miss-peggy.com Open in urlscan Pro
2001:4b98:dc2:950::111 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330
Submission: On March 28 via automatic, source openphish (March 28th 2021, 1:50:24 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2001:4b98:dc2:950::111, located in France and belongs to GANDI-AS Domain name registrar - http://www.gandi.net, FR. The main domain is miss-peggy.com.
TLS certificate: Issued by Gandi Standard SSL CA 2 on November 25th 2020. Valid for: a year.

This is the only time miss-peggy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address		AS Autonomous System
11	2001:4b98:dc2... 2001:4b98:dc2:950::111		29169 (GANDI-AS ...) (GANDI-AS Domain name registrar - http://www.gandi.net)
11	1

11 2001:4b98:dc2:950::111 (France)

ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR)

miss-peggy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	miss-peggy.com miss-peggy.com	2 MB
11	1

	Domain	Requested by
11	miss-peggy.com	miss-peggy.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
miss-peggy.com Gandi Standard SSL CA 2	`2020-11-25` - `2021-11-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330
Frame ID: A312E9EB657185F5DDC8D5A3FECDA125
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1839 kB
Transfer

2305 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request sign_in.php Show response miss-peggy.com/modules/jmsslider/views/img/layers/now/	6 KB 2 KB	111ms 33ms	Document text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash `46141131157985529eb0bd46ae20c2155a89749426ade51daa7d5e6ecf17f1e2` Request headers :method GET :authority miss-peggy.com :scheme https :path /modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:50:04 GMT server Apache x-powered-by PHP/7.3.17 content-encoding gzip content-length 1949 content-type text/html; charset=UTF-8 via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) vary Accept-Encoding x-cache-hits 0 x-cache MISS accept-ranges bytes age 0
GET H2	200	style.css miss-peggy.com/modules/jmsslider/views/img/layers/now/css/	9 KB 2 KB	29ms 28ms	Stylesheet text/css	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/css/style.css Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / Resource Hash `3135f6721eb16532d600785c201da0e0901ba79d97a68ccf2bb09029052ee9b1` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:49:59 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) last-modified Tue, 09 Jun 2020 10:14:20 GMT server Apache age 5 etag "25d4-5a7a3fd9d3700-gzip" vary Accept-Encoding x-cache HIT content-type text/css accept-ranges bytes content-encoding gzip content-length 2047 x-cache-hits 1
GET H2	200	blue-ui.css miss-peggy.com/modules/jmsslider/views/img/layers/now/style/css/	396 KB 50 KB	29ms 28ms	Stylesheet text/css	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/css/blue-ui.css Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / Resource Hash `a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:49:59 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) last-modified Mon, 04 Jun 2018 01:17:42 GMT server Apache age 5 etag "62e2a-56dc6b342b980-gzip" vary Accept-Encoding x-cache HIT content-type text/css accept-ranges bytes content-encoding gzip content-length 51281 x-cache-hits 1
GET H2	200	logon.css miss-peggy.com/modules/jmsslider/views/img/layers/now/style/css/	128 KB 17 KB	30ms 29ms	Stylesheet text/css	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/css/logon.css Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / Resource Hash `beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:49:59 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) last-modified Mon, 04 Jun 2018 00:14:48 GMT server Apache age 5 etag "20048-56dc5d2500e00-gzip" vary Accept-Encoding x-cache HIT content-type text/css accept-ranges bytes content-encoding gzip content-length 17220 x-cache-hits 1
GET H2	404	angular.min.js miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/	0 0	107ms 106ms	Script text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/angular.min.js Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 28 Mar 2021 13:50:04 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) server Apache age 0 x-powered-by PHP/7.3.17 x-cache MISS content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate x-cache-hits 0
GET H2	404	jquery.min.js miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/	0 0	108ms 107ms	Script text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/jquery.min.js Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 28 Mar 2021 13:50:04 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) server Apache age 0 x-powered-by PHP/7.3.17 x-cache MISS content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate x-cache-hits 0
GET H2	404	jquery.validate.min.js miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/	0 0	98ms 98ms	Script text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/jquery.validate.min.js Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 28 Mar 2021 13:50:04 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) server Apache age 0 x-powered-by PHP/7.3.17 x-cache MISS content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate x-cache-hits 0
GET H2	200	wordmark-white.svg miss-peggy.com/modules/jmsslider/views/img/layers/now/images/	1 KB 920 B	29ms 28ms	Image image/svg+xml	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Show image Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/images/wordmark-white.svg Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / Resource Hash `d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:49:59 GMT content-encoding gzip last-modified Mon, 21 May 2018 19:28:38 GMT server Apache age 5 etag "581-56cbc4ef6c580-gzip" vary Accept-Encoding x-cache HIT content-type image/svg+xml access-control-allow-origin * accept-ranges bytes content-length 645 via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) x-cache-hits 1
GET H2	404	jquery.validate.min.js miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/	0 0	92ms 92ms	Script text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/style/js/jquery.validate.min.js Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 28 Mar 2021 13:50:04 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) server Apache age 0 x-powered-by PHP/7.3.17 x-cache MISS content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate x-cache-hits 0
GET H2	200	background.jpeg miss-peggy.com/modules/jmsslider/views/img/layers/now/images/	2 MB 2 MB	29ms 28ms	Image image/jpeg	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Show image Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/images/background.jpeg Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / Resource Hash `ba19d0d5367c224ebe1e26cee56109309fda61bf439dd138d7d6852ce2e5268a` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/sign_in.php?session_386533303330 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 28 Mar 2021 13:49:59 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) last-modified Tue, 09 Jun 2020 04:32:40 GMT server Apache age 4 etag "1b1cb0-5a79f37b80a00" x-cache HIT content-type image/jpeg accept-ranges bytes content-length 1776816 x-cache-hits 1
GET H2	404	bg.jpg miss-peggy.com/modules/jmsslider/views/img/layers/now/images/	30 KB 30 KB	112ms 111ms	Image text/html	2001:4b98:dc2:950::111 http://www.gandi.net
General Check archive.org Show headers Download Go to Show image Full URL https://miss-peggy.com/modules/jmsslider/views/img/layers/now/images/bg.jpg Requested by Host: miss-peggy.com URL: https://miss-peggy.com/modules/jmsslider/views/img/layers/now/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4b98:dc2:950::111 , France, ASN29169 (GANDI-AS Domain name registrar - http://www.gandi.net, FR), Reverse DNS Software Apache / PHP/7.3.17 Resource Hash `4c211ef1d243f7222cee5a9b06ea4ca49a178fd51a113562bdbdb67aa98517d0` Request headers Referer https://miss-peggy.com/modules/jmsslider/views/img/layers/now/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sun, 28 Mar 2021 13:50:04 GMT via 1.1 varnish (Varnish/6.3), 1.1 varnish (Varnish/6.3) server Apache age 0 x-powered-by PHP/7.3.17 x-cache MISS content-type text/html; charset=utf-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate x-cache-hits 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

miss-peggy.com
2001:4b98:dc2:950::111
3135f6721eb16532d600785c201da0e0901ba79d97a68ccf2bb09029052ee9b1
46141131157985529eb0bd46ae20c2155a89749426ade51daa7d5e6ecf17f1e2
4c211ef1d243f7222cee5a9b06ea4ca49a178fd51a113562bdbdb67aa98517d0
a054554812c09bcd6e28618753061066ae6273f3af38e7cba62adeb7f1a5c348
ba19d0d5367c224ebe1e26cee56109309fda61bf439dd138d7d6852ce2e5268a
beaf04b1508ee134c7053a40e11f0a70faad6ac2dabad8cf8d288a77193f10df
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0

miss-peggy.com Open in urlscan Pro 2001:4b98:dc2:950::111 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1839 kBTransfer

2305 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

miss-peggy.com Open in urlscan Pro
2001:4b98:dc2:950::111 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1839 kB
Transfer

2305 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!