urlscan.io logo urlscan.io
SecurityTrails logo

fmg1.xyz Open in urlscan Pro
2606:4700:3035::6815:3f0a  Public Scan

Go To Rescan Add Verdict Report
URL: https://fmg1.xyz/login.php
Submission Tags: c2 malware agenttesla Search All
Submission: On November 17 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3035::6815:3f0a, located in United States and belongs to CLOUDFLARENET, US. The main domain is fmg1.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 15th 2021. Valid for: a year.
This is the only time fmg1.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 2606:4700:303... 13335 (CLOUDFLAR...)
9 1
Apex Domain
Subdomains		 Transfer
9 fmg1.xyz
fmg1.xyz
104 KB
9 1
Domain Requested by
9 fmg1.xyz fmg1.xyz
9 1

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-11-15 -
2022-11-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://fmg1.xyz/login.php
Frame ID: 54DFD3AD6D8252DF9355D8DAE1571814
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

104 kB
Transfer

443 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
fmg1.xyz/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.1.1
Resource Hash
66570233b27c0c11c1bf1a393b51332ffc0d274fd514afbecda91dabe1750d59

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-type
text/html; charset=utf-8
x-powered-by
PHP/7.1.1
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VqjBmnf2yVbIm39ssFnqLMVNXcM3YcWl51kwHkuPVqbnP4x4GjcZeqqmXeIiICt3E6%2FmkxV2MsyFd0cHbCNqoOEOKs1dK5Km0ZOUl84N87yCtZHeoTwnK9MdYu1rDZ%2F8Omhjt8RpOw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6afc4aec281a6943-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
bootstrap.min.css
fmg1.xyz/bootstrap/dist/css/ 		147 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/bootstrap/dist/css/bootstrap.min.css
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 06 Jan 2017 19:12:50 GMT
server
cloudflare
etag
W/"24dd4-54571cdcdf080-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tw85m%2FmSq1IbtgOtGDljV7QBm8v3drvcIOAp5%2FtSI0paZk6I2is4UkDmfikm3X02nLaL3PKj6BLyZ1tghDVWPxIPQnpSvtD1zT8prTaacFdRZpsSc4TGaCLR1x9xjT4GCy272Br89Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a326943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
bootstrap-extension.css
fmg1.xyz/plugins/bower_components/bootstrap-extension/css/ 		76 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/plugins/bower_components/bootstrap-extension/css/bootstrap-extension.css
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ca13f118a0ac8dc77f0894b67dffe9861d52218cbbbaa2150ccf113665c6bfc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 13 Apr 2017 22:47:32 GMT
server
cloudflare
etag
W/"1302f-54d141c3d0900-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G8IPwK7B5aUt%2BBaakt%2Fofhw%2FokQn7Sv6bpa7iCSrsQX0QClejG0qJMUju4vniUEGMI4q8QQePpBUpHj7Zo6%2FU6VG%2BMR6UP8QaebPekawxIQRKISf522uFhUAZg44jkTSlj6hoLNETA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a346943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
sweetalert.css
fmg1.xyz/plugins/sweetalert/dist/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/plugins/sweetalert/dist/sweetalert.css
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
460df149ba9d2eb000637d9bfb2df51c5080a19e9071ff4ed5a4b7e21a0bd2f1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 15 Dec 2016 06:39:02 GMT
server
cloudflare
etag
W/"59ad-543acb57f2d80-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BLu%2FEze8S%2BmRCNB7ncPirINVOA37Ab9Y5gTEN8tcv%2FTAs90MDktxHc6m98mCDldTi8hHnVSx7t8tFQgCQ4aQbD0NZIORWmh0CJgwv%2BX7l%2BKHgFDFD%2B%2BKcgaeSPaTte%2FV4lheisGyeA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a386943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
jquery.min.js
fmg1.xyz/plugins/bower_components/jquery/dist/ 		82 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/plugins/bower_components/jquery/dist/jquery.min.js
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70ea5c0fd61a431fef3e564d404e868b8017cdf8525f37ef2e1a64299246003b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 09 Apr 2017 19:51:02 GMT
server
cloudflare
etag
W/"1498c-54cc12da8f580-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2FhX%2F5gwPVJafNz5ZGGRTYn%2BZ9AdX5gzhXwEdwiCgTZGddHHbcjTqWwdD6ikqRyKHXUxoZqetN7GLVYHVKBUV64hO1Orb4hQXb0EZd4EjbATVCDPafkgjGHWQM9JRdzQoTt13oFN5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a396943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
tether.min.js
fmg1.xyz/bootstrap/dist/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/bootstrap/dist/js/tether.min.js
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff9a470d98767efd5e6489b27e24e1b41e408382ea0e3ca2b6d4fb7cb8dd4fff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 15 Nov 2016 23:37:46 GMT
server
cloudflare
etag
W/"6144-5415f71882680-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBI1KtTtAVtSPGYZCZ%2BvUBt3BhV1ayeDlcCSBDTfRjxZf%2BULbFBBRVafesN2qzfsOLQXUWmVxfhGYkbP8CB%2B0oBUoxi3iXYvJZKqOdGrzR6Tdx%2BzQtocsZeDJ3rF6YSBrfwldveWGg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a3b6943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
bootstrap.min.js
fmg1.xyz/bootstrap/dist/js/ 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/bootstrap/dist/js/bootstrap.min.js
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 06 Jan 2017 19:12:54 GMT
server
cloudflare
etag
W/"b63d-54571ce0af980-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SekGKuTDSb95%2FWvbtLOzbDgTs%2FD4HLiElZVt6dj6hWo66pulcVPJAHTL2bwU6SSSVMmXKFEJrUlJmR8aDKLKFN8MyCtEPIGG4V0SrxsVzh%2FVIhfnqYj0UZjUJVTJI3ek5MxLvS%2FpSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a3e6943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
bootstrap-extension.min.js
fmg1.xyz/plugins/bower_components/bootstrap-extension/js/ 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/plugins/bower_components/bootstrap-extension/js/bootstrap-extension.min.js
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb5e2d3039b4fddffc1e711897eaffc7ddcf7256fea855989d37c4b1aa8bed8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 13 Mar 2017 15:12:32 GMT
server
cloudflare
etag
W/"68a7-54a9e23f37800-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uZINGUheBY3v5OJ1pCZS1fMGMN3AAJoZxUxb3ycC85r%2FsZdtAut3yCgRxv1%2F5NiuCknQKj4a6w85XlPaqmCvEfvcavWrAv1CYepEldSgceVJ8IZzy34X9%2FWsZ4iPRhHtnzvX7yXe2g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a3f6943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
sweetalert.min.js
fmg1.xyz/plugins/sweetalert/dist/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fmg1.xyz/plugins/sweetalert/dist/sweetalert.min.js
Requested by
Host: fmg1.xyz
URL: https://fmg1.xyz/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:3f0a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be4d1215ef6f2b2915b7f65cd28b9a9f7dcef17e1f0d883edd19400ca0ea795c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://fmg1.xyz/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 22:11:03 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 15 Dec 2016 06:39:02 GMT
server
cloudflare
etag
W/"4262-543acb57f2d80-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YUS02OKp4hpmLuvxbKhVqGhsPB1fEC%2Bfpe2JQQ3e7mFQ4jeYHjENKcUcFTG0YzDh8I%2FJairn7qn29YuZLIgpwZQs8LgktecnowUa2OZ0FzH1rbRXOQZxtpwahLnS8iz%2FsgnI%2BiUoeg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6afc4aed1a426943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| Tether function| swal function| sweetAlert

1 Cookies

Domain/Path Name / Value
fmg1.xyz/ Name: PHPSESSID
Value: o4e5bb118esth2ui4eg1eilt4i