mamago.ch Open in urlscan Pro
83.166.138.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Submission Tags: @ipnigh
Submission: On March 22 via api (March 22nd 2020, 2:26:25 pm UTC) from GB

Summary HTTP 32 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 9 IPs in 5 countries across 6 domains to perform 32 HTTP transactions. The main IP is 83.166.138.106, located in Switzerland and belongs to INFOMANIAK-AS, CH. The main domain is mamago.ch.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 22nd 2020. Valid for: 3 months.

This is the only time mamago.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Leumi (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 3	83.166.138.106 83.166.138.106	29222 (INFOMANIA...) (INFOMANIAK-AS)
5	199.203.28.165 199.203.28.165	1680 (NV-ASN CE...) (NV-ASN CELLCOM ltd.)
11	199.203.32.11 199.203.32.11	1680 (NV-ASN CE...) (NV-ASN CELLCOM ltd.)
2	199.203.32.123 199.203.32.123	1680 (NV-ASN CE...) (NV-ASN CELLCOM ltd.)
1	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1	52.16.205.165 52.16.205.165	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
32	9

3 83.166.138.106 (Switzerland) 1 redirects

ASN29222 (INFOMANIAK-AS, CH)
PTR: h2web122.infomaniak.ch

mamago.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.mamago.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 199.203.28.165 (Israel)

ASN1680 (NV-ASN CELLCOM ltd., IL)

hb2.bankleumi.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 199.203.32.11 (Tel Aviv, Israel)

ASN1680 (NV-ASN CELLCOM ltd., IL)
PTR: odap-199-203-32-11.bb.netvision.net.il

cache.bankleumi.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.203.32.123 (Tel Aviv, Israel)

ASN1680 (NV-ASN CELLCOM ltd., IL)
PTR: odap-199-203-32-123.bb.netvision.net.il

accessibilitys.bankleumi.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.16.205.165 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-205-165.eu-west-1.compute.amazonaws.com

10stat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	bankleumi.co.il hb2.bankleumi.co.il cache.bankleumi.co.il accessibilitys.bankleumi.co.il	172 KB
3	mamago.ch 1 redirects mamago.ch www.mamago.ch	8 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	doubleclick.net stats.g.doubleclick.net	136 B
1	10stat.com 10stat.com	250 B
1	googletagmanager.com www.googletagmanager.com	25 KB
32	6

	Domain	Requested by
11	cache.bankleumi.co.il	mamago.ch
5	hb2.bankleumi.co.il	mamago.ch
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	accessibilitys.bankleumi.co.il	mamago.ch accessibilitys.bankleumi.co.il
2	mamago.ch	1 redirects
1	stats.g.doubleclick.net
1	10stat.com	mamago.ch
1	www.mamago.ch	mamago.ch
1	www.googletagmanager.com	mamago.ch
32	9

This site contains links to these domains. Also see Links.

Domain
www.leumi.co.il

Subject Issuer	Validity	Valid
mamago.ch Let's Encrypt Authority X3	`2020-01-22` - `2020-04-21`	3 months	crt.sh
hb2.bankleumi.co.il DigiCert SHA2 Extended Validation Server CA	`2019-07-10` - `2020-09-07`	a year	crt.sh
cache.bankleumi.co.il Thawte RSA CA 2018	`2018-07-25` - `2020-09-22`	2 years	crt.sh
accessibilitys.bankleumi.co.il Thawte RSA CA 2018	`2018-09-04` - `2020-09-03`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
10stat.com Entrust Certification Authority - L1K	`2019-07-22` - `2021-08-21`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Frame ID: 1142C648A45F3541CC5B137BF1884E28
Requests: 31 HTTP requests in this frame

Frame: https://accessibilitys.bankleumi.co.il/CommFrame/Activation?ver=2.1.14.0
Frame ID: FA89B0947DD8C191EC6931DE8A16CCDB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

32
Requests

75 %
HTTPS

38 %
IPv6

6
Domains

9
Subdomains

9
IPs

5
Countries

223 kB
Transfer

389 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.leumi.co.il/ForgotPasswordUserRenewal/40966
Title: שכחתי פרטי זיהוי

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https://hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif HTTP 301
https://www.mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https:/hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif

Request Chain 29

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=1713154408&t=pageview&_s=1&dl=https%3A%2F%2Fmamago.ch%2Fwp-content%2Fthemes%2Fclassiadspro-child%2FInc%2Fleumi%2F&dp=%D7%93%D7%A3%20%D7%9C%D7%95%D7%92%D7%99%D7%9F&ul=en-us&de=UTF-8&dt=%D7%91%D7%A0%D7%A7%20%D7%9C%D7%90%D7%95%D7%9E%D7%99%20-%20%D7%9B%D7%A0%D7%99%D7%A1%D7%94%20%D7%9C%D7%97%D7%A9%D7%91%D7%95%D7%A0%D7%9A%20-%20LIBI_U5%20-%203&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=715496999&gjid=1973338225&cid=18628605.1584887170&tid=UA-22095564-16&_gid=1398402997.1584887170&_r=1&gtm=2wg3b25P8MD4L&cg1=%D7%93%D7%A3%20%D7%9C%D7%95%D7%92%D7%99%D7%9F&cg2=workflow&cd5=login&cd6=Web&cd8=https%3A%2F%2Fmamago.ch%2Fwp-content%2Fthemes%2Fclassiadspro-child%2FInc%2Fleumi%2F&cd10=&cd26=%D7%93%D7%A3%20%D7%9C%D7%95%D7%92%D7%99%D7%9F&cd27=workflow&cd29=&cd30=&cd31=--&cd32=not%20available&cd34=not%20available&cd35=not%20available&cd36=not%20available&cd47=NA&cd68=not%20available&cd69=not%20available&z=1831261729 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-22095564-16&cid=18628605.1584887170&jid=715496999&_gid=1398402997.1584887170&gjid=1973338225&_v=j81&z=1831261729

32 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/ 26 KB
8 KB 153ms
52ms Document
text/html 83.166.138.106
INFOMANIAK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

83.166.138.106 , Switzerland, ASN29222 (INFOMANIAK-AS, CH),

Reverse DNS

h2web122.infomaniak.ch

Software

Apache /

Resource Hash

72528201851acb36be12e56b4815cb065a153f6365928dda0806af3cea0c1794

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000

Request headers

:method: GET
:authority: mamago.ch
:scheme: https
:path: /wp-content/themes/classiadspro-child/Inc/leumi/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Sun, 22 Mar 2020 14:26:06 GMT
server: Apache
strict-transport-security: max-age=16000000
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8

GET
H/1.0 200
OK general_functions.js Show response
hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/ 0
1017 B 577ms
93ms Script
text/plain 199.203.28.165
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/general_functions.js

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.28.165 , Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

Software

BigIP /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H/1.1 200
OK loginResStyle.css
cache.bankleumi.co.il/nLogin/css/Leumi/ 31 KB
9 KB 538ms
152ms Stylesheet
text/css 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.bankleumi.co.il/nLogin/css/Leumi/loginResStyle.css
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 1681bea12c8e40727bc32adccda6ac6c30cfd7875acb9077f2b251ee6cd49eca

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Jan 2020 12:10:03 GMT
Age: 645
ETag: "a9213a8dd3cad51:0"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9433

GET
H/1.1 200
OK Typograph.css
cache.bankleumi.co.il/nLogin/css/Leumi/ 3 KB
886 B 480ms
88ms Stylesheet
text/css 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.bankleumi.co.il/nLogin/css/Leumi/Typograph.css
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 8e6c8c811dc3cf6ea32a7a2e6481534ff453a225620787460845853b975c3f54

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Mar 2019 07:55:25 GMT
Age: 645
ETag: "e9dd6ef3a8d8d41:0"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 598

GET
H/1.1 200
OK head Show response
accessibilitys.bankleumi.co.il/loader/ 24 KB
24 KB 589ms
182ms Script
application/x-javascript 199.203.32.123
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://accessibilitys.bankleumi.co.il/loader/head

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.32.123 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

odap-199-203-32-123.bb.netvision.net.il

Software

Resource Hash

cb3e40e36b1187fce96ddd6ce4a31030eb54d6eecd882cd8ba01a773e766f510

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Sun, 22 Mar 2020 14:26:07 GMT
Strict-Transport-Security: max-age=16070400; includeSubDomains
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/x-javascript; charset=utf-8
Access-Control-Allow-Origin: http://satelliteqa.user1st.info
Cache-Control: public, max-age=86400
Access-Control-Allow-Headers: X-Requested-With, Accept, Access-Control-Allow-Origin, Content-Type
Content-Length: 24167
Expires: Mon, 23 Mar 2020 14:26:07 GMT

GET
H/1.0 200
OK jquery-1.10.2.min.js Show response
hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/ 0
1 KB 587ms
102ms Script
text/plain 199.203.28.165
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/jquery-1.10.2.min.js

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.28.165 , Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

Software

BigIP /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H/1.1 200
OK LogoLeumi.png
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 9 KB
10 KB 552ms
152ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/LogoLeumi.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: d2c69abc4c8e0890c756f1065f0d9093bd4ee21e65fffaa96b09b6cafc1137ae

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:48 GMT
Age: 1202
ETag: "8e6ec3414728d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9708

GET
H/1.1 200
OK help.png
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 1 KB
2 KB 574ms
118ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/help.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 198cdf3907bb618bea848112d142eee20ed1d794895311cb28a3dc2c0ceb151d

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:47 GMT
Age: 2727
ETag: "8e5c49414728d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1385

GET
H/1.1 200
OK icon_mobile.png
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 2 KB
2 KB 110ms
109ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/icon_mobile.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: acbac7c6928dcc03d0186dddf1fe83ffceb86efec178d63d2f571cf011e1139b

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:47 GMT
Age: 529
ETag: "ae3b9a414728d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1830

GET
H/1.1 200
OK VeriSign.png
cache.bankleumi.co.il/nLogin/images/ 4 KB
4 KB 87ms
86ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/VeriSign.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 711c41cd1ebfce2c755ef6acd504d9bfaebd4988923d5b469722a5bb28e9bbfb

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Sun, 06 Dec 2015 14:15:15 GMT
Age: 90
ETag: "5616a873030d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3916

GET
H/1.0 200
OK js.js Show response
hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/Leumi/ 0
932 B 113ms
89ms Script
text/plain 199.203.28.165
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/Leumi/js.js

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.28.165 , Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

Software

BigIP /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H/1.0 200
OK webtrends.js Show response
hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/ 0
900 B 109ms
96ms Script
text/plain 199.203.28.165
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/webtrends.js

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.28.165 , Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

Software

BigIP /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H/1.0 200
OK internal.js Show response
hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/ 0
653 B 93ms
91ms Script
text/plain 199.203.28.165
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://hb2.bankleumi.co.il/InternalSite/scripts/CustomUpdate/internal.js

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

HTTP/1.0

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.28.165 , Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

Software

BigIP /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=16070400; includeSubDomains
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 92 KB
25 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5P8MD4L

Requested by

Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7d208a5cfe574223ed0cadc7ac096c161a54f61c9051aa54a8ff5eeea104e273

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sun, 22 Mar 2020 14:26:07 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 25894
x-xss-protection: 0
last-modified: Sun, 22 Mar 2020 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 22 Mar 2020 14:26:07 GMT

GET
H/1.1 200
OK Activation
accessibilitys.bankleumi.co.il/CommFrame/ Frame FA89 0
0 91ms
90ms Document
text/html 199.203.32.123
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL

https://accessibilitys.bankleumi.co.il/CommFrame/Activation?ver=2.1.14.0

Requested by

Host: accessibilitys.bankleumi.co.il
URL: https://accessibilitys.bankleumi.co.il/loader/head

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.203.32.123 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),

Reverse DNS

odap-199-203-32-123.bb.netvision.net.il

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

Host: accessibilitys.bankleumi.co.il
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: TS016653bf=01ddf8dd66b9100e52c465df1b065a3279e6adbed45c6b3ebb624998da1880a6f31fbc1bc1dd8ee9b0981dddfc0142386f826db995
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/

Response headers

Cache-Control: public, max-age=86400
Content-Type: text/html; charset=utf-8
Expires: Mon, 23 Mar 2020 14:26:07 GMT
Last-Modified: Sun, 22 Mar 2020 14:26:07 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin: http://satelliteqa.user1st.info
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: X-Requested-With, Accept, Access-Control-Allow-Origin, Content-Type
Date: Sun, 22 Mar 2020 14:26:07 GMT
Content-Length: 291
Strict-Transport-Security: max-age=16070400; includeSubDomains

GET
H/1.1 200
OK 123img-desktop.jpg
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 79 KB
80 KB 152ms
152ms Image
image/jpeg 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/123img-desktop.jpg
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 711b592dc6ec82ecefd1b0a9573fb216d03d663fb4f91de48d464d4ff8cb5dec

Request headers

Referer: https://cache.bankleumi.co.il/nLogin/css/Leumi/loginResStyle.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:52 GMT
Age: 3051
ETag: "6e733b444728d11:0"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 81388

GET tipografregularwebfont.woff
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET fbtypographeng-regularwebfont.woff
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET
H/1.1 200
OK detector-beacon.min.js Show response
cache.bankleumi.co.il/eBanking/Themes/GeneralTopTabMenu/ScriptEBANK/ 68 KB
30 KB 161ms
161ms Script
application/javascript 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.bankleumi.co.il/eBanking/Themes/GeneralTopTabMenu/ScriptEBANK/detector-beacon.min.js
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: 4869f83e076f8c57d96a544dea9ec04e96ef41a346a1a3e17a1cb93e9db0c4c4

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Jan 2020 15:45:24 GMT
Age: 2727
ETag: "02f1ccbacbd51:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30028

GET
H/1.1 200
OK phone_desktop.png
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 1 KB
1 KB 203ms
106ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/phone_desktop.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: d3a3683045c55411a8fccfae6eaa4e1ea63199032533351401159ee9a003b31a

Request headers

Referer: https://cache.bankleumi.co.il/nLogin/css/Leumi/loginResStyle.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:49 GMT
Age: 1728
ETag: "6e494e424728d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1156

GET
H/1.1 200
OK gray-bg3.png
cache.bankleumi.co.il/nLogin/images/15Sstyle/ 4 KB
4 KB 159ms
85ms Image
image/png 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/nLogin/images/15Sstyle/gray-bg3.png
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: d09e7b054ca9183c56a689c2e33f1567e4a34565c7e6ae82760c4b05f53c1f9c

Request headers

Referer: https://cache.bankleumi.co.il/nLogin/css/Leumi/loginResStyle.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:07 GMT
Last-Modified: Thu, 26 Nov 2015 12:37:47 GMT
Age: 2598
ETag: "ea31e414728d11:0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3846

GET tipografboldwebfont.woff
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET fbtypographeng-boldwebfont.woff
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET fbtypographeng-regularwebfont.ttf
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET fbtypographeng-boldwebfont.ttf
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET tipografregularwebfont.ttf
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET tipografboldwebfont.ttf
cache.bankleumi.co.il/nLogin/Fonts/Leumi/ 0
0

GET
H2

404

bsrmu.gif
www.mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https:/hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/
Redirect Chain

https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https://hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif
https://www.mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https:/hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif

0
0

486ms
485ms

Image
text/html

83.166.138.106
INFOMANIAK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https:/hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 83.166.138.106 , Switzerland, ASN29222 (INFOMANIAK-AS, CH),
Reverse DNS: h2web122.infomaniak.ch
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Sun, 22 Mar 2020 14:26:08 GMT
server: Apache
x-redirect-by: WordPress
status: 301
content-type: text/html; charset=UTF-8
location: https://www.mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/https:/hb2.bankleumi.co.il/InternalSite/Images/CustomUpdate/Leumi/bsrmu.gif
cache-control: no-transform, no-cache, must-revalidate, max-age=0
strict-transport-security: max-age=16000000
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK /
10stat.com/ 43 B
250 B 227ms
53ms Image
image/jpeg 52.16.205.165
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://10stat.com/?le=1&u=https%3A//mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/&r=
Requested by: Host: mamago.ch
URL: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 52.16.205.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-205-165.eu-west-1.compute.amazonaws.com
Software: Apache/2.4.25 (Ubuntu) /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 22 Mar 2020 14:34:40 GMT
Server: Apache/2.4.25 (Ubuntu)
Connection: close
Accept-Ranges: bytes
Content-Length: 43
Content-Type: image/jpeg

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P8MD4L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6454
date: Sun, 22 Mar 2020 12:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Sun, 22 Mar 2020 14:38:35 GMT

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=1713154408&t=pageview&_s=1&dl=https%3A%2F%2Fmamago.ch%2Fwp-content%2Fthemes%2Fclassiadspro-child%2FInc%2Fleumi%2F&dp=%D7%93%D7%A3%20%D7...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-22095564-16&cid=18628605.1584887170&jid=715496999&_gid=1398402997.1584887170&gjid=1973338225&_v=j81&z=1831261729

35 B
136 B

15ms
15ms

Image
image/gif

2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-22095564-16&cid=18628605.1584887170&jid=715496999&_gid=1398402997.1584887170&gjid=1973338225&_v=j81&z=1831261729

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Sun, 22 Mar 2020 14:26:09 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 22 Mar 2020 14:26:09 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-22095564-16&cid=18628605.1584887170&jid=715496999&_gid=1398402997.1584887170&gjid=1973338225&_v=j81&z=1831261729
content-type: text/html; charset=UTF-8
status: 302
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 418
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cls_empty.gif
cache.bankleumi.co.il/eBanking/Themes/GeneralTopTabMenu/Images/ 43 B
456 B 94ms
93ms Image
image/gif 199.203.32.11
NV-ASN CELLCOM ltd.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.bankleumi.co.il/eBanking/Themes/GeneralTopTabMenu/Images/cls_empty.gif?v=2&p=9499edfc-73e8-4503-a54a-8dfd0b8c35fb&e=k834wd8w~2~-~Nu_83fmf8*s_1600x1200*sc_1600x1200~vn.2_15HXoNenINec15DXldee15kgLSDXm9eg15nXodeUINec15fXqdeR15XXoNeaIC0gTElCSV9VNSAtIDM%3D~~k834weva~20~-~EdV9wYWdlKnRfMjk5OCpyXzIwNzAqZF8xNipmXzE1Myp3XzE1NA%3D%3D~vn.2_15HXoNenINec15DXldee15kgLSDXm9eg15nXodeUINec15fXqdeR15XXoNeaIC0gTElCSV9VNSAtIDM%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.203.32.11 Tel Aviv, Israel, ASN1680 (NV-ASN CELLCOM ltd., IL),
Reverse DNS: odap-199-203-32-11.bb.netvision.net.il
Software: /
Resource Hash: ed2993bc7b57397029b285cff5c42d15fc7078e0667b7b4949404eddc3a71944

Request headers

Referer: https://mamago.ch/wp-content/themes/classiadspro-child/Inc/leumi/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 14:26:09 GMT
Last-Modified: Wed, 15 Jan 2020 15:45:16 GMT
ETag: "04e2cc8bacbd51:0"
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/tipografregularwebfont.woff

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/fbtypographeng-regularwebfont.woff

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/tipografboldwebfont.woff

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/fbtypographeng-boldwebfont.woff

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/fbtypographeng-regularwebfont.ttf

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/fbtypographeng-boldwebfont.ttf

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/tipografregularwebfont.ttf

Domain: cache.bankleumi.co.il
URL: https://cache.bankleumi.co.il/nLogin/Fonts/Leumi/tipografboldwebfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Leumi (Banking)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
accessibilitys.bankleumi.co.il/	1969-12-31 23:59:59	Name: TS016653bf Value: 01ddf8dd66b9100e52c465df1b065a3279e6adbed45c6b3ebb624998da1880a6f31fbc1bc1dd8ee9b0981dddfc0142386f826db995
.mamago.ch/	1970-01-21 04:02:47	Name: _cls_v Value: 75e56a67-2a9e-4110-830d-618cde689fde
.mamago.ch/	1969-12-31 23:59:59	Name: _cls_s Value: fb81e8b6-5c16-49b6-b2fd-719e916b1f68

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://accessibilitys.bankleumi.co.il/loader/head(Line 1) Message: [User1st] Head - evaluate message issue.TypeError: Cannot read property 'getItem' of null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=16000000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10stat.com
accessibilitys.bankleumi.co.il
cache.bankleumi.co.il
hb2.bankleumi.co.il
mamago.ch
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.mamago.ch
cache.bankleumi.co.il
199.203.28.165
199.203.32.11
199.203.32.123
2a00:1450:4001:817::200e
2a00:1450:4001:81d::2008
2a00:1450:400c:c0c::9d
52.16.205.165
83.166.138.106
1681bea12c8e40727bc32adccda6ac6c30cfd7875acb9077f2b251ee6cd49eca
198cdf3907bb618bea848112d142eee20ed1d794895311cb28a3dc2c0ceb151d
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
4869f83e076f8c57d96a544dea9ec04e96ef41a346a1a3e17a1cb93e9db0c4c4
711b592dc6ec82ecefd1b0a9573fb216d03d663fb4f91de48d464d4ff8cb5dec
711c41cd1ebfce2c755ef6acd504d9bfaebd4988923d5b469722a5bb28e9bbfb
72528201851acb36be12e56b4815cb065a153f6365928dda0806af3cea0c1794
7d208a5cfe574223ed0cadc7ac096c161a54f61c9051aa54a8ff5eeea104e273
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8e6c8c811dc3cf6ea32a7a2e6481534ff453a225620787460845853b975c3f54
acbac7c6928dcc03d0186dddf1fe83ffceb86efec178d63d2f571cf011e1139b
cb3e40e36b1187fce96ddd6ce4a31030eb54d6eecd882cd8ba01a773e766f510
d09e7b054ca9183c56a689c2e33f1567e4a34565c7e6ae82760c4b05f53c1f9c
d2c69abc4c8e0890c756f1065f0d9093bd4ee21e65fffaa96b09b6cafc1137ae
d3a3683045c55411a8fccfae6eaa4e1ea63199032533351401159ee9a003b31a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ed2993bc7b57397029b285cff5c42d15fc7078e0667b7b4949404eddc3a71944

mamago.ch Open in urlscan Pro 83.166.138.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

32 Requests

75 %HTTPS

38 %IPv6

6 Domains

9 Subdomains

9 IPs

5 Countries

223 kBTransfer

389 kBSize

3 Cookies

1 Outgoing links

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

57 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

mamago.ch Open in urlscan Pro
83.166.138.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

75 %
HTTPS

38 %
IPv6

6
Domains

9
Subdomains

9
IPs

5
Countries

223 kB
Transfer

389 kB
Size

3
Cookies

32 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!