masterfoods.mn Open in urlscan Pro
43.231.112.120  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 8475657rgdgdgvet46473t362gddvd3t.php Show response masterfoods.mn/jali/Auto%20file/	7 KB 3 KB	1100ms 245ms	Document text/html	43.231.112.120 ITOOLS-AS iTools JSC
General Check archive.org Show headers Download Go to Full URL http://masterfoods.mn/jali/Auto%20file/8475657rgdgdgvet46473t362gddvd3t.php Protocol HTTP/1.1 Server 43.231.112.120 Ulan Bator, Mongolia, ASN63962 (ITOOLS-AS iTools JSC, MN), Reverse DNS linuxhost20.itools.mn Software nginx / PHP/7.2.34 Resource Hash 0b3d554f72c0d0c28c80c9ef6862df2655fa09247a1c9ba111fabcd6f87b34ca Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 01 Dec 2023 04:12:25 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/7.2.34
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	50ms 13ms	Script application/javascript	151.101.66.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: masterfoods.mn URL: http://masterfoods.mn/jali/Auto%20file/8475657rgdgdgvet46473t362gddvd3t.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers accept-language en-AU,en;q=0.9 Referer http://masterfoods.mn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Fri, 01 Dec 2023 04:12:26 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 6603333 x-cache HIT, HIT content-length 30125 x-served-by cache-lga21971-LGA, cache-bne12529-BNE last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1701403946.059920,VS0,VE0 etag W/"28feccc0-15283" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 233, 517970
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	25ms 12ms	Script application/javascript	104.18.11.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: masterfoods.mn URL: http://masterfoods.mn/jali/Auto%20file/8475657rgdgdgvet46473t362gddvd3t.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer http://masterfoods.mn/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Fri, 01 Dec 2023 04:12:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 852 age 1927887 cdn-cachedat 11/06/2022 20:25:53 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag W/"67176c242e1bdc20603c878dee836df3" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 9a5433488a7ff8494ccd27f0421ec1e9 timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 82e87de6ac0155bd-SYD cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
masterfoods.mn
stackpath.bootstrapcdn.com
104.18.11.207
151.101.66.137
43.231.112.120
0b3d554f72c0d0c28c80c9ef6862df2655fa09247a1c9ba111fabcd6f87b34ca
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de