urlscan.io logo urlscan.io
SecurityTrails logo

ws047.weisonmedia.com.tw Open in urlscan Pro
61.221.12.76  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ws047.weisonmedia.com.tw/wp-user/index.php?emc=%24bWNoaUBzeW1wYXRpY28uY2E%3D
Effective URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf2...
Submission: On July 22 via manual from TW — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 61.221.12.76, located in Kaohsiung City, Taiwan and belongs to HINET Data Communication Business Group, TW. The main domain is ws047.weisonmedia.com.tw.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 8th 2022. Valid for: 3 months.
This is the only time ws047.weisonmedia.com.tw was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BCE-Bell (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
10 61.221.12.76 3462 (HINET Dat...)
4 178.79.243.0 ()
15 3
Apex Domain
Subdomains		 Transfer
10 weisonmedia.com.tw
ws047.weisonmedia.com.tw
1 MB
4 llnwd.net
pfobellweb.hs.llnwd.net
120 KB
15 2
Domain Requested by
10 ws047.weisonmedia.com.tw ws047.weisonmedia.com.tw
4 pfobellweb.hs.llnwd.net ws047.weisonmedia.com.tw
15 2

This site contains no links.

Subject Issuer Validity Valid
ws047.weisonmedia.com.tw
cPanel, Inc. Certification Authority		 2022-06-08 -
2022-09-06		 3 months crt.sh
*.hs.llnwd.net
Sectigo RSA Domain Validation Secure Server CA		 2022-03-18 -
2023-04-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Frame ID: F9630E3FB5E2123CB830251A936ECED8
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bell Webmail

Page URL History Show full URLs

  1. https://ws047.weisonmedia.com.tw/wp-user/index.php?emc=%24bWNoaUBzeW1wYXRpY28uY2E%3D Page URL
  2. https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e81... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

15
Requests

93 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1239 kB
Transfer

1241 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ws047.weisonmedia.com.tw/wp-user/index.php?emc=%24bWNoaUBzeW1wYXRpY28uY2E%3D Page URL
  2. https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.php
ws047.weisonmedia.com.tw/wp-user/ 		513 B
456 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/index.php?emc=%24bWNoaUBzeW1wYXRpY28uY2E%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
68106374af755da3f014fc65ddbbfdea3cb988df095503161b5328cb1b5f5427

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 22 Jul 2022 07:28:26 GMT
server
Apache
vary
Accept-Encoding
Primary Request L688cf1yae1865c88.php
ws047.weisonmedia.com.tw/wp-user/ 		19 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
34dafe48c40ee6a33c5e2f0405b984d53b160aa6a1dff4aa6ff624aad9e3b95a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 22 Jul 2022 07:28:26 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
bell.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		808 KB
814 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
e27750bd8f7add80437b9f5a75626739f8342e30fd35dd6ff302d96330b59964

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
827699
content-type
text/css
bell(1).css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell(1).css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
b00754524869bd430ae18a373883452a633e41736b58188d3109fc6b5f36238f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
4376
content-type
text/css
registrationFlow-login.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		32 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/registrationFlow-login.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
721a7bb35cd1aa6b81bbb4e1d197e84003142a72abf045dfe47b29948edc1a79

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
32939
content-type
text/css
login-tracker-icon.min.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/login-tracker-icon.min.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
55b8eb223e37f7bfab42aa9d5144ee52a14df40dd279260bcf7d5b0a68d140a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
1302
content-type
text/css
login-tracker.min.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/login-tracker.min.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
41d5494dc24c7bf70ec0a23e9e96a3cbeb166d4f842c674d93605178ef05acef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
11923
content-type
text/css
bell(2).css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		244 KB
246 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell(2).css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
7c70a0312594726ce839d13a6cca394df912b64b0d1fe1c2fe1858f0597c4245

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
250261
content-type
text/css
fonts.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/fonts.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
053bfcc5e83a414860621f457b4af3dc94a85dc56b7514d7188be47cfa8eca36

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
2364
content-type
text/css
bell_custom_deprecatedbrowser_new.css
ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell_custom_deprecatedbrowser_new.css
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
61.221.12.76 Kaohsiung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS
weison.rockpie.com
Software
Apache /
Resource Hash
5dd4f75a33a397e43c440b1d6ffcfda71f004d0a31cc0894b665ac2f0ff2ad6d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ws047.weisonmedia.com.tw/wp-user/L688cf1yae1865c88.php?emc=$bWNoaUBzeW1wYXRpY28uY2E=&ea0042cacaa28e812381760931cf77cadbf28051a0f5cdf55c20b35546883bb112d65e4daf2d6f6b5974fbb63ae0a9feed6d2a9f6f4978d1c5c90ab8059362438c7714f403621b1de92b4d5eee54437e19a3e47cdb323d901889
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 07:28:27 GMT
last-modified
Mon, 02 Nov 2020 16:11:26 GMT
server
Apache
accept-ranges
bytes
content-length
1214
content-type
text/css
img_login_MyBell_spring_update.jpg
ws047.weisonmedia.com.tw/Styles/images/ 		0
0
bellslim_regular-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 		19 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_regular-webfont.woff2?ver=00000000
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
178.79.243.0 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
3e4d8f00673f6a80b26a8565f9931374e1e9171553b078261a67772af7511629
Security Headers
Name Value
Content-Security-Policy frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://ws047.weisonmedia.com.tw/
Origin
https://ws047.weisonmedia.com.tw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 22 Jul 2022 07:28:31 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Age
16437
Connection
keep-alive
Content-Length
19412
X-XSS-Protection
1
Last-Modified
Sun, 19 Jan 2020 06:54:19 GMT
X-Generated-By
O-9X-T07
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Content-Security-Policy
frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Accept-Ranges
bytes
X-LLID
37d9de0dcf7ca7f20a021ed516a410d7
Expires
Sat, 23 Jul 2022 02:54:34 GMT
bellslim_medium-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 		19 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_medium-webfont.woff2?ver=00000000
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
178.79.243.0 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e36f3860d6fe12df58872c55cf1fb78b7a3fe86d9a27591bfda5d8ceb34a31f3
Security Headers
Name Value
Content-Security-Policy frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://ws047.weisonmedia.com.tw/
Origin
https://ws047.weisonmedia.com.tw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 22 Jul 2022 07:28:31 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Age
16422
Connection
keep-alive
Content-Length
19880
X-XSS-Protection
1
Last-Modified
Sun, 19 Jan 2020 06:54:19 GMT
X-Generated-By
O-9X-T04
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Content-Security-Policy
frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Accept-Ranges
bytes
X-LLID
60cc88b30efdb50f92fb72aa2bced590
Expires
Sat, 23 Jul 2022 02:54:49 GMT
bell-icon.woff
pfobellweb.hs.llnwd.net/Styles/BRF2/Master/core/fonts/ 		59 KB
61 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://pfobellweb.hs.llnwd.net/Styles/BRF2/Master/core/fonts/bell-icon.woff?ver=201910200707
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell(2).css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
178.79.243.0 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
bea03e289208b0ca394d3ed7ddf39f8be8f1570808fbc70055717770b7dab181
Security Headers
Name Value
Content-Security-Policy frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca *.luckymobile.ca *.virginplus.ca; script-src https://*.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://*.google-analytics.com https://*.postescanada-canadapost.ca https://*.digital.nuance.com https://*.inq.com https://connect.facebook.net https://static.ads-twitter.com https://*.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://*.google.com https://*.gstatic.com https://*.vmobile.ca https://*.googleadservices.com https://*.stackadapt.com https://*.doubleclick.net https://*.virginplus.ca https://*.bell.ca https://*.tiktok.com https://*.know-where.com https://*.korem.com https://*.googleapis.com https://*.coveo.com https://siteimproveanalytics.com https://*.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://*.medallia.ca https://*.kampyle.com https://*.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://ws047.weisonmedia.com.tw/
Origin
https://ws047.weisonmedia.com.tw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 22 Jul 2022 07:28:31 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Age
16255
Connection
keep-alive
Content-Length
60340
X-XSS-Protection
1
Last-Modified
Wed, 23 Feb 2022 01:49:45 GMT
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Content-Security-Policy
frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca *.luckymobile.ca *.virginplus.ca; script-src https://*.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://*.google-analytics.com https://*.postescanada-canadapost.ca https://*.digital.nuance.com https://*.inq.com https://connect.facebook.net https://static.ads-twitter.com https://*.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://*.google.com https://*.gstatic.com https://*.vmobile.ca https://*.googleadservices.com https://*.stackadapt.com https://*.doubleclick.net https://*.virginplus.ca https://*.bell.ca https://*.tiktok.com https://*.know-where.com https://*.korem.com https://*.googleapis.com https://*.coveo.com https://siteimproveanalytics.com https://*.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://*.medallia.ca https://*.kampyle.com https://*.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Accept-Ranges
bytes
X-LLID
376064f08a19ffaa55d56fefa4e1c9ba
Expires
Sat, 23 Jul 2022 02:57:36 GMT
bellslim_semibold-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 		19 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_semibold-webfont.woff2?ver=00000000
Requested by
Host: ws047.weisonmedia.com.tw
URL: https://ws047.weisonmedia.com.tw/wp-user/E68EB3671Y9/bell.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
178.79.243.0 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
41407c31a0d44bb952744a390decccd0a4ba5918e4ff89c860f2495d5ee7a7fe
Security Headers
Name Value
Content-Security-Policy frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Strict-Transport-Security max-age=16070400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

Referer
https://ws047.weisonmedia.com.tw/
Origin
https://ws047.weisonmedia.com.tw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Fri, 22 Jul 2022 07:28:31 GMT
Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Age
16255
Connection
keep-alive
Content-Length
19348
X-XSS-Protection
1
Last-Modified
Sun, 19 Jan 2020 06:54:19 GMT
X-Generated-By
O-9X-T06
X-Frame-Options
SAMEORIGIN
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Content-Security-Policy
frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Accept-Ranges
bytes
X-LLID
3c21ced65f556f893ee75fa18beb2fdb
Expires
Sat, 23 Jul 2022 02:57:36 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ws047.weisonmedia.com.tw
URL
https://ws047.weisonmedia.com.tw/Styles/images/img_login_MyBell_spring_update.jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BCE-Bell (Telecommunication)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

2 Cookies

Domain/Path Name / Value
ws047.weisonmedia.com.tw/wp-user Name: drake
Value: dexter
ws047.weisonmedia.com.tw/ Name: PHPSESSID
Value: 4629ddb8a1b08c3bbb72c58b2721be60