lgem.be Open in urlscan Pro
45.153.152.168 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Submission: On September 24 via api (September 24th 2022, 11:25:21 pm UTC) from IE — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 45.153.152.168, located in Belgium and belongs to AS-UNIXSOLUTIONS Unix-Solutions Network, BE. The main domain is lgem.be.
TLS certificate: Issued by R3 on August 21st 2022. Valid for: 3 months.

This is the only time lgem.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address		AS Autonomous System
9	45.153.152.168 45.153.152.168		39923 (AS-UNIXSO...) (AS-UNIXSOLUTIONS Unix-Solutions Network)
1	2a04:4e42:200... 2a04:4e42:200::485		54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:acf		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:1734		13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

9 45.153.152.168 (Belgium)

ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE)
PTR: vps.christophevereecken.be

lgem.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

pro.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	lgem.be lgem.be	89 KB
2	fontawesome.com pro.fontawesome.com — Cisco Umbrella Rank: 4968	102 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2290	7 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 392	9 KB
13	4

	Domain	Requested by
9	lgem.be	lgem.be
2	pro.fontawesome.com	lgem.be pro.fontawesome.com
1	stackpath.bootstrapcdn.com	lgem.be
1	cdn.jsdelivr.net	lgem.be
13	4

This site contains no links.

Subject Issuer	Validity	Valid
lgem.be R3	`2022-08-21` - `2022-11-19`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-21` - `2023-04-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Frame ID: 2F3312C436FAA8EE661C9E3CFE115222
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ebay

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

208 kB
Transfer

683 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/ 4 KB
2 KB 302ms
227ms Document
text/html 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: c7e7e58a33c5a0d97b31a89bbc903045f2b8142a5a5fbeb29c07e2fcf50da037

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1518
content-type: text/html; charset=UTF-8
date: Sat, 24 Sep 2022 23:25:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache/2
vary: Accept-Encoding,User-Agent

GET
H2 200 bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 64 KB
9 KB 56ms
17ms Stylesheet
text/css 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Requested by

Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 5272712
x-jsd-version: 1.5.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9183
etag: W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
x-served-by: cache-fra19142-FRA, cache-hhn4080-HHN
x-jsd-version-type: version
date: Sat, 24 Sep 2022 23:25:17 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 63ms
28ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617
age: 20958184
cdn-cachedat: 2021-06-08 14:35:32
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 8e03a0f40ac23c08b1fbc5b05ccb27fd
cdn-requestcountrycode: US
cf-ray: 74ff4746cb2e920b-FRA
cdn-cache: HIT
cdn-requestpullsuccess: True

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.10.0/css/ 153 KB
29 KB 80ms
42ms Stylesheet
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec

Request headers

Referer: https://lgem.be/
Origin: https://lgem.be
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 21599
x-amz-request-id: PB75K0G16RENANZ4
x-amz-id-2: p5zNmpGGJKU1sDUeo5AXh2Q2HGquxofpJjDHPxItL39DLFsacFlvCwuASED5Al2C/vaUGus4m8E=
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
server: cloudflare
etag: W/"aa1272633e7e552395d147a499bad186"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 74ff4746cffbbb56-FRA

GET
H2 200 bootstrap.css
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/css/ 188 KB
24 KB 42ms
41ms Stylesheet
text/css 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/css/bootstrap.css
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
etag: "2f1f7-5e95fa43228d6-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 24828

GET
H2 200 paragway.css
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/css/ 10 KB
2 KB 28ms
27ms Stylesheet
text/css 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/css/paragway.css
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 987353d8aeba44cf56cc3143ddae8baabc5ef6483c532b5db59049ecb4b5a434

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
etag: "2636-5e95fa4322cbe-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 1573

GET
H2 200 ebay_logo.png
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/ 3 KB
4 KB 44ms
43ms Image
image/png 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/ebay_logo.png
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 51084be6d3cd0bb9d6019bfbd4d3c683fb06c4ec58f468791d85753a3c7fa5d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
accept-ranges: bytes
etag: "df1-5e95fa4329a1e"
content-length: 3569
content-type: image/png

GET
H2 200 fb.png
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/ 1 KB
1 KB 60ms
59ms Image
image/png 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/fb.png
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
accept-ranges: bytes
etag: "4b1-5e95fa4329a1e"
content-length: 1201
content-type: image/png

GET
H2 200 gg.png
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/ 7 KB
7 KB 60ms
59ms Image
image/png 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/gg.png
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
accept-ranges: bytes
etag: "1ae6-5e95fa4329e06"
content-length: 6886
content-type: image/png

GET
H2 200 logo_foter.png
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/ 3 KB
3 KB 60ms
59ms Image
image/png 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/photos/logo_foter.png
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: 202d124cfbdf21fb5f5d09094c9b9ab6523960595e009145765e24bc4050971c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
accept-ranges: bytes
etag: "d5b-5e95fa432a1ee"
content-length: 3419
content-type: image/png

GET
H2 200 jquery-3.5.1.min.js Show response
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/js/ 87 KB
30 KB 68ms
67ms Script
application/javascript 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/js/jquery-3.5.1.min.js
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
etag: "15d84-5e95fa4327ade-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 30910

GET
H2 200 bootstrap.min.js Show response
lgem.be/wp-content/plugins/eikdxvm/tikhrbi/js/ 58 KB
16 KB 44ms
43ms Script
application/javascript 45.153.152.168
AS-UNIXSOLUTIONS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/js/bootstrap.min.js
Requested by: Host: lgem.be
URL: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.153.152.168 , Belgium, ASN39923 (AS-UNIXSOLUTIONS Unix-Solutions Network, BE),
Reverse DNS: vps.christophevereecken.be
Software: Apache/2 /
Resource Hash: fe11b1647190e7b7d72e9f8d0eeb0566c668fcf1b6d41a76fa15d85796bac3e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lgem.be/wp-content/plugins/eikdxvm/tikhrbi/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 22:24:29 GMT
server: Apache/2
etag: "e955-5e95fa4326756-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 15935

GET
H2 200 fa-brands-400.woff2
pro.fontawesome.com/releases/v5.10.0/webfonts/ 73 KB
73 KB 26ms
26ms Font
font/woff2 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.10.0/webfonts/fa-brands-400.woff2
Requested by: Host: pro.fontawesome.com
URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03a811b7e81f930c938141ba6c0a439f59acfe1a3c4a6768b7901741a32b459e

Request headers

Referer: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Origin: https://lgem.be
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 23:25:17 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 21599
cf-ray: 74ff47472876bb56-FRA
content-length: 74668
x-amz-id-2: /Mn0SN7oaZCzgiL4a3lzCbtd3w/npH8W4S1Pyz885MGaPLWo1FwUj/Z5AdyCje3beSYj+TUpyM4=
last-modified: Mon, 28 Jun 2021 16:56:06 GMT
server: cloudflare
etag: "2de2a530b2c689d8dc9548acfcf670a1"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: PB77D7120M614WJN
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
content-type: font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| uidEvent object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lgem.be/	1969-12-31 23:59:59	Name: PHPSESSID Value: r4qe9rhovpq9shq5j4uinmt6ju

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
lgem.be
pro.fontawesome.com
stackpath.bootstrapcdn.com
2606:4700::6812:1734
2606:4700::6812:acf
2a04:4e42:200::485
45.153.152.168
03a811b7e81f930c938141ba6c0a439f59acfe1a3c4a6768b7901741a32b459e
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
202d124cfbdf21fb5f5d09094c9b9ab6523960595e009145765e24bc4050971c
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
51084be6d3cd0bb9d6019bfbd4d3c683fb06c4ec58f468791d85753a3c7fa5d2
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf
56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
987353d8aeba44cf56cc3143ddae8baabc5ef6483c532b5db59049ecb4b5a434
c7e7e58a33c5a0d97b31a89bbc903045f2b8142a5a5fbeb29c07e2fcf50da037
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fe11b1647190e7b7d72e9f8d0eeb0566c668fcf1b6d41a76fa15d85796bac3e8