imoptuswebmail-9fb343.ingress-baronn.easywp.com Open in urlscan Pro
63.250.43.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://frigocare.com/wp-includes/js/dist/vendor/optus.php
Effective URL:
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
Submission Tags: 7433171
Submission: On February 02 via api (February 2nd 2022, 9:18:50 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 38 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 63.250.43.9, located in United States and belongs to NAMECHEAP-NET, US. The main domain is imoptuswebmail-9fb343.ingress-baronn.easywp.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 19th 2021. Valid for: a year.

This is the only time imoptuswebmail-9fb343.ingress-baronn.easywp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.67.84.106 185.67.84.106	60690 (OPEX-ASN) (OPEX-ASN)
1 11	63.250.43.9 63.250.43.9	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

1 185.67.84.106 (Iceland) 1 redirects

ASN60690 (OPEX-ASN, IS)
PTR: vefir1.office.is

frigocare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 63.250.43.9 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-baronn.easywp.com

imoptuswebmail-9fb343.ingress-baronn.easywp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	easywp.com 1 redirects imoptuswebmail-9fb343.ingress-baronn.easywp.com	586 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 440	14 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 584	33 KB
1	frigocare.com 1 redirects frigocare.com	312 B
13	4

	Domain	Requested by
11	imoptuswebmail-9fb343.ingress-baronn.easywp.com	1 redirects imoptuswebmail-9fb343.ingress-baronn.easywp.com
2	cdn.jsdelivr.net	imoptuswebmail-9fb343.ingress-baronn.easywp.com
1	code.jquery.com	imoptuswebmail-9fb343.ingress-baronn.easywp.com
1	frigocare.com	1 redirects
13	4

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
memberservices.optuszoo.com.au
webmail.optusnet.com.au
sport.optus.com.au
yescrowd.optus.com.au
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
plus.google.com
www.pinterest.com
instagram.com
www.singtel.com
offer.optus.com.au

Subject Issuer	Validity	Valid
*.ingress-baronn.easywp.com Sectigo RSA Domain Validation Secure Server CA	`2021-08-19` - `2022-08-19`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
Frame ID: 1188E63960B3190B119C938AFA956A09
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Account Login - Optus

Page URL History Show full URLs

https://frigocare.com/wp-includes/js/dist/vendor/optus.php HTTP 302
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus HTTP 301
http://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/ HTTP 307
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

632 kB
Transfer

4371 kB
Size

0
Cookies

38 Outgoing links

These are links going to different origins than the main page.

URL: https://www.optus.com.au/my-account-login?TYPE=100663297&REALMOID=06-8ddf53bb-43cf-4d85-9334-da38d3f555e9&GUID=1&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-qrO%2f7pv80kBPNdyFsh4xzrcFhAaZ5fTczH%2bJYZKe%2fnANBOvXuad%2b5m86DCkkpnnb&TARGET=-SM-HTTP%3a%2f%2fwww%2eoptus%2ecom%2eau%2fsecure%2fsm%2flogin%2eprocess%3ftarget%3dhttps-%3A-%2F-%2Fwww%2eoptus%2ecom%2eau-%2Fmy--account#nav-primary-level
Title: Skip to Primary Navigation

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/for-you
Title: For You

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/business
Title: For Business

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/enterprise
Title: For Enterprise

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/shoppingcart
Title: Cart

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/my-account
Title: My Account

Search URL Search Domain Scan URL

URL: https://memberservices.optuszoo.com.au/myaccount/
Title: Member Services

Search URL Search Domain Scan URL

URL: https://webmail.optusnet.com.au/
Title: Webmail

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customercentre/rewards/login
Title: Optus Perks

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customercentre/yescrowd/login
Title: Yes Crowd

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/yesbusiness

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/customer-extras/mobile-apps/my-optus-app
Title: My Optus App

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/entertainment/hype
Title: Hype

Search URL Search Domain Scan URL

URL: https://sport.optus.com.au/
Title: Optus Sport

Search URL Search Domain Scan URL

URL: https://yescrowd.optus.com.au/
Title: Yes Crowd

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/support
Title: Support

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/legal/privacy-and-security
Title: Privacy, Security and Safety

Search URL Search Domain Scan URL

URL: http://www.optus.com.au/about/legal#link/legal/0
Title: Standard Agreement

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/cis
Title: Critical Information Summaries

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/usageguides
Title: Optus Usage Guidelines

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/legal/copyright
Title: Copyright

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/about/inclusion-diversity/differing-abilities/disability-services
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/devicewarrtechinfo
Title: Device Warranties

Search URL Search Domain Scan URL

URL: http://www.facebook.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://twitter.com/Optus
Title: ""

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/yesoptus
Title: ""

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://plus.google.com/+optus/posts
Title: ""

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: http://instagram.com/optus
Title: ""

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/shop/stores
Title: Store Locator

Search URL Search Domain Scan URL

URL: https://www.optus.com.au/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.singtel.com/about-us
Title: About Singtel

Search URL Search Domain Scan URL

URL: https://offer.optus.com.au/for-you/support/complaints1?sid=complaints:source:homepage
Title: Lodge a complaint

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://frigocare.com/wp-includes/js/dist/vendor/optus.php HTTP 302
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus HTTP 301
http://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/ HTTP 307
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
Redirect Chain

https://frigocare.com/wp-includes/js/dist/vendor/optus.php
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus
http://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

46 KB
8 KB

156ms
156ms

Document
text/html

63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

3ea88691207013a4881ddd92d86a07c3fc839f59685c6ea0c39d48dea03b609d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Wed, 02 Feb 2022 21:15:55 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: public
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
x-cacheable: YES
age: 168
x-cache: HIT
accept-ranges: bytes
content-length: 8162
strict-transport-security: max-age=15768000

Redirect headers

Location: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
Non-Authoritative-Reason: HSTS

GET
H2 200 lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 493 KB
49 KB 157ms
157ms Stylesheet
text/css 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

bb56cea5f5f48414b5504b157a9420e6f159896a168ea9e6ff5e4ee9547de77a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 131
x-cache: HIT
vary: Accept-Encoding
content-length: 49958
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:02:04 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f983ac-7b441"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 lux.49c32e08060172d8b8758ebe235b7642.css
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 3 MB
271 KB 467ms
467ms Stylesheet
text/css 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.49c32e08060172d8b8758ebe235b7642.css

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

682892b4c0711d6936022fe0f066d42e909e3824f60c2e47eaef7a92c451e321

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 131
x-cache: HIT
vary: Accept-Encoding
content-length: 277289
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:02:03 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f983ab-35cc4c"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 52ms
17ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:44 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-1762a"
vary: Accept-Encoding
x-hw: 1643836724.dop245.am5.t,1643836724.cds223.am5.hn,1643836724.cds249.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33202

GET
H2 200 jquery.validate.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 23 KB
8 KB 37ms
20ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 732988
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19132-FRA
timing-allow-origin: *
server: cloudflare
etag: W/"5a1e-IUhhlLqiLrEVX+mL969jFOd3PMc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6d76742afca891d2-FRA

GET
H2 200 additional-methods.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 17 KB
6 KB 32ms
15ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.validation/1.16.0/additional-methods.min.js

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:44 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 732983
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19168-FRA
timing-allow-origin: *
server: cloudflare
etag: W/"4587-uIBUYLV1S+ixaiI99zfZV32kwYI"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6d76742afcaa91d2-FRA

GET
H2 200 login.js Show response
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 545 B
835 B 777ms
777ms Script
application/javascript 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/login.js

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

37fa54090471f5b10ee622d15acf84bbda09b286defce156ec3952e399be0794

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
vary: Accept-Encoding
content-length: 318
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:02:03 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"61f983ab-221"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: application/javascript
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 507b76aa0351c57ece90f02239b62ba3.woff
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 66 KB
67 KB 158ms
157ms Font
font/woff 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/507b76aa0351c57ece90f02239b62ba3.woff

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:34 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 131
x-cache: HIT
content-length: 67824
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:01:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f9839e-108f0"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 b7b268c962e2855acf62186c96a55466.woff
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 66 KB
67 KB 157ms
156ms Font
font/woff 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/b7b268c962e2855acf62186c96a55466.woff

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:34 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 131
x-cache: HIT
content-length: 67808
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:01:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f9839e-108e0"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/ 0
0 157ms
157ms Font
text/html 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.49c32e08060172d8b8758ebe235b7642.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.49c32e08060172d8b8758ebe235b7642.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:45 GMT
content-encoding: gzip
server: nginx
age: 0
vary: Accept-Encoding
x-cache: MISS
content-type: text/html
strict-transport-security: max-age=15768000
content-length: 167

GET
H2 200 ee10f7196c1b125a3b8222341465bf5e.woff
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 65 KB
66 KB 166ms
165ms Font
font/woff 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ee10f7196c1b125a3b8222341465bf5e.woff

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:34 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 131
x-cache: HIT
content-length: 66552
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:01:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f9839e-103f8"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 e1055008ac141ccf27da8fbe95009134.ttf
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/ 0
0 158ms
157ms Font
text/html 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/e1055008ac141ccf27da8fbe95009134.ttf

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:18:46 GMT
content-encoding: gzip
server: nginx
age: 0
vary: Accept-Encoding
x-cache: MISS
content-type: text/html
strict-transport-security: max-age=15768000

GET
H2 200 cdf06c294d7cc3d6664b0dc9edf2c7ea.woff
imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/ 56 KB
57 KB 157ms
156ms Font
font/woff 63.250.43.9
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff

Requested by

Host: imoptuswebmail-9fb343.ingress-baronn.easywp.com
URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.9 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-baronn.easywp.com

Software

nginx /

Resource Hash

abb2805631568056488332283a9cde15bb8fe0c2100d41963f673dba10d0fd8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/lux.base.40b79b2dff70805dc551aaca7c6f6a4b.css
Origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 21:16:36 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 129
x-cache: HIT
content-length: 57556
x-xss-protection: 1; mode=block
last-modified: Tue, 01 Feb 2022 19:01:50 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "61f9839e-e0d4"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| luxPackages string| lineOfBusiness function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/cdf06c294d7cc3d6664b0dc9edf2c7ea.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://imoptuswebmail-9fb343.ingress-baronn.easywp.com/optus/files/assets/fonts/lux-icons/e1055008ac141ccf27da8fbe95009134.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
frigocare.com
imoptuswebmail-9fb343.ingress-baronn.easywp.com
185.67.84.106
2001:4de0:ac18::1:a:2a
2606:4700::6810:5714
63.250.43.9
06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f
37fa54090471f5b10ee622d15acf84bbda09b286defce156ec3952e399be0794
3ea88691207013a4881ddd92d86a07c3fc839f59685c6ea0c39d48dea03b609d
4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
682892b4c0711d6936022fe0f066d42e909e3824f60c2e47eaef7a92c451e321
7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12
8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8
abb2805631568056488332283a9cde15bb8fe0c2100d41963f673dba10d0fd8f
bb56cea5f5f48414b5504b157a9420e6f159896a168ea9e6ff5e4ee9547de77a
eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

imoptuswebmail-9fb343.ingress-baronn.easywp.com Open in urlscan Pro 63.250.43.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

632 kBTransfer

4371 kBSize

0 Cookies

38 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

2 Console Messages

Security Headers

Indicators

imoptuswebmail-9fb343.ingress-baronn.easywp.com Open in urlscan Pro
63.250.43.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

632 kB
Transfer

4371 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!