sagepathriskscore.com Open in urlscan Pro
162.241.120.145 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sagepathriskscore.com/yigo/2.php
Submission: On March 31 via automatic, source openphish (March 31st 2022, 1:12:08 pm UTC) — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 18 HTTP transactions. The main IP is 162.241.120.145, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is sagepathriskscore.com.
TLS certificate: Issued by R3 on March 30th 2022. Valid for: 3 months.

This is the only time sagepathriskscore.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of Guam (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	162.241.120.145 162.241.120.145	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
8	192.0.54.4 192.0.54.4	62659 (Q2HOLDINGS) (Q2HOLDINGS)
18	2

10 162.241.120.145 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-120-145.unifiedlayer.com

sagepathriskscore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 192.0.54.4 (United States)

ASN62659 (Q2HOLDINGS, US)

cdn1.onlineaccess1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	sagepathriskscore.com sagepathriskscore.com	697 KB
8	onlineaccess1.com cdn1.onlineaccess1.com — Cisco Umbrella Rank: 20064	316 KB
18	2

	Domain	Requested by
10	sagepathriskscore.com	sagepathriskscore.com
8	cdn1.onlineaccess1.com	sagepathriskscore.com cdn1.onlineaccess1.com
18	2

This site contains no links.

Subject Issuer	Validity	Valid
cpanel.sagepathriskscore.com R3	`2022-03-30` - `2022-06-28`	3 months	crt.sh
onlineaccess1.com Cloudflare Inc ECC CA-3	`2021-08-13` - `2022-08-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sagepathriskscore.com/yigo/2.php
Frame ID: 47EF21088CA4ADBB178EB13BCD16DAAA
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bank of Guam

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1012 kB
Transfer

2103 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 2.php Show response
sagepathriskscore.com/yigo/ 148 KB
148 KB 449ms
171ms Document
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: 695cb97f691e4d32e9a463f5fb65419e81e5945261a1d9e0f37f2968baae286a

Request headers

Accept-Language: de-DE,de;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 31 Mar 2022 13:11:59 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK app.css
sagepathriskscore.com/yigo/hatagana_css/ 96 KB
96 KB 376ms
125ms Stylesheet
text/css 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/app.css
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: ccd04e53f94698141af52777aa617347c0c469fb1f8bc2e645dc949e35b9a823

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/yigo/2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:11:59 GMT
Last-Modified: Sat, 01 Aug 2020 14:22:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 97963

GET
H/1.1 200
OK highcontrast-faeb96f0648bcaf3054ef11d5696ee43.css
sagepathriskscore.com/yigo/hatagana_css/ 226 KB
226 KB 376ms
126ms Stylesheet
text/css 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/highcontrast-faeb96f0648bcaf3054ef11d5696ee43.css
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: cd4104550cdaf752439dcf64adf4fe5d878e22644ede5bd2a9ec77f79298fc28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/yigo/2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:11:59 GMT
Last-Modified: Sat, 01 Aug 2020 14:22:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 231421

GET
H/1.1 200
OK theme-q2-9855f9ef95bcf00d6f666b0cc50aa040.css
sagepathriskscore.com/yigo/hatagana_css/ 218 KB
218 KB 378ms
126ms Stylesheet
text/css 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/theme-q2-9855f9ef95bcf00d6f666b0cc50aa040.css
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: 5655d187eb008122e9b5f3580073af19af7861ed4eb4e8c1a03d0995494ed040

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/yigo/2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:11:59 GMT
Last-Modified: Sat, 01 Aug 2020 14:22:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 223157

GET
H/1.1 200
OK add-engine-meta.html Show response
sagepathriskscore.com/yigo/hatagana_css/ 315 B
557 B 380ms
125ms Script
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/add-engine-meta.html
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:11:59 GMT
Last-Modified: Sat, 01 Aug 2020 14:22:44 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 315

GET
H/1.1 200
OK tecton-2f616577dbd335c1ce3db6dd61e6741d.css
sagepathriskscore.com/yigo/hatagana_css/ 8 KB
8 KB 378ms
126ms Stylesheet
text/css 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash: 7b1da2ac308fda50fdcbf077f6159c359da942337720939920f566ab50c30c4b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:11:59 GMT
Last-Modified: Sat, 01 Aug 2020 14:22:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7963

GET
H2 200 theme-q2-blessed2-f7e7288f6bd7494fa78475abef2b0081.css
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/ 276 KB
36 KB 69ms
39ms Stylesheet
text/css 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/theme-q2-blessed2-f7e7288f6bd7494fa78475abef2b0081.css

Requested by

Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/theme-q2-9855f9ef95bcf00d6f666b0cc50aa040.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d96939ebeb04d872b7c6629a89cb118518fc92493d74370f13a08f126b995a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 29564
timing-allow-origin: *
last-modified: Tue, 26 May 2020 18:46:44 GMT
server: cloudflare
etag: W/"5ecd6414-450e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 6f49558fba5268f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 theme-q2-blessed1-bee7118c47e721e96342d09c25061464.css
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/ 345 KB
50 KB 71ms
41ms Stylesheet
text/css 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/theme-q2-blessed1-bee7118c47e721e96342d09c25061464.css

Requested by

Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/theme-q2-9855f9ef95bcf00d6f666b0cc50aa040.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8f5b0754ce0df3151dedb17206fff87e055a8812a9d53131c7e8269e84c6344

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:01 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 29564
timing-allow-origin: *
last-modified: Tue, 26 May 2020 18:46:44 GMT
server: cloudflare
etag: W/"5ecd6414-5658a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 6f49558fba5568f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/ 283 KB
35 KB 30ms
29ms Stylesheet
text/css 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css

Requested by

Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/highcontrast-faeb96f0648bcaf3054ef11d5696ee43.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9110e7d03dc1ae2fbcde0e68011e66d5e27ef7875e70f63d9adb62586776b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 29565
timing-allow-origin: *
last-modified: Tue, 26 May 2020 18:46:44 GMT
server: cloudflare
etag: W/"5ecd6414-46a6c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 6f495596cf4968f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 highcontrast-blessed1-abab3b6a22d43874bd58d60c8cca78fa.css
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/ 361 KB
50 KB 31ms
31ms Stylesheet
text/css 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed1-abab3b6a22d43874bd58d60c8cca78fa.css

Requested by

Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/highcontrast-faeb96f0648bcaf3054ef11d5696ee43.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c48fdd8bd5e74afb09a8a7e591a4364eb13c4f95ce35d072a5e53ac088ce1108

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 29565
timing-allow-origin: *
last-modified: Tue, 26 May 2020 18:46:44 GMT
server: cloudflare
etag: W/"5ecd6414-5a273"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 6f495596cf4b68f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 desktop-background_new-a5e799f7e01a793d62ed53bdae04ee58.jpg
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/a03435df7dd835231632abd8763daa41/assets/images/ 87 KB
87 KB 27ms
27ms Image
image/jpeg 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/a03435df7dd835231632abd8763daa41/assets/images/desktop-background_new-a5e799f7e01a793d62ed53bdae04ee58.jpg

Requested by

Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/2.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

807d5ce4bf491d415c3cf4dc7460fde05db16f8b0adb8c19ea3f2fa0ad580152

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sagepathriskscore.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 29565
content-length: 88919
timing-allow-origin: *
last-modified: Fri, 04 Mar 2022 21:00:55 GMT
server: cloudflare
etag: "62227e07-15b57"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6f495597481c68f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo_large-1f7a0261597679ec179a2cddec2e7af4.png
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/images/logos/ 8 KB
8 KB 26ms
26ms Image
image/png 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/images/logos/logo_large-1f7a0261597679ec179a2cddec2e7af4.png

Requested by

Host: cdn1.onlineaccess1.com
URL: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/theme-q2-blessed2-f7e7288f6bd7494fa78475abef2b0081.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d97dbcef4f8ecefe7e7643453602a882c803ea7746302caadd0f4074135d9583

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/theme-q2-blessed2-f7e7288f6bd7494fa78475abef2b0081.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 29565
timing-allow-origin: *
last-modified: Mon, 14 Feb 2022 20:12:23 GMT
server: cloudflare
etag: W/"620ab7a7-1efa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 6f495597482668f8-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 404
Not Found OpenSans-Regular.woff
sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/ 0
0 126ms
125ms Font
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Regular.woff
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:12:01 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Semibold.woff
sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/ 0
0 126ms
126ms Font
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Semibold.woff
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:12:01 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Regular.ttf
sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/ 0
0 125ms
125ms Font
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Regular.ttf
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:12:01 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found OpenSans-Semibold.ttf
sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/ 0
0 125ms
125ms Font
text/html 162.241.120.145
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Semibold.ttf
Requested by: Host: sagepathriskscore.com
URL: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.120.145 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-120-145.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://sagepathriskscore.com/yigo/hatagana_css/tecton-2f616577dbd335c1ce3db6dd61e6741d.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Thu, 31 Mar 2022 13:12:01 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 OpenSans-Regular.woff
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/fonts/OpenSans/ 24 KB
25 KB 49ms
32ms Font
font/woff 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/fonts/OpenSans/OpenSans-Regular.woff

Requested by

Host: cdn1.onlineaccess1.com
URL: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95915582ecc56aa27829e7bd118b423f09cba0856ce517fdcd82e4e05726e6e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Referer: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 33960
content-length: 24872
timing-allow-origin: *
last-modified: Wed, 23 Oct 2019 23:11:36 GMT
server: cloudflare
etag: "5db0de28-6128"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6f49559908f49a2f-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 OpenSans-Semibold.woff
cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/fonts/OpenSans/ 24 KB
24 KB 37ms
37ms Font
font/woff 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/fonts/OpenSans/OpenSans-Semibold.woff

Requested by

Host: cdn1.onlineaccess1.com
URL: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e335db7f8ef9f87be9dcc9c56f071d27a7b5bbd9111cfcdabd6babe5eb4e968

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Referer: https://cdn1.onlineaccess1.com/cdn/depot/3274_01/503/784d317f36f837a08b130b733b72dde1/assets/highcontrast-blessed2-884b0f8f98c674f9e067b22932e17b55.css
Origin: https://sagepathriskscore.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Thu, 31 Mar 2022 13:12:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 33960
content-length: 24952
timing-allow-origin: *
last-modified: Wed, 23 Oct 2019 23:11:37 GMT
server: cloudflare
etag: "5db0de29-6178"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6f495599191f9a2f-FRA
access-control-allow-headers: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of Guam (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.onlineaccess1.com/	1969-12-31 23:59:59	Name: __cfruid Value: 9e7f44beff25a8486b3b741d529304eed7b9e3b3-1648732321

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Regular.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Semibold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://sagepathriskscore.com/yigo/hatagana_css/fonts/OpenSans/OpenSans-Semibold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn1.onlineaccess1.com
sagepathriskscore.com
162.241.120.145
192.0.54.4
1d96939ebeb04d872b7c6629a89cb118518fc92493d74370f13a08f126b995a7
5655d187eb008122e9b5f3580073af19af7861ed4eb4e8c1a03d0995494ed040
5e335db7f8ef9f87be9dcc9c56f071d27a7b5bbd9111cfcdabd6babe5eb4e968
695cb97f691e4d32e9a463f5fb65419e81e5945261a1d9e0f37f2968baae286a
7b1da2ac308fda50fdcbf077f6159c359da942337720939920f566ab50c30c4b
807d5ce4bf491d415c3cf4dc7460fde05db16f8b0adb8c19ea3f2fa0ad580152
95915582ecc56aa27829e7bd118b423f09cba0856ce517fdcd82e4e05726e6e6
a8f5b0754ce0df3151dedb17206fff87e055a8812a9d53131c7e8269e84c6344
c48fdd8bd5e74afb09a8a7e591a4364eb13c4f95ce35d072a5e53ac088ce1108
ccd04e53f94698141af52777aa617347c0c469fb1f8bc2e645dc949e35b9a823
cd4104550cdaf752439dcf64adf4fe5d878e22644ede5bd2a9ec77f79298fc28
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d97dbcef4f8ecefe7e7643453602a882c803ea7746302caadd0f4074135d9583
f9110e7d03dc1ae2fbcde0e68011e66d5e27ef7875e70f63d9adb62586776b34

sagepathriskscore.com Open in urlscan Pro 162.241.120.145 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

1012 kBTransfer

2103 kBSize

1 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

sagepathriskscore.com Open in urlscan Pro
162.241.120.145 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1012 kB
Transfer

2103 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!