www.arabworldnewsnetwork.com Open in urlscan Pro
107.6.182.77  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request zlatan.php Show response www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/	7 KB 7 KB	389ms 376ms	Document text/html	107.6.182.77 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol HTTP/1.1 Server 107.6.182.77 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS vm521.tmdcloud.eu Software Apache / Resource Hash 3708792af5f48383399cd94648d02bf2866fa94fc607a724e7b373aeb16a0e6d Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language nl-NL,nl;q=0.9 Response headers Date Thu, 18 Nov 2021 01:23:56 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	screen.css acs4.3dsecure.no/mdpayacs/content/040/	3 KB 1 KB	1012ms 33ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/screen.css Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:23:58 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-c14" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	gh-buttons.css acs4.3dsecure.no/mdpayacs/content/040/dk/	13 KB 3 KB	1013ms 34ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:23:58 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-3290" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	commons.js Show response acs4.3dsecure.no/mdpayacs/content/	1 KB 823 B	1013ms 35ms	Script application/javascript	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/commons.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:23:58 GMT content-encoding gzip last-modified Thu, 04 Oct 2018 00:56:30 GMT server nginx etag W/"1202-1538614590000" vary Accept-Encoding content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	1013ms 35ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers
GET H/1.1	200 OK	date_time.js Show response www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/Autentisering_files/	823 B 1 KB	16ms 16ms	Script application/javascript	107.6.182.77 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Full URL http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/Autentisering_files/date_time.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol HTTP/1.1 Server 107.6.182.77 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS vm521.tmdcloud.eu Software Apache / Resource Hash c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Thu, 18 Nov 2021 01:23:57 GMT Last-Modified Wed, 17 Nov 2021 19:24:10 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 823
GET H2	200	Israel_Post_Logo.png logos-download.com/wp-content/uploads/2019/06/	188 KB 189 KB	222ms 146ms	Image image/png	2606:4700:e4::ac40:a716 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://logos-download.com/wp-content/uploads/2019/06/Israel_Post_Logo.png Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e4::ac40:a716 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / WordOps Resource Hash 51a24a187f57893ea3eb42100d659609111ad5b5c0cc66d1f392f3c385901286 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 18 Nov 2021 01:23:58 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-powered-by WordOps report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gIexa%2F%2BVKdpNYgxm4G6eZJEO6OPAz%2FdKT8K9qrtrLrgT%2BMWOAcgIsErG0oBuRYc7YytUHSzNCYIEJWYS0AssjrH0dhg35ycM3Cif%2F0S2GvrC1I%2Fs1%2FmwjZ10wRnH%2FXRatoE0wyDam6kYg7ga5Loy9V0%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 192403 x-xss-protection 1; mode=block referrer-policy no-referrer, strict-origin-when-cross-origin last-modified Wed, 26 Jun 2019 20:04:03 GMT server cloudflare x-frame-options SAMEORIGIN etag "5d13cfb3-2ef93" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-download-options noopen content-type image/png access-control-allow-origin * cache-control max-age=315360000 accept-ranges bytes cf-ray 6afd6580de2b5995-MXP expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	loader.gif www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/	3 KB 3 KB	16ms 16ms	Image image/gif	107.6.182.77 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Show image Full URL http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/loader.gif Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol HTTP/1.1 Server 107.6.182.77 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS vm521.tmdcloud.eu Software Apache / Resource Hash d924d966d44cf7973b34c92c74dc68237fec423d578f2c9497eaa0790900d71e Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Thu, 18 Nov 2021 01:23:58 GMT Last-Modified Wed, 17 Nov 2021 19:24:10 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3279
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	34ms 34ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.arabworldnewsnetwork.com URL: http://www.arabworldnewsnetwork.com/checkout-paymentprocessout/services.israelpost.co.il/dd32f325f2c3cae4bd7dc3edae4bc74c/zlatan.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9 Referer http://www.arabworldnewsnetwork.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| date_time number| count string| redirect function| countDown function| onBodyLoad function| validate function| incrementResendCount object| date number| year number| month object| months number| d number| day object| days string| h number| m string| s string| result

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
logos-download.com
www.arabworldnewsnetwork.com
107.6.182.77
185.42.168.133
2606:4700:e4::ac40:a716
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
3708792af5f48383399cd94648d02bf2866fa94fc607a724e7b373aeb16a0e6d
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
51a24a187f57893ea3eb42100d659609111ad5b5c0cc66d1f392f3c385901286
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb
d924d966d44cf7973b34c92c74dc68237fec423d578f2c9497eaa0790900d71e