wordpress-green-kangaroo-slm.codeanyapp.com
Open in
urlscan Pro
198.199.109.95
Malicious Activity!
Public Scan
URL:
https://wordpress-green-kangaroo-slm.codeanyapp.com/gseno/index.htm
Submission: On October 19 via api from CA — Scanned from CA
Submission: On October 19 via api from CA — Scanned from CA
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 198.199.109.95, located in
San Francisco, United States and
belongs to DIGITALOCEAN-ASN, US.
The main domain is wordpress-green-kangaroo-slm.codeanyapp.com.
TLS certificate: Issued by E5 on October 14th 2024. Valid for: 3 months.
This is the only time wordpress-green-kangaroo-slm.codeanyapp.com was scanned on urlscan.io!
TLS certificate: Issued by E5 on October 14th 2024. Valid for: 3 months.
This is the only time wordpress-green-kangaroo-slm.codeanyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Gjensidige (Insurance)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 198.199.109.95 198.199.109.95 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
| 2 | 2600:9000:251... 2600:9000:2511:ce00:7:2bfb:7c00:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 13 | 2 |
11
198.199.109.95
(San Francisco, United States)
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com
| wordpress-green-kangaroo-slm.codeanyapp.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
codeanyapp.com
wordpress-green-kangaroo-slm.codeanyapp.com |
168 KB |
| 2 |
tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1314 |
11 KB |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | wordpress-green-kangaroo-slm.codeanyapp.com |
wordpress-green-kangaroo-slm.codeanyapp.com
|
| 2 | tags.tiqcdn.com |
wordpress-green-kangaroo-slm.codeanyapp.com
|
| 13 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| codeanyapp.com E5 |
2024-10-14 - 2025-01-12 |
3 months | crt.sh |
| tags.tiqcdn.com Amazon RSA 2048 M02 |
2024-03-19 - 2025-04-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wordpress-green-kangaroo-slm.codeanyapp.com/gseno/index.htm
Frame ID: 637AF29F428D519557981539FD5FFB01
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.htm
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utag.js
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
77 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utag.sync.js
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
1 KB 816 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gjeff.css
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
547 KB 75 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.css
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
2 KB 779 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gjeff.min.js
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
203 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utag.v.js
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
2 B 154 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gjensidige-no_prod_180504.js
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
317 B 447 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gjensidige_logo.svg
wordpress-green-kangaroo-slm.codeanyapp.com/gseno/Login%20-%20Gjensidige%20Forsikring_files/ |
6 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utag.js
tags.tiqcdn.com/utag/gjensidige/eai/prod/ |
33 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loginpage-ssn
wordpress-green-kangaroo-slm.codeanyapp.com/ajax/ |
326 B 415 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ |
2 B 432 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
wordpress-green-kangaroo-slm.codeanyapp.com/ |
319 B 408 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Gjensidige (Insurance)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| codi function| jQuery function| $ object| jQuery1124025662531520349185 object| gj object| utag object| utag_data function| gcct string| warningString function| simplePopup function| getScreenWidth function| getScreenHeight function| submitOrderAccess function| addUser function| submitForgottenPassword function| disableLogin function| validateLogin1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .codeanyapp.com/ | Name: utag_main Value: v_id:0192a32b983400136df017f8c5b705065004305d00b08$_sn:1$_se:1$_ss:1$_st:1729316196214$ses_id:1729314396214%3Bexp-session$_pn:1%3Bexp-session$_prevpage:https%3A%2F%2Fwordpress-green-kangaroo-slm.codeanyapp.com%2Fgseno%2Findex.htm%3Bexp-1729317996218 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
tags.tiqcdn.com
wordpress-green-kangaroo-slm.codeanyapp.com
198.199.109.95
2600:9000:2511:ce00:7:2bfb:7c00:93a1
14f5d202b459656ce07b4d787e6e0737e97fcfcfae3ef64328d69620afb14615
378bdc98f3b3d7d0938dd3b2d09c199ad8f2f6d8af6cec9541a0a6502d9663cc
4c5b69b606d822d1eebf8af630ebd8ced3ab782fa67d4538f601f5d06625f163
83e71e55571bd3d4e7298768cfe226b3fb65a68ba7dbea5d60a4fd076050d429
87077dcddf56b917cf35d9f4915f1417cf4bf859c82bde414fb822e1e33f0dfe
94750789a5c3968d5922a3feacba21c410b710b3e84d3ec4e3b893cd240c04b4
9a4143e1ac191044c1987a32e6e8893513a7ce3106e30ccd1e0d457fe2aae102
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
c64ebb41f089f740652cf58dee1ef57c1006d5aca18a495d25b38f38c4895169
ecb0e38b4c2be3cb2ea228f88118824735de98ce8fa38167be92faa84a744931
ecff1eec9f503aa52ad46a7e3b1b456d62b6290947dbeee2b8465ca7c2759d7e
f3be7f0cb342ebc17954d769f3a1648ece0eb57ce1e03e4c18c92f47dd73ad0d