urlscan.io logo urlscan.io
SecurityTrails logo

tradeguardians.org Open in urlscan Pro
199.250.206.120  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tradeguardians.org/prk/auto.html
Effective URL: https://tradeguardians.org/prk/auto.html
Submission: On April 27 via manual from NO — Scanned from NO
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 17 HTTP transactions. The main IP is 199.250.206.120, located in United States and belongs to IMH-IAD, US. The main domain is tradeguardians.org.
TLS certificate: Issued by R3 on April 3rd 2024. Valid for: 3 months.
This is the only time tradeguardians.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Autopay (Transportation)

Domain & IP information

IP Address AS Autonomous System
9 199.250.206.120 54641 (IMH-IAD)
1 199.36.158.100 54113 (FASTLY)
1 20.126.75.6 8075 (MICROSOFT...)
5 137.117.170.23 8075 (MICROSOFT...)
17 5
Domain Requested by
9 tradeguardians.org tradeguardians.org
5 epayment.nets.eu tradeguardians.org
1 test.epayment.nets.eu tradeguardians.org
1 static.autopay.io tradeguardians.org
17 4

This site contains no links.

Subject Issuer Validity Valid
*.tradeguardians.org
R3		 2024-04-03 -
2024-07-02		 3 months crt.sh
atkinsbookoflandscapes2020.com
GTS CA 1D4		 2024-04-07 -
2024-07-06		 3 months crt.sh
test.epayment.nets.eu
R3		 2024-03-03 -
2024-06-01		 3 months crt.sh
epayment.nets.eu
DigiCert TLS RSA SHA256 2020 CA1		 2023-06-05 -
2024-07-05		 a year crt.sh

This page contains 1 frames:

Primary Page: https://tradeguardians.org/prk/auto.html
Frame ID: 835160E1A8034DD0F6E0F486F834C0DE
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nets - Aksepter betaling

Page URL History Show full URLs

  1. http://tradeguardians.org/prk/auto.html HTTP 307
    https://tradeguardians.org/prk/auto.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <input[^>]+name="__VIEWSTATE
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

94 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

83 kB
Transfer

97 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tradeguardians.org/prk/auto.html HTTP 307
    https://tradeguardians.org/prk/auto.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request auto.html
tradeguardians.org/prk/
Redirect Chain
  • http://tradeguardians.org/prk/auto.html
  • https://tradeguardians.org/prk/auto.html
19 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash
2db1d1da08cb178619e5517a3919ab9b731454634f078ddd905c78f3639d7ecb

Request headers

Accept-Language
no-NO,no;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

content-encoding
br
content-type
text/html
date
Sat, 27 Apr 2024 19:33:47 GMT
last-modified
Fri, 12 Apr 2024 00:30:32 GMT
server
nginx/1.25.3
vary
Accept-Encoding
x-proxy-cache
HIT

Redirect headers

Location
https://tradeguardians.org/prk/auto.html
Non-Authoritative-Reason
HttpsUpgrades
jquery.3.5.min.js
tradeguardians.org/prk/css/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/jquery.3.5.min.js
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
StyleSheet_ExistingTerminal.css
tradeguardians.org/prk/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/StyleSheet_ExistingTerminal.css?1610
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
autopay.css
static.autopay.io/netaxept/v1/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.autopay.io/netaxept/v1/autopay.css
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8b731bb63c483a873948db9fc3f6711956227f26d78fbccc2f54601777b04ad2
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-served-by
cache-bma1630-BMA
strict-transport-security
max-age=31556926
content-encoding
br
date
Sat, 27 Apr 2024 19:33:47 GMT
last-modified
Mon, 28 Aug 2023 13:07:38 GMT
x-timer
S1714246427.395076,VS0,VE0
etag
"c90186bed6d063e0384ac157dc5cc1c57ca8ea330fe499a26ffdd3869009525c-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1496
x-cache-hits
146
Default.js
tradeguardians.org/prk/css/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/Default.js
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
TDSMethod.js
tradeguardians.org/prk/css/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/TDSMethod.js?2052
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
terminalimage.ashx
test.epayment.nets.eu/images/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://test.epayment.nets.eu/images/terminalimage.ashx?terminalImageId=c79773f4-578e-42b7-b8ea-ada1fb9d54b4
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.126.75.6 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
56239290173b9f263e53e63911e0e5c505a57e6a0f70bc048bc57e4451cf5059
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
x-content-type-options
nosniff
content-type
image/png
access-control-expose-headers
Request-Context
cache-control
private
x-robots-tag
noindex
content-length
10584
x-xss-protection
1; mode=block
request-context
appId=cid-v1:f2c7dfc0-df3b-4c74-a4d9-5fc744b61509
terminalimage.ashx
epayment.nets.eu/images/ 		607 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://epayment.nets.eu/images/terminalimage.ashx?terminalImageId=6f4df495-ec28-4f6c-b5df-729dfb249b0e
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.117.170.23 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a8705899ab21966962695a7516afe58b6e018d1fd0afba05ba00d266d1ac0cf8
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
x-content-type-options
nosniff
content-type
image/png
access-control-expose-headers
Request-Context
cache-control
private
x-robots-tag
noindex
content-length
607
x-xss-protection
1; mode=block
request-context
appId=cid-v1:009003ea-705a-4511-9a6b-3c017cea37fd
TopLedge_New.png
epayment.nets.eu/Terminal/Images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://epayment.nets.eu/Terminal/Images/TopLedge_New.png
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.117.170.23 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b0e39c2678c443e6e6722cacd41e413d51142e670adb7e0bf073cd49dcabf1d3
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
last-modified
Wed, 17 Apr 2024 10:31:26 GMT
x-content-type-options
nosniff
etag
"0d38d66b290da1:0"
content-type
image/png
accept-ranges
bytes
x-robots-tag
noindex
content-length
5341
x-xss-protection
1; mode=block
terminalimage.ashx
epayment.nets.eu/images/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://epayment.nets.eu/images/terminalimage.ashx?terminalImageId=337ece02-90c0-4450-ba9e-10de8fc40f5e
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.117.170.23 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
56239290173b9f263e53e63911e0e5c505a57e6a0f70bc048bc57e4451cf5059
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
x-content-type-options
nosniff
content-type
image/png
access-control-expose-headers
Request-Context
cache-control
private
x-robots-tag
noindex
content-length
10584
x-xss-protection
1; mode=block
request-context
appId=cid-v1:009003ea-705a-4511-9a6b-3c017cea37fd
32882.jpg
tradeguardians.org/prk/css/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tradeguardians.org/prk/css/32882.jpg
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash
ac0cf6a92444a873c2d5d4af1b2857828f9579812bc3720883028ee600bbf37d

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Sat, 04 May 2024 19:33:47 GMT
date
Sat, 27 Apr 2024 19:33:47 GMT
last-modified
Wed, 28 Feb 2024 07:30:30 GMT
server
nginx/1.25.3
etag
"65dee116-a49c"
content-type
image/jpeg
cache-control
max-age=604800, public, must-revalidate
accept-ranges
bytes
content-length
42140
x-proxy-cache
STATIC/TYPE
helpbutton.png
epayment.nets.eu/Terminal/images/ 		580 B
926 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://epayment.nets.eu/Terminal/images/helpbutton.png
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.117.170.23 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d17e4d479b21e65e099a312481d3effeb0e0c0e36b965e8174b67df79c4ac2f8
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
last-modified
Wed, 17 Apr 2024 10:31:26 GMT
x-content-type-options
nosniff
etag
"0d38d66b290da1:0"
content-type
image/png
accept-ranges
bytes
x-robots-tag
noindex
content-length
580
x-xss-protection
1; mode=block
visa.png
tradeguardians.org/Images/Issuers/Icons/ 		555 B
555 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tradeguardians.org/Images/Issuers/Icons/visa.png
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash
e209d6d6e97cb95d6246e176f50383d75b0ea94345c7cc1c0777e178935db3c5

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
Common.js
tradeguardians.org/prk/css/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/Common.js?2066
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
EasyPayment.js
tradeguardians.org/prk/css/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tradeguardians.org/prk/css/EasyPayment.js?1854
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
199.250.206.120 , United States, ASN54641 (IMH-IAD, US),
Reverse DNS
ded5926.inmotionhosting.com
Software
nginx/1.25.3 /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/prk/auto.html
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
content-encoding
br
server
nginx/1.25.3
vary
Accept-Encoding
content-type
text/html
transparentProgress.gif
epayment.nets.eu//terminal/Images/ 		723 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://epayment.nets.eu//terminal/Images/transparentProgress.gif
Requested by
Host: tradeguardians.org
URL: https://tradeguardians.org/prk/auto.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.117.170.23 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5a8f886ffb6afed6497f36d8940ab950086a2eb72fe82266f8ac96acc43a8de2
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
Strict-Transport-Security max-age=7776000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://tradeguardians.org/
Accept-Language
no-NO,no;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 27 Apr 2024 19:33:47 GMT
strict-transport-security
max-age=7776000
referrer-policy
origin-when-cross-origin
content-security-policy
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://localhost:44399 https://pay.google.com;
last-modified
Wed, 17 Apr 2024 10:31:26 GMT
x-content-type-options
nosniff
etag
"0d38d66b290da1:0"
content-type
image/gif
accept-ranges
bytes
x-robots-tag
noindex
content-length
723
x-xss-protection
1; mode=block
favicon_New.ico
epayment.nets.eu/Images/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
epayment.nets.eu
URL
https://epayment.nets.eu/Images/favicon_New.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Autopay (Transportation)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| easyPaymentCardNoId string| easyPaymentEpaySessionId string| easyPaymentCurrentIssuerImageId string| easyPaymentCurrentIssuerNameId string| easyPaymentvalidationRequired string| easyPaymentverificationLabel string| easyPaymentsecurityCode string| easyPaymentpopupLink object| easyPaymentIssuers boolean| easyPaymentDiscoverFlag object| chkMobileDevice

0 Cookies

7 Console Messages

Source Level URL
Text
network error URL: https://tradeguardians.org/prk/css/StyleSheet_ExistingTerminal.css?1610
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/prk/css/jquery.3.5.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/prk/css/Default.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/prk/css/TDSMethod.js?2052
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/prk/css/Common.js?2066
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/Images/Issuers/Icons/visa.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://tradeguardians.org/prk/css/EasyPayment.js?1854
Message:
Failed to load resource: the server responded with a status of 404 ()