mgfs.es
Open in
urlscan Pro
185.176.9.32
Malicious Activity!
Public Scan
URL:
https://mgfs.es/insidei5/payment.php
Submission: On January 03 via manual from US — Scanned from DE
Submission: On January 03 via manual from US — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 20 HTTP transactions.
The main IP is 185.176.9.32, located in
Spain and
belongs to AXARNET-AS, ES.
The main domain is mgfs.es.
TLS certificate: Issued by R3 on November 30th 2021. Valid for: 3 months.
This is the only time mgfs.es was scanned on urlscan.io!
TLS certificate: Issued by R3 on November 30th 2021. Valid for: 3 months.
This is the only time mgfs.es was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Saudi Post (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 20 | 185.176.9.32 185.176.9.32 | 50926 (AXARNET-AS) (AXARNET-AS) | |
| 20 | 1 |
| Domain | Requested by | |
|---|---|---|
| 20 | mgfs.es |
mgfs.es
|
| 20 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| nortec-control.es R3 |
2021-11-30 - 2022-02-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mgfs.es/insidei5/payment.php
Frame ID: C28E1EBCDDE006A726C7D387A7CF7EA5
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Saudi Post - Simple & Trusted PaymentsDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
payment.php
mgfs.es/insidei5/ |
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.css
mgfs.es/insidei5/files/ |
140 KB 140 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
custom.css
mgfs.es/insidei5/files/ |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
mgfs.es/insidei5/files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
opensans.css
mgfs.es/insidei5/files/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
intlTelInput.css
mgfs.es/insidei5/build/css/ |
25 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loading_payment.gif
mgfs.es/insidei5/files/ |
11 KB 11 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
62617_1589791686.png
mgfs.es/insidei5/files/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
58482363cef1014c0b5e49c1.png
mgfs.es/insidei5/files/ |
80 KB 81 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
58482354cef1014c0b5e49c0.png
mgfs.es/insidei5/files/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
intlTelInput.js
mgfs.es/insidei5/build/js/ |
87 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cards.png
mgfs.es/insidei5/files/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cards1.png
mgfs.es/insidei5/files/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
trust-removebg-preview.png
mgfs.es/insidei5/files/ |
132 KB 132 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
express-checkout.png
mgfs.es/insidei5/files/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
mgfs.es/insidei5/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mem5YaGs126MiZpBA-UNirkOUuhp.woff2
mgfs.es/insidei5/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mem8YaGs126MiZpBA-UFVZ0b.woff2
mgfs.es/insidei5/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
flags.png
mgfs.es/insidei5/build/img/ |
69 KB 69 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utils.js
mgfs.es/insidei5/build/js/ |
248 KB 248 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Saudi Post (Government)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| $cc object| intlTelInputGlobals function| intlTelInput object| input object| errorMsg object| validMsg object| errorMap object| iti function| reset object| intlTelInputUtils1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| mgfs.es/ | Name: 33d8453b92cd2e72ede95328d0bfa4e2 Value: mfojti2dcg9t16pm01h80oi2b1 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mgfs.es
185.176.9.32
0434701192cc2fbfad32f66624b56676a8f416d3d94b259fa1eb1aaa60f6ad39
0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55
1027cddddbd69edd1f84013d8f86a9bafa415503b104e5e1fb003b70e5362e3b
16893732c1d56cff7778f74e569a833e345cc0f0fb0c3226380d7bcf414f51fe
186c8713eeaa90ab36660a4ae84f95e51aa3730dd3543c5ce18e776108a75b60
1a84a7da15921a85f7a8bd195b2eee6310715e1d9afa14bf75b2ce6fd7bfd52d
1bc2d5be2d753eaf2f6c0e91bdb24a95a9e20d19e1d76edcbf1a0bb13818643f
4f1bf1cc5ae0cd0c356965fd378e4e9c30268533949d65349c2d4315852627a0
5432b59decde382eae206cbe12dee7dd05ca9dcacb67f027a59b6a97a4379f07
60fc37f80886700e21b2f04c04bf880087a5a69d87a530e33d11e4eaea5ac67c
68b7e9302357f948488decd18e467a578a663902ec7b18773f680eca120e8cd9
750ac8d2bd2d0168a404a67733239d84262902c0dc2f231fff66182436a6e0c4
7b813b380d5e99d9d7ae94501469895cb3658f7b45d91ac6cfdfaa3665388112
a986c719cec3f724474437ef3a91f066d3e23c3543e667294d7a770df6ea296e
ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491
aeb6bc2ecd957d24b8bb08c9ebd6248835fbf6bbed3eeb1ac61d403eed193f56
e3ac3b8c4a13f2f0ae8c1ae1ecffa93f7f3528c05d440141f83cfea940132d6d