wordpress-117342-0.cloudclusters.net
Open in
urlscan Pro
172.106.0.47
Malicious Activity!
Public Scan
URL:
https://wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/sending.php
Submission: On March 27 via automatic, source phishtank — Scanned from DE
Submission: On March 27 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 8 HTTP transactions.
The main IP is 172.106.0.47, located in
Dallas, United States and
belongs to AS40676, US.
The main domain is wordpress-117342-0.cloudclusters.net.
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on March 13th 2023. Valid for: a year.
This is the only time wordpress-117342-0.cloudclusters.net was scanned on urlscan.io!
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on March 13th 2023. Valid for: a year.
This is the only time wordpress-117342-0.cloudclusters.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 172.106.0.47 172.106.0.47 | 40676 (AS40676) (AS40676) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 8 | 3 |
6
172.106.0.47
(Dallas, United States)
ASN40676 (AS40676, US)
PTR: unassigned.psychz.net
ASN40676 (AS40676, US)
PTR: unassigned.psychz.net
| wordpress-117342-0.cloudclusters.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
cloudclusters.net
wordpress-117342-0.cloudclusters.net |
130 KB |
| 1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2339 |
25 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
899 B |
| 8 | 3 |
| Domain | Requested by | |
|---|---|---|
| 6 | wordpress-117342-0.cloudclusters.net |
wordpress-117342-0.cloudclusters.net
|
| 1 | stackpath.bootstrapcdn.com |
wordpress-117342-0.cloudclusters.net
|
| 1 | fonts.googleapis.com |
wordpress-117342-0.cloudclusters.net
|
| 8 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.cloudclusters.net RapidSSL TLS RSA CA G1 |
2023-03-13 - 2024-04-12 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/sending.php
Frame ID: FA1408B2FA48FB21FB3DC758FEF7C013
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
sending.php
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
1 KB 899 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.css
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/css/ |
58 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2.css
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/css/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
swiis-logo.png
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Swiss_new.svg.png
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mastercard.png
wordpress-117342-0.cloudclusters.net/wp-admin/wu/swi/img/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| countdown1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| wordpress-117342-0.cloudclusters.net/ | Name: PHPSESSID Value: mkc9dtdgjaodduubbad382sf0o |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=15724800; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
stackpath.bootstrapcdn.com
wordpress-117342-0.cloudclusters.net
172.106.0.47
2606:4700::6812:acf
2a00:1450:4001:813::200a
490ed4cd487facdb15cde073a96adbb1abf8912ddbfa22fd04a22c70a3326560
4b37dda748186d435029ff25309c6e634ab7b9d3a2f68a67448e6b569c2b3603
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
8bf139bc7ff8798dd787870da86ed07fa3315d60da06944176570a844424b277
9666485687d40c0ad90dff19837986a69bdb153428ccaf9914dc757c80eb407e
af1e6edc875a382b338bb25bd7c5c3f474a7f1b36212002a5896dd06f2186325
b1f854d3e2302e7d54f0b074f93d9f3ecd29a432d31b584333e9aafcceac912d
d0faa78922ead19875a28fa7f08998289c49fd1e2d0ba101a930aeb871252600