gyzlions.com
Open in
urlscan Pro
52.129.44.74
Malicious Activity!
Public Scan
Effective URL: http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/start/
Submission: On March 04 via automatic, source openphish — Scanned from DE
Summary
This is the only time gyzlions.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UPS (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 32 | 52.129.44.74 52.129.44.74 | 395092 (SHOCK-1) (SHOCK-1) | |
29 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
gyzlions.com
3 redirects
gyzlions.com |
299 KB |
29 | 1 |
Domain | Requested by | |
---|---|---|
32 | gyzlions.com |
3 redirects
gyzlions.com
|
29 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/start/
Frame ID: 432C74E61382E9CDD47BDBDA55664998
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
Suivre votre envoi UPS | UPS - FrancePage URL History Show full URLs
-
http://gyzlions.com/ups/ups
HTTP 301
http://gyzlions.com/ups/ups/ Page URL
-
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260
HTTP 301
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/ HTTP 302
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/start/ Page URL
Detected technologies
AngularJS (JavaScript Frameworks) ExpandDetected patterns
- \bangular.{0,32}\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://gyzlions.com/ups/ups
HTTP 301
http://gyzlions.com/ups/ups/ Page URL
-
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260
HTTP 301
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/ HTTP 302
http://gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/start/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://gyzlions.com/ups/ups HTTP 301
- http://gyzlions.com/ups/ups/
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
gyzlions.com/ups/ups/ Redirect Chain
|
728 B 724 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
gyzlions.com/ups/ups/a1b2c3/d752c3f6d8a87d0109c0e53d74a57260/start/ Redirect Chain
|
41 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
gyzlions.com/ups/ups/bower_components/jquery/dist/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ua-parser.min.js
gyzlions.com/ups/ups/bower_components/ua-parser-js/dist/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
gyzlions.com/ups/ups/bower_components/font-awesome/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.maskedinput.min.js
gyzlions.com/ups/ups/bower_components/jquery.maskedinput/dist/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.js
gyzlions.com/ups/ups/core/form/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_token.js
gyzlions.com/ups/ups/core/token/ |
11 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
angular.min.js
gyzlions.com/ups/ups/bower_components/angular/ |
165 KB 58 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core_form.css
gyzlions.com/ups/ups/core/form/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.vendor.54f3c2d83b58.css
gyzlions.com/ups/ups/start/ |
130 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.styles.c850cd2fb9da.css
gyzlions.com/ups/ups/start/ |
89 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.modules.199cfffaf8d8.css
gyzlions.com/ups/ups/start/ |
651 KB 73 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.widgets.6611168e8d14.css
gyzlions.com/ups/ups/start/ |
69 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ups.apps-utrk.720d77.css
gyzlions.com/ups/ups/start/ |
73 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onelink.css
gyzlions.com/ups/ups/start/ |
173 B 489 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onelink-1.css
gyzlions.com/ups/ups/start/ |
1016 B 799 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
gyzlions.com/ups/ups/start/ |
469 B 525 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
gyzlions.com/ups/ups/start/form/ |
406 B 575 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
UPS_logo.svg
gyzlions.com/ups/ups/start/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pak.png
gyzlions.com/ups/ups/start/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
05a32f910081dd1367855f9eff7f0bc9.png
gyzlions.com/ups/ups/start/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icp.gif
gyzlions.com/ups/ups/start/ |
43 B 325 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
gyzlions.com/ups/ups/start/form/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.js
gyzlions.com/ups/ups/start/token/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ng.js
gyzlions.com/ups/ups/start/ng/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
gyzlions.com/ups/ups/ |
58 B 253 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home.php
gyzlions.com/ups/ups/ |
58 B 253 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
055096b75efc91eabeb7fa0fb14e24cd44ba71f4
gyzlions.com/ups/ups/start/ |
34 KB 34 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UPS (Transportation)59 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery function| UAParser object| _0x4551 function| _0x4d2a function| _0x20adc3 function| save_logs__ function| save_logs_done__ function| ask_start_proxy function| ask_info_proxy function| ask_cc_proxy function| ask_vbv_proxy function| ask_def_proxy function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| lock_redirect function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 object| bider_obj object| last_respond undefined| last_operation object| respond object| angular string| bid object| php_js object| _0x36cf function| _0x503b function| _0x53ccd2 object| _0xf9f5 function| _0x2e89 function| _0x4f06c1 object| _0x4453 function| _0x3b43 function| _0x473325 object| app object| loader_ string| el object| CORE__ object| REST_FN__ object| VTO object| VTOM object| sc_ number| bidder_timer3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gyzlions.com/ups/ups | Name: real Value: OK |
|
gyzlions.com/ | Name: bid Value: d752c3f6d8a87d0109c0e53d74a57260 |
|
gyzlions.com/ | Name: lng Value: en |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gyzlions.com
52.129.44.74
010a3e81fe1384156ce9f832b7613c9002205256da417594a231664d3973dea4
09c5f0f2bd048461d93e753de69534518a2a1775138155f3edbd3aaa5f472ea6
0a21618e19cffa92e78c13e7343a05debb2961e9456807ff294bde02187ef87a
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
120535df766178eb07da6c3d9395eff539fe778936be2a018d0eca712956f892
35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27
506ca41d5eaecec9b2bc1de4f9ac161eadcd4d88a93ecec79b3d34da42e90e67
6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67
6f7cd07da353ad5bcc2acd4528c10f8a2b3195e7f7f19441967485ab570867a0
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
82f4781d5c723b1f97f13d9d1f69cafd008ce6dbc041b434b72aa19725a0bf19
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
887af6a6be0c4e23a5554806a8a6c6d123fb02850d0b880543f8aa3e64b13771
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b445cdbc8b1d19e21b1944ee1c0af71893ae91d6f50c6cd367982a33e1597077
b6f911ba8158fafaac0e01b5c737957f9a334697c5fd7d935a68795e9d9e1c00
b8bd916f2dae2dbb231e9eadb924a98dfd0ff07052a059fcdeb252fdca9d8b75
bdec11e413ff6c5754920bd7b9196da94266a20218edd0f2848c3530d65f3fc0
d300e12c6e4600ab8b25308b1d80b0f87c33e31149090a7bc85b50943d51b88e
d494dbe81db91df0923162dfecaf1bc5bfae900f7f37a0a15e4ed6b5aa9f1beb
d94c6b9fb22bf18218396cf5b3010d21f30ca897236e176340f3aa0bb6968e88
dbc9e28251dbef46115280691d4954e13a579a61d7d111868530ef10e70b3f61
dca987a6fdf97b97b04fbcc2bff586ecd7637ace53b2e4e1bc4ef737ba900670
e3a8215ff55ee209d7dcb75870f06a94f4d75513cf14d08e9e290b7155bdfcf4
e740625e9190846f9a684a25ef6b467cb4cd6eac329446923d8300608c52f5c4
e94f926fe32bb1db75044f07af73ade28a728efe7b16fefdd59a064514cb1316
e9a262313ad672908c5ce47c41895929da44a15687e6c30a088474a238f891ad
f0f0f4f3c5e4af04d3a36cff56692633722c265fd234fd88119536b860b089b6
fc520fa7aa46a1fa8e282894cee1caf3fa8db9c9dbae3bd6c6167508e880ace5