terwebhome.com Open in urlscan Pro
2607:f1c0:100f:f000::247  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request ls19c5.html Show response terwebhome.com/bnac/adfs/	51 KB 14 KB	449ms 176ms	Document text/html	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://terwebhome.com/bnac/adfs/ls19c5.html?B Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash 914299c17ae56658f1ac88efcae9e7c00081d4fb01cd366a424859c0f8245aaf Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html date Sun, 20 Feb 2022 14:15:30 GMT server Apache last-modified Sat, 05 Feb 2022 17:45:05 GMT etag W/"cb50-5d748ed787926" content-encoding gzip
GET H2	200	style8f57.css terwebhome.com/bnac/adfs/portal/css/	26 KB 26 KB	198ms 198ms	Stylesheet text/css	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/ls19c5.html?B Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash be73cab6c4c09afb515cd2c2b637cbfbd5d3ed3af0a8f6e153c6288684d5cdd3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/ls19c5.html?B User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:09 GMT server Apache accept-ranges bytes etag "667d-5d748edc06f06" content-length 26237 content-type text/css
GET H2	200	css fonts.googleapis.com/	3 KB 700 B	75ms 29ms	Stylesheet text/css	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/ls19c5.html?B Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 48394ef740fabcd6aeb9c1de94df052c57348fc38da106e85828b45eef22580f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 20 Feb 2022 12:27:13 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Sun, 20 Feb 2022 14:15:30 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 20 Feb 2022 14:15:30 GMT
GET H2	200	css fonts.googleapis.com/	664 B 858 B	73ms 27ms	Stylesheet text/css	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/ls19c5.html?B Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 05410fbe1192a21525520421f6ddce4a065a94658a42146ae707a814926fa77d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 20 Feb 2022 12:32:38 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Sun, 20 Feb 2022 14:15:30 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 20 Feb 2022 14:15:30 GMT
GET H2	200	css fonts.googleapis.com/	5 KB 731 B	73ms 28ms	Stylesheet text/css	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400&display=swap Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/ls19c5.html?B Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 0202c1e41ee2a905889b0f4140b2853a48703fae16087f17292cbb75c0385ac0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Sun, 20 Feb 2022 14:15:30 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Sun, 20 Feb 2022 14:15:30 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 20 Feb 2022 14:15:30 GMT
GET H2	200	illustrationba1b.png terwebhome.com/bnac/adfs/portal/illustration/	114 KB 114 KB	195ms 193ms	Image image/png	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://terwebhome.com/bnac/adfs/portal/illustration/illustrationba1b.png?id=183128A3C941EDE3D9199FA37D6AA90E0A7DFE101B37D10B4FEDA0CF35E11AFD&amp;rp=37d0e840-bdc3-e911-90f3-005056b6cfbb Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash 183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/ls19c5.html?B User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:15 GMT server Apache accept-ranges bytes etag "1c7db-5d748ee0dc3e6" content-length 116699 content-type image/png
GET H2	200	fondo.jpg terwebhome.com/bnac/adfs/portal/images/bncr/	83 KB 84 KB	532ms 530ms	Image image/jpeg	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://terwebhome.com/bnac/adfs/portal/images/bncr/fondo.jpg Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash a25ba1b157ec936592d10b603b83173744a279f8be236e4dc3f25aab9fbbd452 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:16 GMT server Apache accept-ranges bytes etag "14d8f-5d748ee2b2f26" content-length 85391 content-type image/jpeg
GET H2	200	firma.png terwebhome.com/bnac/adfs/portal/images/bncr/	3 KB 3 KB	489ms 488ms	Image image/png	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://terwebhome.com/bnac/adfs/portal/images/bncr/firma.png Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash 52691c4f90034c90a93cb95cf2c62e8bfee3f2da454e5ad4195b89db97dfe446 Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:16 GMT server Apache accept-ranges bytes etag "a10-5d748ee294ac6" content-length 2576 content-type image/png
GET H2	200	JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 fonts.gstatic.com/s/montserrat/v12/	18 KB 19 KB	70ms 18ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v12/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 Requested by Host: terwebhome.com URL: https://terwebhome.com/bnac/adfs/portal/css/style8f57.css?id=0F9A4AAB2FC50B0189F436642AAAA301641D0685424D403AAAB8DD4459949820&rp=37d0e840-bdc3-e911-90f3-005056b6cfbb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://terwebhome.com/ Origin https://terwebhome.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Mon, 14 Feb 2022 21:35:21 GMT x-content-type-options nosniff age 492009 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18684 x-xss-protection 0 last-modified Tue, 07 Nov 2017 15:24:32 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Tue, 14 Feb 2023 21:35:21 GMT
GET H2	200	memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 fonts.gstatic.com/s/opensans/v27/	16 KB 16 KB	76ms 26ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v27/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://terwebhome.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Fri, 18 Feb 2022 09:52:04 GMT x-content-type-options nosniff age 188606 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16692 x-xss-protection 0 last-modified Thu, 28 Oct 2021 00:32:10 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Sat, 18 Feb 2023 09:52:04 GMT
GET H2	200	logo.png terwebhome.com/bnac/adfs/portal/images/bncr/	2 KB 2 KB	524ms 524ms	Image image/png	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://terwebhome.com/bnac/adfs/portal/images/bncr/logo.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash a11306b40a20c1d8d40e2746d1ee259b7556c00bcbc719e5e1065f02b7cc427c Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/ls19c5.html?B User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:17 GMT server Apache accept-ranges bytes etag "8ea-5d748ee31e5e6" content-length 2282 content-type image/png
GET H2	200	BNChat.png terwebhome.com/bnac/adfs/portal/images/bncr/	5 KB 6 KB	529ms 529ms	Image image/png	2607:f1c0:100f:f000::247 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://terwebhome.com/bnac/adfs/portal/images/bncr/BNChat.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2607:f1c0:100f:f000::247 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash 2e4ecfa7866203cf7f8f705c2c9fffa8cdeb3b11bea0cae4399f6bc974b07b6f Request headers Accept-Language de-DE,de;q=0.9 Referer https://terwebhome.com/bnac/adfs/ls19c5.html?B User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Sun, 20 Feb 2022 14:15:30 GMT last-modified Sat, 05 Feb 2022 17:45:16 GMT server Apache accept-ranges bytes etag "15c3-5d748ee2274c6" content-length 5571 content-type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Nacional (Banking)

75 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login string| Title string| LoginTitle string| urlBnMovilDefault string| urlIBDefault string| urlBNSDefault string| urlLostPassword string| urlLostPasswordBnMovil string| urlAffiliate string| urlAffiliateBnMovil string| urlApiToken string| urlCambioClave string| urlCambioClaveBNM string| indiceAuth string| indiceBNM string| indiceIB string| indiceBNS string| urlIBCDescarga string| rutabase string| urlLogo string| urlChatImg string| urlChat string| FooterSeccionLeftLogin string| FooterSeccionCenterLogin string| FooterSeccionRightLogin string| FooterSeccionLeftKeyBoard string| FooterSeccionCenterKeyBoard string| FooterSeccionRightKeyBoard string| FooterSeccionLeftOTP string| FooterSeccionCenterOTP string| FooterSeccionRightOTP string| Terms string| TermsUrl string| Privacy string| PrivacyUrl string| chatLink string| helpModal object| contentHtml undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| LoadTheme function| IsIB function| IsIBMovil function| IsBNS function| Signout function| ClearDomain function| CambioContrasena function| HideShowControl function| ElementExist function| WindowsRedirect function| ExistMFA function| DrawMFA function| ApplyCSSInput function| SetValueInput function| ControlFooter function| GetReturnUri function| GetParamts function| GetUsrName function| AppendLostPassword function| AppendCertificate function| AppendUserName function| InitControls function| LettersAndNumbers function| CertificateClick function| HelpClick function| ValidarErrorCert function| RestringirMoviles function| Close

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
terwebhome.com
2607:f1c0:100f:f000::247
2a00:1450:4001:803::2003
2a00:1450:4001:830::200a
0202c1e41ee2a905889b0f4140b2853a48703fae16087f17292cbb75c0385ac0
05410fbe1192a21525520421f6ddce4a065a94658a42146ae707a814926fa77d
183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd
2e4ecfa7866203cf7f8f705c2c9fffa8cdeb3b11bea0cae4399f6bc974b07b6f
48394ef740fabcd6aeb9c1de94df052c57348fc38da106e85828b45eef22580f
4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2
52691c4f90034c90a93cb95cf2c62e8bfee3f2da454e5ad4195b89db97dfe446
914299c17ae56658f1ac88efcae9e7c00081d4fb01cd366a424859c0f8245aaf
a11306b40a20c1d8d40e2746d1ee259b7556c00bcbc719e5e1065f02b7cc427c
a25ba1b157ec936592d10b603b83173744a279f8be236e4dc3f25aab9fbbd452
be73cab6c4c09afb515cd2c2b637cbfbd5d3ed3af0a8f6e153c6288684d5cdd3
cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0