Submitted URL: https://www.mdp.edu.ar/utd/wp-includes/iog.html
Effective URL: https://h1studio.com/assets/fonts/slick/2/wise/
Submission: On September 22 via api from DE — Scanned from DE

Summary

This website contacted 6 IPs in 5 countries across 5 domains to perform 10 HTTP transactions. The main IP is 103.15.235.138, located in Singapore and belongs to DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU. The main domain is h1studio.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 20th 2022. Valid for: 3 months.
This is the only time h1studio.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wise (Online)

Domain & IP information

IP Address AS Autonomous System
1 200.0.182.9 27981 (Universid...)
6 103.15.235.138 38719 (DREAMSCAP...)
1 2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.18.30.50 13335 (CLOUDFLAR...)
10 6
Apex Domain
Subdomains
Transfer
6 h1studio.com
h1studio.com
210 KB
2 tailwindcss.com
cdn.tailwindcss.com — Cisco Umbrella Rank: 120565
97 KB
1 wise.com
wise.com — Cisco Umbrella Rank: 54731
1 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 293
34 KB
1 mdp.edu.ar
www.mdp.edu.ar
698 B
10 5
Domain Requested by
6 h1studio.com www.mdp.edu.ar
h1studio.com
2 cdn.tailwindcss.com 1 redirects h1studio.com
1 wise.com h1studio.com
1 ajax.googleapis.com h1studio.com
1 www.mdp.edu.ar
10 5

This site contains no links.

Subject Issuer Validity Valid
www.mdp.edu.ar
R3
2022-09-10 -
2022-12-09
3 months crt.sh
h1studio.com
cPanel, Inc. Certification Authority
2022-09-20 -
2022-12-19
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-08-29 -
2022-11-21
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-10 -
2023-08-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://h1studio.com/assets/fonts/slick/2/wise/
Frame ID: FE0E98313C029E702015A9372078E2E3
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Wise - Login

Page URL History Show full URLs

  1. https://www.mdp.edu.ar/utd/wp-includes/iog.html Page URL
  2. https://h1studio.com/assets/fonts/slick/2/wise/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

5
Countries

342 kB
Transfer

629 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.mdp.edu.ar/utd/wp-includes/iog.html Page URL
  2. https://h1studio.com/assets/fonts/slick/2/wise/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://cdn.tailwindcss.com/ HTTP 302
  • https://cdn.tailwindcss.com/3.1.8

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
iog.html
www.mdp.edu.ar/utd/wp-includes/
408 B
698 B
Document
General
Full URL
https://www.mdp.edu.ar/utd/wp-includes/iog.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
200.0.182.9 Mar del Plata, Argentina, ASN27981 (Universidad Nacional de Mar del Plata, AR),
Reverse DNS
pino.mdp.edu.ar
Software
Apache/2.4.38 (Debian) /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
268
Content-Type
text/html
Date
Thu, 22 Sep 2022 11:18:20 GMT
ETag
"198-5e933ccfb26db-gzip"
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 21 Sep 2022 18:06:15 GMT
Server
Apache/2.4.38 (Debian)
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Primary Request /
h1studio.com/assets/fonts/slick/2/wise/
19 KB
19 KB
Document
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/
Requested by
Host: www.mdp.edu.ar
URL: https://www.mdp.edu.ar/utd/wp-includes/iog.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
c3f74b4f55583f7852e8e2b0cdd6b06e6992e5103dec7d56639f2bdc52097c0e

Request headers

Referer
https://www.mdp.edu.ar/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
19495
Content-Type
text/html
Date
Thu, 22 Sep 2022 11:18:21 GMT
Keep-Alive
timeout=1, max=50
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
3.1.8
cdn.tailwindcss.com/
Redirect Chain
  • https://cdn.tailwindcss.com/
  • https://cdn.tailwindcss.com/3.1.8
319 KB
97 KB
Script
General
Full URL
https://cdn.tailwindcss.com/3.1.8
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
H2
Server
2606:4700:20::ac43:4ad5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d6e7e5263fa38ed2725e4be49d49fdca61aa60f92ffc1edbd0c3b47dc8c9e2b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 22 Sep 2022 11:18:21 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 05 Aug 2022 17:01:21 GMT
x-vercel-id
syd1::iad1::5cswb-1659718880314-e36b19295c12
age
4126618
x-vercel-cache
MISS
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BvSx6iU8pKEAnE%2FALmh2QztKWxF2yYBoTTWugRgIoHLC4jgBIcdnPa8H%2FSZU0roDVln6eVS1PHaRLPM2MlrC7vO6P5ESBcMy0k01jM%2BD7TvWn%2FEpT4zFAnYEz9JwAJ9ljYGPTIq0MNxhoBY75sIaYDg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cache-control
max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=63072000
cf-ray
74eaa3af39976919-FRA
server
cloudflare

Redirect headers

date
Thu, 22 Sep 2022 11:18:21 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-vercel-id
syd1::iad1::cxxnh-1663845116411-9c6b0b41f0c8
age
245
x-vercel-cache
MISS
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pCGTptTeCEqUc7ffJn2180axZoPfaPJnUZUfcHdOXEX1HHlmn07DqUHO489Z1SUdMk%2BlDi0aTky8eRlX0NhIB0n604N9SUpFGEqqnfpLhlyxHDRVdFY5ZJK%2BijRlNR%2BXVncoAEpVhkwuP%2FCEg%2F9CZT8%3D"}],"group":"cf-nel","max_age":604800}
location
/3.1.8
cache-control
max-age=14400
strict-transport-security
max-age=63072000
cf-ray
74eaa3af19676919-FRA
content-length
0
server
cloudflare
style.css
h1studio.com/assets/fonts/slick/2/wise/assets/
2 KB
2 KB
Stylesheet
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/assets/style.css
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
a3373de7d6210fe5ad031dff3f456008feebed35d5e76821de013103e6c24f1f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/assets/fonts/slick/2/wise/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Thu, 22 Sep 2022 11:18:21 GMT
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=49
Content-Length
1607
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/
95 KB
34 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 22 Sep 2022 10:00:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4700
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33951
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Sep 2023 10:00:01 GMT
wise.png
h1studio.com/assets/fonts/slick/2/wise/assets/
101 KB
101 KB
Image
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/assets/wise.png
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
dafcee0c81270acb40d0cd64fb6c9f16c97c290ecf251761b933895eca44e9fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/assets/fonts/slick/2/wise/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Thu, 22 Sep 2022 11:18:21 GMT
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=48
Content-Length
103615
brand_logo.svg
wise.com/public-resources/assets/logos/wise/
985 B
1 KB
Image
General
Full URL
https://wise.com/public-resources/assets/logos/wise/brand_logo.svg
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.30.50 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c32b6681302c9688e8c7597a688a9908c3dbbcf3880adcaf33b3e236153169a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Thu, 22 Sep 2022 11:18:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
957
content-type
image/svg+xml
x-envoy-upstream-service-time
20
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
W8GQ54X2EF8YB6MF
x-amz-id-2
dsQFszL3yryfff4s+3ZzKKDDaCzSsoBlXL1zuNooaT/bo5BUd4bCbKj0UjXKk1jx67TT1nBdlVg=
last-modified
Thu, 16 Jun 2022 12:48:18 GMT
server
cloudflare
etag
W/"b1037b69d5b2463005bb7ac08244fa11"
strict-transport-security
max-age=31536000
x-amz-version-id
jdU6PZrnTfS6nmSIS6XRhYtnpnshCske
vary
Accept-Encoding
cache-control
public,max-age=86400,s-maxage=3600,stale-while-revalidate=604800,stale-if-error=604800
x-envoy-attempt-count
1
cf-ray
74eaa3b17cdf9ba6-FRA
2fa.png
h1studio.com/assets/fonts/slick/2/wise/assets/
47 KB
47 KB
Image
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/assets/2fa.png
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
d55468352f5ae50dabbdfcb7eb584f2c85198d125047453912d0bbf322ba6605

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/assets/fonts/slick/2/wise/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Thu, 22 Sep 2022 11:18:21 GMT
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=50
Content-Length
48026
code.png
h1studio.com/assets/fonts/slick/2/wise/assets/
37 KB
38 KB
Image
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/assets/code.png
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
54e4117f8085c3dddefcc8766883ec8ea9c2bd354b3cbf6c1cc91b3790ac47fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/assets/fonts/slick/2/wise/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Thu, 22 Sep 2022 11:18:21 GMT
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=49
Content-Length
38245
main.js
h1studio.com/assets/fonts/slick/2/wise/
2 KB
2 KB
Script
General
Full URL
https://h1studio.com/assets/fonts/slick/2/wise/main.js
Requested by
Host: h1studio.com
URL: https://h1studio.com/assets/fonts/slick/2/wise/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.15.235.138 , Singapore, ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU),
Reverse DNS
v235138.serveradd.com
Software
Apache /
Resource Hash
96b0ec9a85efeb687fa292ae788bb2e67aaf0ce134131bb0abca48533d6fd3f4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://h1studio.com/assets/fonts/slick/2/wise/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Thu, 22 Sep 2022 11:18:21 GMT
Last-Modified
Wed, 21 Sep 2022 18:02:45 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=1, max=50
Content-Length
2303
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a78c9e170e339d1c8ff65b90eabbb3678da1726b7b953bed0e8149f851fae9e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
741 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
315607e8ea06ac28fb54e0affd09f0facd805ccd1d631dc57050dc856f7cefa4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
947 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3654c9cf52fe535d9318210918ad766fae532fe390c9524c27166952109622c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wise (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| tailwind function| $ function| jQuery string| /template.html function| sendcode

1 Cookies

Domain/Path Name / Value
.wise.com/ Name: __cf_bm
Value: 11Pnv2mU4M6cd0nWArcpXIuDuVX9kFBk2dzj5O_vJo4-1663845501-0-AbMyahALegLedwSa94amEcRrv+u5l2XVWccCxwmwzVEoORSgARhvzjRogEVaxTyvdYz7UrozNcySSQEbKaBS9sMsn99V5hTNixt++LZXFeLZ

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Frame-Options SAMEORIGIN