hi8khmgfw3w2.com Open in urlscan Pro
192.185.148.48  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail HTTP 301
   https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Page URL
   

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Redirect Chain https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/	32 KB 8 KB	158ms 158ms	Document text/html	192.185.148.48 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.148.48 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-148-48.unifiedlayer.com Software Apache / Resource Hash 9be8b71b6a390448ef26a591b8549b57a759d890353e4728e96ff5b54185459b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 8407 content-type text/html date Tue, 13 Sep 2022 18:14:00 GMT last-modified Wed, 10 Mar 2021 06:12:40 GMT server Apache vary Accept-Encoding Redirect headers content-length 261 content-type text/html; charset=iso-8859-1 date Tue, 13 Sep 2022 18:14:00 GMT location https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ server Apache
GET H2	200	login.531530f676cc5cd496ce.css hi8khmgfw3w2.com/stripe-RD972-user-em-detail/css/	1 MB 380 KB	143ms 141ms	Stylesheet text/css	192.185.148.48 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/css/login.531530f676cc5cd496ce.css Requested by Host: hi8khmgfw3w2.com URL: https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.148.48 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-148-48.unifiedlayer.com Software Apache / Resource Hash 6b2ae948b4340c69974df4cb2de64ee7353ab10e1608241d6e4400cd7d064103 Request headers accept-language de-DE,de;q=0.9 Referer https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 13 Sep 2022 18:14:00 GMT content-encoding gzip last-modified Wed, 10 Mar 2021 06:07:32 GMT server Apache accept-ranges bytes vary Accept-Encoding content-type text/css
GET		Sohne-latin-basic.woff2 b.stripecdn.com/manage/assets/fonts/	0 0
GET		Sohne-Regular.woff b.stripecdn.com/manage/assets/fonts/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.stripecdn.com

URL

https://b.stripecdn.com/manage/assets/fonts/Sohne-latin-basic.woff2

Domain

b.stripecdn.com

URL

https://b.stripecdn.com/manage/assets/fonts/Sohne-Regular.woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Stripe (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Message: Access to font at 'https://b.stripecdn.com/manage/assets/fonts/Sohne-latin-basic.woff2' from origin 'https://hi8khmgfw3w2.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://b.stripecdn.com/manage/assets/fonts/Sohne-latin-basic.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://hi8khmgfw3w2.com/stripe-RD972-user-em-detail/ Message: Access to font at 'https://b.stripecdn.com/manage/assets/fonts/Sohne-Regular.woff' from origin 'https://hi8khmgfw3w2.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://b.stripecdn.com/manage/assets/fonts/Sohne-Regular.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.stripecdn.com
hi8khmgfw3w2.com
b.stripecdn.com
192.185.148.48
6b2ae948b4340c69974df4cb2de64ee7353ab10e1608241d6e4400cd7d064103
9be8b71b6a390448ef26a591b8549b57a759d890353e4728e96ff5b54185459b