urlscan.io logo urlscan.io
SecurityTrails logo

workinglit.com Open in urlscan Pro
198.44.14.24  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://workinglit.com/discover%20scam%20page
Effective URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Submission: On December 03 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 36 HTTP transactions. The main IP is 198.44.14.24, located in Seattle, United States and belongs to HOSTWINDS - Hostwinds LLC., US. The main domain is workinglit.com.
This is the only time workinglit.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Discover (Financial)

Domain & IP information

IP Address AS Autonomous System
1 10 198.44.14.24 54290 (HOSTWINDS)
2 24 23.67.136.187 20940 (AKAMAI-ASN1)
1 1 208.81.233.33 13902 (XAXIS-AS2)
1 2.19.40.200 20940 (AKAMAI-ASN1)
1 2 172.217.23.134 15169 (GOOGLE)
3 162.252.74.5 11054 (LIVEPERSON)
36 5
10    198.44.14.24 (Seattle, United States)

ASN54290 (HOSTWINDS - Hostwinds LLC., US)
PTR: hwsrv-648327.hostwindsdns.com
workinglit.com
24    23.67.136.187 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-136-187.deploy.static.akamaitechnologies.com
www.discovercard.com
www.discover.com
1    208.81.233.33 (United States)

ASN13902 (XAXIS-AS2 - xaxis, inc., US)
b3.mookie1.com
1    2.19.40.200 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-40-200.deploy.static.akamaitechnologies.com
cdn-akamai.mookie1.com
2    172.217.23.134 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s18-in-f134.1e100.net
fls.doubleclick.net
3    162.252.74.5 (United States)

ASN11054 (LIVEPERSON - LivePerson, Inc., US)
sales.liveperson.net
Apex Domain
Subdomains		 Transfer
22 discovercard.com
www.discovercard.com
86 KB
10 workinglit.com
workinglit.com
31 KB
3 liveperson.net
sales.liveperson.net
20 KB
2 doubleclick.net
fls.doubleclick.net
526 B
2 mookie1.com
b3.mookie1.com
cdn-akamai.mookie1.com
724 B
2 discover.com
www.discover.com
827 B
36 6
Domain Requested by
22 www.discovercard.com 2 redirects workinglit.com
10 workinglit.com 1 redirects workinglit.com
3 sales.liveperson.net www.discovercard.com
workinglit.com
2 fls.doubleclick.net 1 redirects workinglit.com
2 www.discover.com workinglit.com
1 cdn-akamai.mookie1.com workinglit.com
1 b3.mookie1.com 1 redirects
36 7
Subject Issuer Validity Valid
www.discover.com
DigiCert SHA2 Extended Validation Server CA		 2019-08-26 -
2021-03-19		 2 years crt.sh
cdn-akamai.mookie1.com
DigiCert SHA2 Secure Server CA		 2019-01-17 -
2020-01-18		 a year crt.sh
*.doubleclick.net
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Frame ID: D85266A63BECF7359370723D6A8BB927
Requests: 36 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://workinglit.com/discover%20scam%20page HTTP 301
    http://workinglit.com/discover%20scam%20page/ Page URL
  2. http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

36
Requests

67 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

5
IPs

3
Countries

137 kB
Transfer

319 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://workinglit.com/discover%20scam%20page HTTP 301
    http://workinglit.com/discover%20scam%20page/ Page URL
  2. http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://workinglit.com/discover%20scam%20page HTTP 301
  • http://workinglit.com/discover%20scam%20page/
Request Chain 8
  • http://www.discovercard.com/images/login-off.gif HTTP 301
  • https://www.discover.com/images/login-off.gif
Request Chain 11
  • http://www.discovercard.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg HTTP 301
  • https://www.discover.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg
Request Chain 16
  • https://b3.mookie1.com/1/TRACK_Discover/Discover/Retargeting_NX_Secure@Bottom3 HTTP 302
  • https://cdn-akamai.mookie1.com/html/empty.gif
Request Chain 20
  • https://fls.doubleclick.net/activityj;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249 HTTP 302
  • https://fls.doubleclick.net/activityj;dc_pre=CNrourGpmuYCFQQo4AodUNQPPw;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249

36 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
workinglit.com/discover%20scam%20page/
Redirect Chain
  • http://workinglit.com/discover%20scam%20page
  • http://workinglit.com/discover%20scam%20page/
330 B
537 B 		Document
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/discover%20scam%20page/
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash
beefdcaf4d0ab3b166870a48f945292f1be33544bfaad4090d3eb63407c29742

Request headers

Host
workinglit.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Tue, 03 Dec 2019 20:31:52 GMT
Server
Apache
Location
http://workinglit.com/discover%20scam%20page/
Content-Length
253
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Primary Request login.php
workinglit.com/discover%20scam%20page/ 		30 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash
707901cbf9d60ec135fda17d26421e13df515893dc4bb9b50595c280628b8e50

Request headers

Host
workinglit.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://workinglit.com/discover%20scam%20page/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://workinglit.com/discover%20scam%20page/

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
ac-global.css
www.discovercard.com/css/optimized/ 		55 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.discovercard.com/css/optimized/ac-global.css
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6b6125cb52babd1e719c9f1a2f39c19f094b4cf8563d6594d6f62c533b5dec3f
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 15 May 2019 05:35:43 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
vary
Accept-Encoding
content-length
9216
x-xss-protection
1; mode=block
loginlogout-global.css
www.discovercard.com/css/optimized/ 		112 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.discovercard.com/css/optimized/loginlogout-global.css
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
804b6281b14de8ea3beeac5bfc18dee2a4b4ad797c420d30fd2ff267a2542d1b
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 18 Nov 2014 11:50:57 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
vary
Accept-Encoding
content-length
16391
x-xss-protection
1; mode=block
ac-global-screen.css
www.discovercard.com/css/optimized/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.discovercard.com/css/optimized/ac-global-screen.css
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
866290055b5670010dac9c7101be7edcaeef61cdd98a805ef3e9b467fa156e97
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:56:52 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
vary
Accept-Encoding
content-length
2874
x-xss-protection
1; mode=block
loginlogout-top.js
www.discovercard.com/scripts/optimized/ 		59 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.discovercard.com/scripts/optimized/loginlogout-top.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c29a78f3d8dc28314e247d994b1ea33951435d55a3a7d464169504710b87849a
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 11 Jul 2017 05:50:39 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
vary
Accept-Encoding
content-length
22707
x-xss-protection
1; mode=block
logo-discover-financial-services.gif
www.discovercard.com/registration/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/registration/images/logo-discover-financial-services.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
40da5d11bdfffe97bd52a7c20a03fdebafa7a0a0756fe65f4859298e4ba54370
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 19:07:17 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
2395
x-xss-protection
1; mode=block
btn-search-gray-off.gif
www.discovercard.com/search/images/ 		907 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/search/images/btn-search-gray-off.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
23463987921a39610e206599214b319a6fe88e106e695fecdcf6556603bb0b7d
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 19:07:20 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
907
x-xss-protection
1; mode=block
icon-lock.gif
www.discovercard.com/images/ 		72 B
327 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/icon-lock.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
180fabdab945223febb42a698e458f019cbd321ea79fd886b00523d9f7a17222
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 17:56:13 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
72
x-xss-protection
1; mode=block
login-off.gif
www.discover.com/images/
Redirect Chain
  • http://www.discovercard.com/images/login-off.gif
  • https://www.discover.com/images/login-off.gif
703 B
827 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discover.com/images/login-off.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
897bbcc31b17dd6e483ca3ccbd457e260e474bcecd823d1d04916567e2525568

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Tue, 03 Dec 2019 20:31:53 GMT
cache-control
public, must-revalidate
last-modified
Fri, 27 Oct 2017 19:09:12 GMT
accept-ranges
bytes
content-length
703
content-type
image/gif

Redirect headers

Location
https://www.discover.com/images/login-off.gif
Date
Tue, 03 Dec 2019 20:31:53 GMT
Connection
keep-alive
Content-Length
253
Content-Type
text/html; charset=iso-8859-1
question-popup-off.gif
www.discovercard.com/images/ 		147 B
403 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/question-popup-off.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9338be77b0bb0f06e446925ecc0d36d2a9e83a29f024e00023060db99c951bff
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Thu, 29 May 2008 04:00:00 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
147
x-xss-protection
1; mode=block
mbox.js
workinglit.com/scripts/vendors/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/vendors/mbox.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
credit-score-tracker-ac-placement.jpg
www.discover.com/loginlogout/app/images/
Redirect Chain
  • http://www.discovercard.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg
  • https://www.discover.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discover.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Location
https://www.discover.com/loginlogout/app/images/credit-score-tracker-ac-placement.jpg
Date
Tue, 03 Dec 2019 20:31:53 GMT
X-N
S
Connection
keep-alive
Content-Length
293
Content-Type
text/html; charset=iso-8859-1
btn-learn-more-lg.png
www.discovercard.com/achome/images/promos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/achome/images/promos/btn-learn-more-lg.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2ff1afa3c4aa3531b49cb623cac70a8ff3cd1a961dfcf8dfd2fb7cb19da04cd6
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Wed, 20 Oct 2010 04:58:48 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
1524
x-xss-protection
1; mode=block
btn-popup-close.gif
workinglit.com/registration/images/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://workinglit.com/registration/images/btn-popup-close.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
dc-global-bottom.js
workinglit.com/scripts/optimized/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/optimized/dc-global-bottom.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
vendor-dc-global-bottom.js
workinglit.com/scripts/optimized/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/optimized/vendor-dc-global-bottom.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
empty.gif
cdn-akamai.mookie1.com/html/
Redirect Chain
  • https://b3.mookie1.com/1/TRACK_Discover/Discover/Retargeting_NX_Secure@Bottom3
  • https://cdn-akamai.mookie1.com/html/empty.gif?
43 B
562 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-akamai.mookie1.com/html/empty.gif?
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.40.200 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-40-200.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:54 GMT
Last-Modified
Fri, 21 Aug 2015 16:09:40 GMT
Server
AkamaiNetStorage
ETag
"fc94fb0c3ed8a8f909dbc7630a0987ff:1440173380"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
43
Expires
Wed, 04 Dec 2019 20:31:54 GMT

Redirect headers

Location
https://cdn-akamai.mookie1.com/html/empty.gif?
Pragma
no-cache
Cache-Control
no-cache
Connection
close
c_sprite.png
www.discovercard.com/images/optimized/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/optimized/c_sprite.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f80cd677405fca2aa43cb47cb4165fff83dedd3b0546c8d032c92c877e7be42e
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/loginlogout-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 19:07:01 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
8748
x-xss-protection
1; mode=block
c_sprite1.png
www.discovercard.com/images/optimized/ 		553 B
789 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/optimized/c_sprite1.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
824ee2b3eaae3448987f4217fe35b22c2e479316ccaad58475403ae57236db12
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/loginlogout-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:08:37 GMT
date
Tue, 03 Dec 2019 20:31:53 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
553
x-xss-protection
1; mode=block
icon-question-popup-gray.gif
www.discovercard.com/images/ 		147 B
403 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/icon-question-popup-gray.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9338be77b0bb0f06e446925ecc0d36d2a9e83a29f024e00023060db99c951bff
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/loginlogout-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 17:56:13 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
147
x-xss-protection
1; mode=block
activityj;dc_pre=CNrourGpmuYCFQQo4AodUNQPPw;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249
fls.doubleclick.net/
Redirect Chain
  • https://fls.doubleclick.net/activityj;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249?
  • https://fls.doubleclick.net/activityj;dc_pre=CNrourGpmuYCFQQo4AodUNQPPw;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249?
0
278 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fls.doubleclick.net/activityj;dc_pre=CNrourGpmuYCFQQo4AodUNQPPw;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249?
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.134 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s18-in-f134.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 03 Dec 2019 20:31:53 GMT
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private, max-age=0
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 03 Dec 2019 20:31:53 GMT

Redirect headers

pragma
no-cache
date
Tue, 03 Dec 2019 20:31:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://fls.doubleclick.net/activityj;dc_pre=CNrourGpmuYCFQQo4AodUNQPPw;src=2033010;type=cashbbou;cat=loginpag;ord=1;num=6367860512231.249?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mbox.js
workinglit.com/scripts/vendors/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/vendors/mbox.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
bullet-blue.gif
www.discovercard.com/images/ 		68 B
323 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/bullet-blue.gif
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fb2c359f2c3d053c6aa6c2e291faff3004f83ec078378c549f73ceffefce9fa1
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/loginlogout-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 04 Sep 2009 13:05:00 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
status
200
cache-control
public, must-revalidate
accept-ranges
bytes
content-length
68
x-xss-protection
1; mode=block
loginlogout_btn_sprite.png
www.discovercard.com/images/optimized/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/optimized/loginlogout_btn_sprite.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
97fbbb53c53c6d5b9af70e2b43942185f236114c0952e2d92dffc000ea8ff162
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/loginlogout-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Thu, 06 Jan 2011 06:14:35 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
6026
x-xss-protection
1; mode=block
dc-global-bottom.js
workinglit.com/scripts/optimized/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/optimized/dc-global-bottom.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:54 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
vendor-dc-global-bottom.js
workinglit.com/scripts/optimized/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://workinglit.com/scripts/optimized/vendor-dc-global-bottom.js
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
HTTP/1.1
Server
198.44.14.24 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS
hwsrv-648327.hostwindsdns.com
Software
Apache /
Resource Hash

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:54 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
bg-social-icons.png
www.discovercard.com/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/bg-social-icons.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f539319c027c53d3af91987b58bdf031ebc20603c62f9782f7acc67e291806a
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:57:10 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
4076
x-xss-protection
1; mode=block
bg-footer.png
www.discovercard.com/images/ 		250 B
485 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/bg-footer.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c775671608781223d3c6355f2655c2eada5d811dd4412c9d4c054b5b657828ae
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:08:35 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
250
x-xss-protection
1; mode=block
icon-footer-down-arrow.png
www.discovercard.com/images/ 		208 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/icon-footer-down-arrow.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7cdc24c5739df6dec49b9e53c538399945d8eccc986ff84735317ca5185c169a
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 19:07:00 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
208
x-xss-protection
1; mode=block
logo-it-pays-to-discover.png
www.discovercard.com/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/logo-it-pays-to-discover.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b6bf543ad3b1547b54b9608d058aef4fd0412745d2517079a94da339900d8ea0
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:57:10 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
5035
x-xss-protection
1; mode=block
bg-footer-btm.png
www.discovercard.com/images/ 		806 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/bg-footer-btm.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
88c115e368b88caf347417c33f4fbe321450fa8f1f667f0d933b937568a6cb4b
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:57:10 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
806
x-xss-protection
1; mode=block
footer-line.png
www.discovercard.com/images/ 		126 B
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.discovercard.com/images/footer-line.png
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.136.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-136-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9b53f818b1aa9c91a5456738caedfe89c562996d9ed4deea9e0df50b718148b6
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.discovercard.com/css/optimized/ac-global.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
x-content-type-options
nosniff
last-modified
Fri, 27 Oct 2017 18:08:36 GMT
date
Tue, 03 Dec 2019 20:31:54 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
accept-ranges
bytes
content-length
126
x-xss-protection
1; mode=block
mTag.js
sales.liveperson.net/hcp/html/ 		17 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://sales.liveperson.net/hcp/html/mTag.js?site=33238650
Requested by
Host: www.discovercard.com
URL: https://www.discovercard.com/scripts/optimized/loginlogout-top.js
Protocol
HTTP/1.1
Server
162.252.74.5 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
WS /
Resource Hash
7af71bf299d55a276ed7126683da9bdc8534684cca0044fa34252a9f18ebc917

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 03 Dec 2019 20:31:53 GMT
Last-Modified
Wed, 16 Sep 2015 19:55:44 GMT
Server
WS
ETag
"0a0eacb9f0d01:0"
Access-Control-Allow-Methods
GET, POST, PATCH
P3P
CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Content-Type
application/javascript
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
Content-Length
17753
/
sales.liveperson.net/hc/33238650/ 		108 B
905 B 		Script
General
Check archive.org
Download Go to
Full URL
http://sales.liveperson.net/hc/33238650/?&site=33238650&cmd=mTagKnockPage&lpCallId=328539045735-265226129907&protV=20&lpjson=1&id=1211199404&javaSupport=false&visitorStatus=INSITE_STATUS
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/
Protocol
HTTP/1.1
Server
162.252.74.5 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
WS /
Resource Hash
746672d46eb43ac0080e2e57b6958d515bfe66ac5b85c74cc67c2309980bd976

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 03 Dec 2019 20:31:54 GMT
Last-Modified
Tue, 03 Dec 2019 20:31:54 GMT
Server
WS
Access-Control-Allow-Methods
GET, POST, PATCH
P3P
CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Content-Type
application/x-javascript
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
Content-Length
108
Expires
Wed, 31 Dec 1969 23:59:59 GMT
/
sales.liveperson.net/hc/33238650/ 		108 B
905 B 		Script
General
Check archive.org
Download Go to
Full URL
http://sales.liveperson.net/hc/33238650/?&site=33238650&cmd=mTagKnockPage&lpCallId=402073197562-317539507643&protV=20&lpjson=1&id=1211199404&javaSupport=false&visitorStatus=INSITE_STATUS
Requested by
Host: workinglit.com
URL: http://workinglit.com/discover%20scam%20page/
Protocol
HTTP/1.1
Server
162.252.74.5 , United States, ASN11054 (LIVEPERSON - LivePerson, Inc., US),
Reverse DNS
Software
WS /
Resource Hash
2176644afc4222680a599fbc99915aa92cb55353ffa9797be7ced412694fec3e

Request headers

Referer
http://workinglit.com/discover%20scam%20page/login.php?section=cardmembersvcs/loginlogout/app/signin
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 03 Dec 2019 20:32:03 GMT
Last-Modified
Tue, 03 Dec 2019 20:32:04 GMT
Server
WS
Access-Control-Allow-Methods
GET, POST, PATCH
P3P
CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
Cache-Control
no-store
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Content-Type
application/x-javascript
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
Content-Length
108
Expires
Wed, 31 Dec 1969 23:59:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Discover (Financial)

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| expDays object| exp function| GetCookie function| SetCookie function| DeleteCookie function| getCookieVal function| checkUserID function| setValues string| SEP string| PAIR string| DEV number| ver function| goto function| flashfix function| activeXDetect function| extractVersions function| stripIllegalChars function| stripFullPath function| fingerprint_browser function| fingerprint_display function| fingerprint_software function| fingerprint_timezone function| fingerprint_language function| fingerprint_java function| fingerprint_cookie function| form_add_data function| form_add_fingerprint function| asyncpost_fingerprints function| post_fingerprints function| post_fingerprintsnoencode function| URLencode function| add_deviceprint function| Hashtable string| pageUrl object| logurl object| lpMTagConfig string| lpUnit string| lpLanguage string| dfsedskey function| addLoadEvent function| findPos function| clearSearch function| initNavDropdown function| getElementsByClassName number| currentPane object| overlayArray function| initOverlays function| showOverlay function| lpAddMonitorTag function| lpSendData function| lpSendDataPage function| lpAddVars function| getCookieValue string| ua boolean| opera boolean| ie boolean| iemac number| moz string| os function| jQuery function| $ number| flashinstalled number| flashversion string| MSDetect undefined| d undefined| out string| t boolean| isFirst string| axel number| a string| bName number| bVer string| popURL boolean| suppressMboxes object| focusControl string| turl string| urlIdx string| fpString string| andString object| today number| year0 object| navRoot object| node function| hcArrayStorage function| lpRequest function| lpConnectionLibrary object| lpJSLib object| lpConnLib function| lpMonitorTag object| lpLazy object| lpMTag function| lpJSLibrary object| lpOpenPlatformNS object| lpMTagDebug

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b3.mookie1.com
cdn-akamai.mookie1.com
fls.doubleclick.net
sales.liveperson.net
workinglit.com
www.discover.com
www.discovercard.com
162.252.74.5
172.217.23.134
198.44.14.24
2.19.40.200
208.81.233.33
23.67.136.187
180fabdab945223febb42a698e458f019cbd321ea79fd886b00523d9f7a17222
2176644afc4222680a599fbc99915aa92cb55353ffa9797be7ced412694fec3e
23463987921a39610e206599214b319a6fe88e106e695fecdcf6556603bb0b7d
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ff1afa3c4aa3531b49cb623cac70a8ff3cd1a961dfcf8dfd2fb7cb19da04cd6
40da5d11bdfffe97bd52a7c20a03fdebafa7a0a0756fe65f4859298e4ba54370
4f539319c027c53d3af91987b58bdf031ebc20603c62f9782f7acc67e291806a
6b6125cb52babd1e719c9f1a2f39c19f094b4cf8563d6594d6f62c533b5dec3f
707901cbf9d60ec135fda17d26421e13df515893dc4bb9b50595c280628b8e50
746672d46eb43ac0080e2e57b6958d515bfe66ac5b85c74cc67c2309980bd976
7af71bf299d55a276ed7126683da9bdc8534684cca0044fa34252a9f18ebc917
7cdc24c5739df6dec49b9e53c538399945d8eccc986ff84735317ca5185c169a
804b6281b14de8ea3beeac5bfc18dee2a4b4ad797c420d30fd2ff267a2542d1b
824ee2b3eaae3448987f4217fe35b22c2e479316ccaad58475403ae57236db12
866290055b5670010dac9c7101be7edcaeef61cdd98a805ef3e9b467fa156e97
88c115e368b88caf347417c33f4fbe321450fa8f1f667f0d933b937568a6cb4b
897bbcc31b17dd6e483ca3ccbd457e260e474bcecd823d1d04916567e2525568
9338be77b0bb0f06e446925ecc0d36d2a9e83a29f024e00023060db99c951bff
97fbbb53c53c6d5b9af70e2b43942185f236114c0952e2d92dffc000ea8ff162
9b53f818b1aa9c91a5456738caedfe89c562996d9ed4deea9e0df50b718148b6
b6bf543ad3b1547b54b9608d058aef4fd0412745d2517079a94da339900d8ea0
beefdcaf4d0ab3b166870a48f945292f1be33544bfaad4090d3eb63407c29742
c29a78f3d8dc28314e247d994b1ea33951435d55a3a7d464169504710b87849a
c775671608781223d3c6355f2655c2eada5d811dd4412c9d4c054b5b657828ae
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f80cd677405fca2aa43cb47cb4165fff83dedd3b0546c8d032c92c877e7be42e
fb2c359f2c3d053c6aa6c2e291faff3004f83ec078378c549f73ceffefce9fa1