gymtsv.com.au
Open in
urlscan Pro
103.37.8.107
Malicious Activity!
Public Scan
Submission: On September 17 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by RapidSSL TLS RSA CA G1 on October 24th 2023. Valid for: a year.
This is the only time gymtsv.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Suspicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 103.37.8.107 103.37.8.107 | 135543 (NETWORKDY...) (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd) | |
3 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 104.18.94.41 104.18.94.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.129.11 172.67.129.11 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.187.31 104.18.187.31 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 23.32.5.159 23.32.5.159 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 6 |
ASN135543 (NETWORKDYNAMICS-PTY-LTD-AS-AP Network Dynamics Pty Ltd, AU)
PTR: server-1007.wphosting.com.au
gymtsv.com.au |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-32-5-159.deploy.static.akamaitechnologies.com
th.bing.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
cloudflare.com
1 redirects
cdnjs.cloudflare.com — Cisco Umbrella Rank: 215 challenges.cloudflare.com — Cisco Umbrella Rank: 3407 |
203 KB |
4 |
bing.com
th.bing.com — Cisco Umbrella Rank: 161 |
155 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 314 |
35 KB |
1 |
stellarbyteae.ru
stellarbyteae.ru |
7 KB |
1 |
gymtsv.com.au
gymtsv.com.au |
3 KB |
11 | 5 |
Domain | Requested by | |
---|---|---|
4 | th.bing.com |
gymtsv.com.au
|
3 | cdnjs.cloudflare.com |
gymtsv.com.au
cdnjs.cloudflare.com |
2 | challenges.cloudflare.com |
1 redirects
gymtsv.com.au
|
1 | cdn.jsdelivr.net |
gymtsv.com.au
|
1 | stellarbyteae.ru |
gymtsv.com.au
|
1 | gymtsv.com.au | |
11 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
gymtsv.com.au RapidSSL TLS RSA CA G1 |
2023-10-24 - 2024-10-23 |
a year | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
stellarbyteae.ru WE1 |
2024-08-13 - 2024-11-11 |
3 months | crt.sh |
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA |
2024-05-04 - 2025-05-04 |
a year | crt.sh |
r.bing.com Microsoft Azure ECC TLS Issuing CA 04 |
2024-06-24 - 2025-06-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://gymtsv.com.au/sea/links/
Frame ID: 920B24F0E84F32580B05F99162B029C0
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Retro Car Fans - stellarbyteae.ruDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/b/388c99dd0998/api.js
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
gymtsv.com.au/sea/links/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/b/388c99dd0998/ Redirect Chain
|
46 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
stellarbyteae.ru// |
8 KB 7 KB |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/ |
227 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/ |
100 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OIP.y-jFalnEmB7HCfAyVni7UgHaFJ
th.bing.com/th/id/ |
39 KB 40 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OIP.xkKRibed8LJ1SBNUGEm-4AHaLI
th.bing.com/th/id/ |
62 KB 63 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OIP.3crybvJaTID_W58Px8ReuAHaE8
th.bing.com/th/id/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OIP.2gqKsn0J9OJe0chfjFoHBwHaE7
th.bing.com/th/id/ |
23 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/ |
153 KB 154 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Suspicious
page.url
Submitted on
September 17th 2024, 2:06:23 am
UTC —
From Australia
Threats:
Social Engineering
Brand Impersonation
Spearphishing
Brands:
Microsoft
US
Comment: The WordPress website has been hacked and a sub page has been setup to collect Microsoft 365 credentials, They also detect if the page is scanned or a human user to redirect to the Microsoft login or the Car Shop site seen in this scan (see urlscan.io screenshot) .
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS object| turnstile function| abase function| nacho0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
challenges.cloudflare.com
gymtsv.com.au
stellarbyteae.ru
th.bing.com
103.37.8.107
104.17.24.14
104.18.187.31
104.18.94.41
172.67.129.11
23.32.5.159
3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8
6693d876093c5a661696632eb1872e343ad38567780b815a1302ece0dc1a35de
741ee959c15dfdb1efb66852b9144f11307af11410f447a722eb0c272a97fbf7
83e21a3d81adcd330d1fdd4a3a9ae032da97bbb5dec928d9b7a09cbad3f944bb
8bc662c4a39c7dd8dd8724f4e0477589b3f343d0cbd3f68e7b8efa89a5c027dd
8eae5159c56bf66c17e0cb002b25fc2e343f3e009dc2a39a7e230f08b7b8c672
aee2639854efd78af388ad412990525a0e2b4c33ac41be33d34efd18a8f07423
c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
f037f33296e1d31ebea8d9cf1d0d10236e304a41959672776949aaf39eee2bb5
f4c5a5b297e623bc159679563a4d1eb16e409ca3b57698fbc00fd2c907dadae0