nordicwalkingcadiz.com Open in urlscan Pro
54.37.30.125 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/
Effective URL:
https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/
Submission: On September 09 via api (September 9th 2024, 10:49:08 pm UTC) from BE — Scanned from FR

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 54.37.30.125, located in France and belongs to OVH, FR. The main domain is nordicwalkingcadiz.com.
TLS certificate: Issued by R11 on August 14th 2024. Valid for: 3 months.

This is the only time nordicwalkingcadiz.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address		AS Autonomous System
9	54.37.30.125 54.37.30.125		16276 (OVH) (OVH)
10	2

9 54.37.30.125 (France)

ASN16276 (OVH, FR)
PTR: server.servidorurano.com

nordicwalkingcadiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	nordicwalkingcadiz.com nordicwalkingcadiz.com	71 KB
0	googleapis.com Failed fonts.googleapis.com Failed
10	2

	Domain	Requested by
9	nordicwalkingcadiz.com	nordicwalkingcadiz.com
0	fonts.googleapis.com Failed	nordicwalkingcadiz.com
10	2

This site contains no links.

Subject Issuer	Validity	Valid
nordicwalkingcadiz.es R11	`2024-08-14` - `2024-11-12`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/
Frame ID: D6972286252007B558ECA6D52B6AFC52
Requests: 6 HTTP requests in this frame

Frame: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php
Frame ID: 01F1B6529C9FB2F7A94CDF7004814796
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ HTTP 307
https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

71 kB
Transfer

76 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ HTTP 307
https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Redirect Chain http://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/	8 KB 3 KB	97ms 52ms	Document text/html	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / PHP/8.2.14 Resource Hash `82d74685e6978cd6514b8af87033cdac6dfcc8a99d4c4acaf12c890cf96cdff1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 09 Sep 2024 22:49:01 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/8.2.14 Redirect headers Location https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Non-Authoritative-Reason HttpsUpgrades
GET		css fonts.googleapis.com/	0 0

GET H/1.1	200 OK	logo.png nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/	2 KB 2 KB	20ms 20ms	Image image/png	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/logo.png Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `c4bb6d764f00d10e2f3448ce1d9eca1e1ffa8238a30e41aba201655a41e959c0` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:30 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 2224 Content-Type image/png
GET H/1.1	200 OK	signin.png nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/	9 KB 9 KB	41ms 20ms	Image image/png	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/signin.png Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `cccba13b939908d83a7ec394ee263e225d0098574100fa2534877400d8562684` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:31 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 9500 Content-Type image/png
GET H/1.1	200 OK	MarketSans.ttf nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/	54 KB 54 KB	23ms 22ms	Font font/ttf	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/MarketSans.ttf Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `f97997c252780639d228d05ccc0430d60c7ae22b0d7f70cd420bca3b245f95a9` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Origin https://nordicwalkingcadiz.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:30 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 55340 Content-Type font/ttf
GET H/1.1	200 OK	counter1.php Show response nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/ Frame 01F1	231 B 353 B	51ms 50ms	Document text/html	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / PHP/8.2.14 Resource Hash `1e215fd1ca449627bab7affb0b8ced181b89d3eb717c394bc834438450cd5cbb` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 09 Sep 2024 22:49:01 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/8.2.14
GET H/1.1	200 OK	6.GIF nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/ Frame 01F1	142 B 351 B	20ms 19ms	Image image/gif	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/6.GIF Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `52668877e284856ff8e44449e3a7de6176f5dddb69f5f0ba43bc621a3bf6ba3a` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:33 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 142 Content-Type image/gif
GET H/1.1	200 OK	0.GIF nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/ Frame 01F1	142 B 351 B	20ms 19ms	Image image/gif	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/0.GIF Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `b76e8a7e4b19259132e729c22182fddcbdc677ec93cd37d9a5268f247e5a3f4e` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:32 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 142 Content-Type image/gif
GET H/1.1	200 OK	8.GIF nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/ Frame 01F1	131 B 340 B	37ms 18ms	Image image/gif	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/digits/1/8.GIF Requested by Host: nordicwalkingcadiz.com URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `2d40e869573441aabce201b90423b04e070c4b077927998ecffb42e487d54eff` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/counter/counter1.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Last-Modified Sun, 21 Jan 2024 16:54:33 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 131 Content-Type image/gif
GET H/1.1	200 OK	favicon.ico nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/	1 KB 471 B	19ms 19ms	Other image/x-icon	54.37.30.125 OVH
General Check archive.org Show headers Download Go to Full URL https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 54.37.30.125 , France, ASN16276 (OVH, FR), Reverse DNS server.servidorurano.com Software nginx / Resource Hash `21e336fd55001d8b9ff40b1a5763ffccb6c1e1e4d386a9e398a8da9c26d1cf5e` Request headers Referer https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Mon, 09 Sep 2024 22:49:01 GMT Content-Encoding gzip Last-Modified Sun, 21 Jan 2024 16:54:30 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/x-icon Connection keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=MarketSans

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Message: [DOM] Found 2 elements with non-unique id #nextBtn: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://nordicwalkingcadiz.com/ws-eBaiSAPI.allSi-gn-In2Fmy2FhomeFCurrentPage3DMyeBaIAllSelling26ssPageName/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
nordicwalkingcadiz.com
fonts.googleapis.com
54.37.30.125
1e215fd1ca449627bab7affb0b8ced181b89d3eb717c394bc834438450cd5cbb
21e336fd55001d8b9ff40b1a5763ffccb6c1e1e4d386a9e398a8da9c26d1cf5e
2d40e869573441aabce201b90423b04e070c4b077927998ecffb42e487d54eff
52668877e284856ff8e44449e3a7de6176f5dddb69f5f0ba43bc621a3bf6ba3a
82d74685e6978cd6514b8af87033cdac6dfcc8a99d4c4acaf12c890cf96cdff1
b76e8a7e4b19259132e729c22182fddcbdc677ec93cd37d9a5268f247e5a3f4e
c4bb6d764f00d10e2f3448ce1d9eca1e1ffa8238a30e41aba201655a41e959c0
cccba13b939908d83a7ec394ee263e225d0098574100fa2534877400d8562684
f97997c252780639d228d05ccc0430d60c7ae22b0d7f70cd420bca3b245f95a9

nordicwalkingcadiz.com Open in urlscan Pro 54.37.30.125 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

71 kBTransfer

76 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

nordicwalkingcadiz.com Open in urlscan Pro
54.37.30.125 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

71 kB
Transfer

76 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!