45f3785a923e25e5cb7dba281e1e36a3b4075ed1a

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-length
4425
content-type
text/html; charset=UTF-8
date
Tue, 30 Apr 2024 10:29:00 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

Location
https://coplinhealth.local-user.com/
Non-Authoritative-Reason
HttpsUpgrades
jquery-1.9.1.js
www.mykplan.com/participantsecure_net/Scripts/ 		0
0
jquery.unobtrusive-ajax.min.js
www.mykplan.com/participantsecure_net/Scripts/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Scripts/jquery.unobtrusive-ajax.min.js
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
f58726453dcf252a1740e5f4f6698de462263e9e17db4fc369f4d1077ce047dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:52 GMT
ETag
"1D95C108BDEB200"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-733958709"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
1538
Expires
Wed, 01 May 2024 10:01:56 GMT
adp.rs.particsponsor.js
www.mykplan.com/participantsecure_net/Scripts/adp/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Scripts/adp/adp.rs.particsponsor.js
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
1831f58a125d069393bc6e5d35f3bbe44786abc501b5c4f794f7f739ecaba4ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:50 GMT
ETag
"1D95C108AAD8500"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1705525462"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
4990
Expires
Wed, 01 May 2024 10:18:53 GMT
jquery.placeholder.js
www.mykplan.com/participantsecure_net/Scripts/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Scripts/jquery.placeholder.js
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
2ee29ed1ded35ddc043bd956a7aa13fde7c448e13781a20b7a3a76ce31a4ce80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:52 GMT
ETag
"1D95C108BDEB200"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1464866030"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
2455
Expires
Wed, 01 May 2024 10:19:01 GMT
jquery.mobile-1.3.2.js
www.mykplan.com/participantsecure_net/Scripts/ 		0
0
cookies.js
www.mykplan.com/participantsecure_net/Scripts/ 		399 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Scripts/cookies.js
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
f1e96ee232c8e9c04edf4d0875e9727e4aa8052bd5335657608ac115e4728c33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Last-Modified
Tue, 21 Mar 2023 16:16:51 GMT
ETag
"1D95C108B461B80"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1068887725"
Accept-Ranges
bytes
Content-Length
399
Expires
Wed, 01 May 2024 09:47:31 GMT
jquery.megamenu.3.css
www.mykplan.com/participantsecure_net/Content/ 		813 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/jquery.megamenu.3.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
782eb0c6641d09a5735af7b5f228a0d741ffebd3925fa67f40f36387a8bdeb18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Last-Modified
Tue, 21 Mar 2023 16:16:46 GMT
ETag
"1D95C10884B2B00"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-219943930"
Accept-Ranges
bytes
Content-Length
813
Expires
Wed, 01 May 2024 08:00:35 GMT
portalLOGIN-2012.css
www.mykplan.com/participantsecure_net/ 		82 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/portalLOGIN-2012.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
cc8cddaa39d486231a4c5f9bcabf856e1be4bcf81bfa0b8be0910a53388ccf5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:50 GMT
ETag
"1D95C108AAD8500"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="864749523"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
9098
Expires
Wed, 01 May 2024 08:00:45 GMT
jquery.mobile-1.3.2.css
www.mykplan.com/participantsecure_net/Content/ 		133 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/jquery.mobile-1.3.2.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
85e3c92392b40a75acac01789df37bd16b124649e38ac2ea38514298330df944
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:00 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 14 Jul 2021 19:59:04 GMT
ETag
"1D778EAB2503400"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-373889969"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
36417
Expires
Wed, 01 May 2024 10:09:44 GMT
jquery.mobile.structure-1.3.2.css
www.mykplan.com/participantsecure_net/Content/ 		85 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/jquery.mobile.structure-1.3.2.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
58262f6c7923cc516fdd2a94cbe4edf322ff80737ef2f5842f8b9ef2d0507b69
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 14 Jul 2021 19:59:04 GMT
ETag
"1D778EAB2503400"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1753428720"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
25123
Expires
Wed, 01 May 2024 09:23:02 GMT
jquery.mobile.theme-1.3.2.css
www.mykplan.com/participantsecure_net/Content/ 		48 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/jquery.mobile.theme-1.3.2.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
43015feb9b9f1cc3c7333871254db6481a06ebf31140c96f6bb104ad1cb4b393
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Wed, 14 Jul 2021 19:59:04 GMT
ETag
"1D778EAB2503400"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="386205391"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
11697
Expires
Wed, 01 May 2024 10:23:58 GMT
adp.rs.revolution4.base.css
www.mykplan.com/participantsecure_net/Content/adp/ 		27 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.revolution4.base.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
48d7800f8dd4bed660799444e13dfbd8bc6a5ef2448d0428ebac77ea9c24976a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:00 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:45 GMT
ETag
"1D95C1087B29480"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="925948158"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
8168
Expires
Wed, 01 May 2024 08:00:24 GMT
adp.rs.revolution4.custom.css
www.mykplan.com/participantsecure_net/Content/adp/ 		35 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.revolution4.custom.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
4523537e4a67fb8aa3a6fc7654dd1478f7a257d1e5fdeb904e4e6efe1ce68994
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:45 GMT
ETag
"1D95C1087B29480"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-358835339"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
10094
Expires
Wed, 01 May 2024 08:01:54 GMT
adp.rs.ti.base.min.css
www.mykplan.com/participantsecure_net/Content/adp/ 		81 KB
73 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.ti.base.min.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
2938498a76f7ea5f56e58d6a963364f5364b1a3437ad0485f22b1b6e215458ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:00 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:45 GMT
ETag
"1D95C1087B29480"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1359321096"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
74101
Expires
Wed, 01 May 2024 08:00:51 GMT
adp.rs.participant.custom.min.css
www.mykplan.com/participantsecure_net/Content/adp/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.participant.custom.min.css
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
9cf02dcacfeba8b3f6f14a5e1fbe46a8705e2cccf218ac94d55930b2885e0d3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Content-Encoding
gzip
Last-Modified
Tue, 21 Mar 2023 16:16:45 GMT
ETag
"1D95C1087B29480"
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-1365511991"
Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
1001
Expires
Wed, 01 May 2024 08:00:35 GMT
ADPlogo_white.png
www.mykplan.com/participantsecure_net/imgs/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mykplan.com/participantsecure_net/imgs/ADPlogo_white.png
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
33ee72eaceec23acc44a182a346ca2e77d659865aba46564bed74359c4a1d4ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Last-Modified
Tue, 21 Mar 2023 16:16:49 GMT
ETag
"4681388a105cd91:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1846939874"
Accept-Ranges
bytes
Content-Length
1102
footer-adp-logo.png
www.mykplan.com/participantsecure_net/Imgs/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mykplan.com/participantsecure_net/Imgs/footer-adp-logo.png
Requested by
Host: coplinhealth.local-user.com
URL: https://coplinhealth.local-user.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
dcb5e7ad08efc40e0b71fa266656a3f7d0a6ce620d054ab35704ee3b00b1fd0a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:01 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Last-Modified
Tue, 21 Mar 2023 16:16:49 GMT
ETag
"115f498a105cd91:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Server-Timing
dtSInfo;desc="0", dtRpid;desc="716099325"
Accept-Ranges
bytes
Content-Length
1746
gtm.js
www.googletagmanager.com/ 		0
0
rs_sponsor_grass_bg.jpg
www.mykplan.com/participantsecure_net/Imgs/participant_login/ 		88 KB
88 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mykplan.com/participantsecure_net/Imgs/participant_login/rs_sponsor_grass_bg.jpg
Requested by
Host: www.mykplan.com
URL: https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.ti.base.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.146.92.153 , United States, ASN14299 (ADP1, US),
Reverse DNS
s4.planaccount.com
Software
/
Resource Hash
88f6d5721640f988d73b7c754170fc9767c42433ead2fed06b89a643a86c9df5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.mykplan.com/participantsecure_net/Content/adp/adp.rs.ti.base.min.css
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date
Tue, 30 Apr 2024 10:29:03 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains;
Last-Modified
Tue, 21 Mar 2023 16:16:49 GMT
ETag
"1D95C108A14EE80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
public
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1786577918"
Accept-Ranges
bytes
Content-Length
89727
Expires
Wed, 01 May 2024 08:17:35 GMT
truncated
/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dd36a716441351d9999a5ee6e0908312dcd41a1642160eea89a7a32dbe59ae0

Request headers

Referer
Origin
https://coplinhealth.local-user.com
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff;charset=utf-8
truncated
/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6fd3183ba7d12e77b209b2e0419c26a075e8041e5f5f04203cc6867e0ad8afc3

Request headers

Referer
Origin
https://coplinhealth.local-user.com
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
application/x-font-woff;charset=utf-8
favicon.ico
coplinhealth.local-user.com/ 		315 B
388 B 		Other
General
Check archive.org
Download Go to
Full URL
https://coplinhealth.local-user.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
208.109.19.66 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
66.19.109.208.host.secureserver.net
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://coplinhealth.local-user.com/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Tue, 30 Apr 2024 10:29:04 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.mykplan.com
URL
https://www.mykplan.com/participantsecure_net/Scripts/jquery-1.9.1.js
Domain
www.mykplan.com
URL
https://www.mykplan.com/participantsecure_net/Scripts/jquery.mobile-1.3.2.js
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtm.js?id=GTM-KH3TMH

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ADP (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| PlaceholderforTextOnly object| myAlliance object| myPlan function| GetCookie function| SetCookie function| DeleteCookie function| getCookieVal function| ContactUs function| confirmCheck function| CloseMe function| SetFocus object| dataLayer object| theForm function| __doPostBack function| disablebuttons

1 Cookies

Domain/Path Name / Value
coplinhealth.local-user.com/ Name: PHPSESSID
Value: d4ea15c7a15bf4d243ba283176e49b47

3 Console Messages

Source Level URL
Text
security error URL: https://coplinhealth.local-user.com/(Line 242)
Message:
Mixed Content: The page at 'https://coplinhealth.local-user.com/' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtm.js?id=GTM-KH3TMH'. This request has been blocked; the content must be served over HTTPS.
recommendation verbose URL: https://coplinhealth.local-user.com/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://coplinhealth.local-user.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

coplinhealth.local-user.com
www.googletagmanager.com
www.mykplan.com
www.googletagmanager.com
www.mykplan.com
170.146.92.153
208.109.19.66
1831f58a125d069393bc6e5d35f3bbe44786abc501b5c4f794f7f739ecaba4ee
2938498a76f7ea5f56e58d6a963364f5364b1a3437ad0485f22b1b6e215458ec
2dd36a716441351d9999a5ee6e0908312dcd41a1642160eea89a7a32dbe59ae0
2ee29ed1ded35ddc043bd956a7aa13fde7c448e13781a20b7a3a76ce31a4ce80
33ee72eaceec23acc44a182a346ca2e77d659865aba46564bed74359c4a1d4ac
43015feb9b9f1cc3c7333871254db6481a06ebf31140c96f6bb104ad1cb4b393
4523537e4a67fb8aa3a6fc7654dd1478f7a257d1e5fdeb904e4e6efe1ce68994
48d7800f8dd4bed660799444e13dfbd8bc6a5ef2448d0428ebac77ea9c24976a
58262f6c7923cc516fdd2a94cbe4edf322ff80737ef2f5842f8b9ef2d0507b69
6fd3183ba7d12e77b209b2e0419c26a075e8041e5f5f04203cc6867e0ad8afc3
782eb0c6641d09a5735af7b5f228a0d741ffebd3925fa67f40f36387a8bdeb18
85e3c92392b40a75acac01789df37bd16b124649e38ac2ea38514298330df944
88f6d5721640f988d73b7c754170fc9767c42433ead2fed06b89a643a86c9df5
9cf02dcacfeba8b3f6f14a5e1fbe46a8705e2cccf218ac94d55930b2885e0d3f
cc8cddaa39d486231a4c5f9bcabf856e1be4bcf81bfa0b8be0910a53388ccf5f
cf208d3bd8f28d1764ad24f45f3785a923e25e5cb7dba281e1e36a3b4075ed1a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dcb5e7ad08efc40e0b71fa266656a3f7d0a6ce620d054ab35704ee3b00b1fd0a
f1e96ee232c8e9c04edf4d0875e9727e4aa8052bd5335657608ac115e4728c33
f58726453dcf252a1740e5f4f6698de462263e9e17db4fc369f4d1077ce047dd