www.goupwind.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.goupwind.com/TW/log/
Effective URL:
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Submission: On August 24 via manual (August 24th 2022, 7:12:34 am UTC) from IN — Scanned from NL

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.goupwind.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 29th 2022. Valid for: a year.

This is the only time www.goupwind.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 8	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
9	4

8 2a06:98c1:3121::3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.goupwind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	goupwind.com 2 redirects www.goupwind.com	714 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 219	4 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	929 B
9	3

	Domain	Requested by
8	www.goupwind.com	2 redirects www.goupwind.com
2	cdnjs.cloudflare.com	www.goupwind.com
1	fonts.googleapis.com	www.goupwind.com
9	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-29` - `2023-05-29`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Frame ID: 2952D76E17226E6A5137F82DBB870F20
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FedEx 支付FedEx

Page URL History Show full URLs

https://www.goupwind.com/TW/log/ HTTP 302
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/index.php HTTP 302
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

779 kB
Transfer

1756 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.goupwind.com/TW/log/ HTTP 302
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/index.php HTTP 302
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request payment Show response
www.goupwind.com/TW/log/49c46fe4e0ac2e1/
Redirect Chain

https://www.goupwind.com/TW/log/
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/index.php
https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment

1 MB
625 KB

74ms
73ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9453ca56c2afd04523ff7b871472b21d7575ca9b66e112d1bff0e79ffd2108b0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 73fa47a6faeb8fc8-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 07:12:29 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sqrMe5FTuyhabRgUnSBWqBThPq2JoQH9yUrcWCpgaCeq3sIvuhNBac6braFNDd%2BKeKpweoMkYaMOP2WS%2FzWtOH4Mmb2Urp%2F%2BTw%2FCHwtvcM8MlnK6OFB9BEx7qadZ8vzWmg3Wdi%2Be0fMk%2B9JnF%2Fad"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-cache-status: BYPASS

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 73fa47a59f0691ed-FRA
content-type: text/html; charset=UTF-8
date: Wed, 24 Aug 2022 07:12:29 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: payment#session_id=7Hkw2RmvRaQG7SdLeQuWizVZJgBZ0FXYd8k6Pxsxx84vR76VNrIWQuMqAdgrJ4fM2pIHN15aZZvGWssAJ0nplZGL3M3CG8fyoO61&token=12uQn0DFj4f9hvl71W0EPsbOyz2cwUHnM14ZSyv1tB1BWcyNZoiFHjj5Jc75WFjzxepfDL7WcYnY1MCQ1KlzUvvt
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5S9xBGgFW7a%2BZgIWMIrL7oL%2FF9SStYF%2B9xfu00Lehk2VDvtHauZ4Dnfg2JOvLxfdanlDrRC%2B6m1qXJDq3B8AXatIDBKxK5pfIfMsb0rs1nQxGo%2FFA081Wc4WAyAD6DVA1%2FmH%2B8psZ%2BzHz8bbcqPo"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-cache-status: BYPASS

GET
H2 200 reset.min.css
cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/ 773 B
1 KB 70ms
26ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css

Requested by

Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2972414
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 333
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:13:23 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03f23-305"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c8rKlwsOqlNrS8z1Z5EYU788VYQd7I0R3ahorPmz7NW4iEub8ihLOHeXuxWV0ggEJHMy84lmIFTm5HOLojYewEB3nCHLjCB9UPN2avYHYH7xWKcRCQre62LOMwA8w4mTt07P%2BdgZcAc8f7FcOPz3MjuA"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 73fa47a7dfe0bba7-FRA
expires: Mon, 14 Aug 2023 07:12:29 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
929 B 79ms
31ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Alex+Brush

Requested by

Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b10f6ea159e79e3c8a18ee6e68e515d7610ed323caa353f97cb8c9576ac6a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Aug 2022 06:44:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Aug 2022 07:12:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Aug 2022 07:12:29 GMT

GET
H3 200 load.png
www.goupwind.com/TW/log/assets/img/ 36 KB
37 KB 62ms
61ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.goupwind.com/TW/log/assets/img/load.png
Requested by: Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eddbce7ed1e7ba4c47431051f4d42c858b92dc3ea39f71ce87587e1c37701ede

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status: BYPASS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37050
last-modified: Thu, 18 Aug 2022 06:02:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G6K73bIbspdjSP4W9BXL1NjAbPI4X6dlpC3yIYNMuOaxCzp3nI3SHu9B2A0Tf0XXyAzcdYgr5dcawBthrUm4UkK7w%2B45lnaJxotPtNSGBipekveu9InRyjT%2FUsKDld48e%2Fo8joXOnwgiClzs33dj"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 73fa47a81bd18fc8-FRA
expires: max-age=2592000, public

GET
H3 200 jquery-3.1.0.min.js Show response
www.goupwind.com/TW/log/assets/js/ 84 KB
31 KB 66ms
65ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.goupwind.com/TW/log/assets/js/jquery-3.1.0.min.js
Requested by: Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 18 Aug 2022 06:02:47 GMT
server: cloudflare
x-cache-status: BYPASS
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tQfuy5EXmJKCmcPH7xINsf4HpQO3cxhEPKo9QstqQ%2BZ%2BL32UQYv0ULKHGANDk%2FgWbABUxzzg6eSA3bK9HnxzsPGimCImwW5Mnqfkb4HMnfFHdFDXMjOoVTAlvqBshTshMo2gBSALD16jWX5T%2FIqm"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 73fa47a84bfe8fc8-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: max-age=2592000, public

GET
H3 200 jquery.maskedinput.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ 10 KB
3 KB 65ms
41ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/jquery.maskedinput.js

Requested by

Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2205937
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2306
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-284d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KmAHVEDUbInl3pRo1oJIB665qStjKTIm7mOkebmZfrCOI3pHg8yTuubGUOq%2FsMaD7LiGy3%2BtnFon4bmgxGYRYm2Kea%2F0a2XVUAqb4iOUVCNHyiQCd9IEyYNsFsXv4fM%2FKQYiTZMnuky3IxLVIXX%2Bbs8s"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 73fa47a86c2b5c6e-FRA
expires: Mon, 14 Aug 2023 07:12:29 GMT

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Request headers

Referer
Origin: https://www.goupwind.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 18 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99f7cd905d160e4bf4408195b22a893a45661a8855a0841e207d5bafe7411d90

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f46e13ab4b86da0407a98685e6cdf678aa732e29335fe0f441c2b816ddf0e46

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 box.png
www.goupwind.com/TW/log/assets/img/ 10 KB
11 KB 57ms
57ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.goupwind.com/TW/log/assets/img/box.png
Requested by: Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a34b399aad5f80683ee24cf477070a53ff2e9ee1850c9210635ea275508bf82c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status: BYPASS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10640
last-modified: Thu, 18 Aug 2022 06:02:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jObZMCXfipe%2F%2B5qT%2BFJqhY0LdmRN4WJNJe46dKW%2BuGKJFGre9kPE4kDCdpPMKq04joHvVJvYZyv1luyW9lNNViu%2FlnBpmR3UlFdAkXjRJX2BhJ2mAKL9tLuvMbcz0FkRi0B0zkJRyGaQ7BFj2K0P"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 73fa47a8cc7e8fc8-FRA
expires: max-age=2592000, public

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8c8e4cee94204596733d23753ae8cebddfc2157e56eae975f0ae7127b795a03d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 145 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f995102ff390103e11ee9a5923acdb93bde061b2c832c1b4aeb9c5145f83db1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 cccc.png
www.goupwind.com/TW/log/assets/img/ 7 KB
7 KB 48ms
47ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.goupwind.com/TW/log/assets/img/cccc.png
Requested by: Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76dc0f524b990f1a1dcb4e8fe32c0deeb5a4cd2402877250e5f29936e643ef0d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status: BYPASS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6932
last-modified: Thu, 18 Aug 2022 06:02:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z6YvYD3trsXesQe7YJu%2FbSofG4ZBKKfGZ8oOp3quohAqI%2BnoaurtL5sCSEipSbosByQvWGxvLuPIrQhiv7fw4KdIQFjQcfAX4JlUGn11gB4%2F3tEKL8zRzJrksg9t8kGpkCp6%2FKZqnzQ4Hr4jUBdF"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 73fa47a8fca28fc8-FRA
expires: max-age=2592000, public

GET
H3 200 crypt.png
www.goupwind.com/TW/log/assets/img/ 952 B
1 KB 59ms
59ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.goupwind.com/TW/log/assets/img/crypt.png
Requested by: Host: www.goupwind.com
URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff2f95a3fef0f95cbc0f6134cfd34b2926bbfdf283272ca51b5668395ff90857

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 07:12:29 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status: BYPASS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 952
last-modified: Thu, 18 Aug 2022 06:02:47 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yzjW%2BPgHdqFCswdVfZjrsG%2BJSqrCwehnGFlq1tgqs1cb4edBQhND26jDpge%2FdUJZv8mTXLjBr82jwrSOrIe49EiPN64m%2FPiUf%2BE95nM7L%2Fs1DG6zJdkV5CPSYAWadTP4SNuNzpsvCKwvkh%2BVa%2BSy"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 73fa47a8fca48fc8-FRA
expires: max-age=2592000, public

GET
DATA 200
OK truncated
/ 55 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56b7e8ca4092fc7f4ce541932df6a5d30143414550046ab65387c5f4c134ad21

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ed127284f8f4caaee4c7dceeaab3657e6528f9f84fc47734b58ba099c95fa42

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 886 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2b8655490b3625bd3d1a1605a29ccfbbe2b54619e0b7beac72fee4716adbc89f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4101aa02d68cd3d07bf6340516c410b5fe6311214576622f7c4da72e26544e18

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 14 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d96fafac7d9ca03d4c9b9bcbc5bd5770d21fa72ba09fe5b388dad06c44b4e5a5

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Request headers

Referer
Origin: https://www.goupwind.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230

Request headers

Referer
Origin: https://www.goupwind.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Request headers

Referer
Origin: https://www.goupwind.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef9f59e5e4c1ffaca22c603a007cebde14637e04326972169bd6a39d480267b1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.goupwind.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1ladanaeunmgnffmh8pbck8q92

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.goupwind.com/TW/log/49c46fe4e0ac2e1/payment#session_id=7Hkw2RmvRaQG7SdLeQuWizVZJgBZ0FXYd8k6Pxsxx84vR76VNrIWQuMqAdgrJ4fM2pIHN15aZZvGWssAJ0nplZGL3M3CG8fyoO61&token=12uQn0DFj4f9hvl71W0EPsbOyz2cwUHnM14ZSyv1tB1BWcyNZoiFHjj5Jc75WFjzxepfDL7WcYnY1MCQ1KlzUvvt(Line 183) Message: The Content Security Policy 'default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:;' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
www.goupwind.com
2606:4700::6811:180e
2a00:1450:4001:82a::200a
2a06:98c1:3121::3
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230
2b8655490b3625bd3d1a1605a29ccfbbe2b54619e0b7beac72fee4716adbc89f
2ed127284f8f4caaee4c7dceeaab3657e6528f9f84fc47734b58ba099c95fa42
2f995102ff390103e11ee9a5923acdb93bde061b2c832c1b4aeb9c5145f83db1
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
4101aa02d68cd3d07bf6340516c410b5fe6311214576622f7c4da72e26544e18
56b7e8ca4092fc7f4ce541932df6a5d30143414550046ab65387c5f4c134ad21
6f46e13ab4b86da0407a98685e6cdf678aa732e29335fe0f441c2b816ddf0e46
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
76dc0f524b990f1a1dcb4e8fe32c0deeb5a4cd2402877250e5f29936e643ef0d
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
8c8e4cee94204596733d23753ae8cebddfc2157e56eae975f0ae7127b795a03d
9453ca56c2afd04523ff7b871472b21d7575ca9b66e112d1bff0e79ffd2108b0
99f7cd905d160e4bf4408195b22a893a45661a8855a0841e207d5bafe7411d90
a34b399aad5f80683ee24cf477070a53ff2e9ee1850c9210635ea275508bf82c
b10f6ea159e79e3c8a18ee6e68e515d7610ed323caa353f97cb8c9576ac6a3ba
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d96fafac7d9ca03d4c9b9bcbc5bd5770d21fa72ba09fe5b388dad06c44b4e5a5
eddbce7ed1e7ba4c47431051f4d42c858b92dc3ea39f71ce87587e1c37701ede
ef9f59e5e4c1ffaca22c603a007cebde14637e04326972169bd6a39d480267b1
ff2f95a3fef0f95cbc0f6134cfd34b2926bbfdf283272ca51b5668395ff90857

www.goupwind.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

779 kBTransfer

1756 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.goupwind.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

779 kB
Transfer

1756 kB
Size

1
Cookies

9 HTTP transactions
14 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!