wearefiberly.com Open in urlscan Pro
132.148.239.32  Malicious Activity! Public Scan

Submitted URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/
Effective URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x...
Submission Tags: phishing malicious Search All
Submission: On April 27 via api from US

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 132.148.239.32, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is wearefiberly.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 6th 2021. Valid for: 3 months.
This is the only time wearefiberly.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 5 132.148.239.32 398101 (GO-DADDY-...)
1 2.16.186.248 20940 (AKAMAI-ASN1)
1 104.111.215.162 16625 (AKAMAI-AS)
6 3
Apex Domain
Subdomains
Transfer
5 wearefiberly.com
wearefiberly.com
38 KB
1 secureserver.net
img.secureserver.net
637 B
1 wsimg.com
img1.wsimg.com
5 KB
6 3
Domain Requested by
5 wearefiberly.com 1 redirects wearefiberly.com
1 img.secureserver.net
1 img1.wsimg.com wearefiberly.com
6 3

This site contains no links.

Subject Issuer Validity Valid
wearefiberly.com
cPanel, Inc. Certification Authority
2021-04-06 -
2021-07-05
3 months crt.sh
*.wsimg.com
Starfield Secure Certificate Authority - G2
2021-03-05 -
2022-04-06
a year crt.sh
*.secureserver.net
Starfield Secure Certificate Authority - G2
2019-10-22 -
2021-10-22
2 years crt.sh

This page contains 1 frames:

Primary Page: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
Frame ID: 03744FD120976068DBFD980A9884E214
Requests: 6 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/ HTTP 302
    https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?c... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

43 kB
Transfer

121 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/ HTTP 302
    https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/
Redirect Chain
  • https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/
  • https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
7 KB
2 KB
Document
General
Full URL
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.239.32 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-239-32.ip.secureserver.net
Software
Apache / PHP/7.3.23
Resource Hash
289a7464c02b5f522cd4d8e48c181cf9f4f0ec5621775d175c64ad8b239b5f6c

Request headers

:method
GET
:authority
wearefiberly.com
:scheme
https
:path
/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=b889c66d7d222c89ea72fecdf23351a8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 07:08:28 GMT
server
Apache
x-powered-by
PHP/7.3.23
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
2478
content-type
text/html; charset=UTF-8

Redirect headers

date
Tue, 27 Apr 2021 07:08:28 GMT
server
Apache
x-powered-by
PHP/7.3.23
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=b889c66d7d222c89ea72fecdf23351a8; path=/
location
myaccount/signin/?country.x=DE&locale.x=en_DE
vary
User-Agent
content-length
0
content-type
text/html; charset=UTF-8
L-Z118.css
wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/L-Z118.css
Requested by
Host: wearefiberly.com
URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.239.32 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-239-32.ip.secureserver.net
Software
Apache /
Resource Hash
1bcda772b32139bbd18696ba5a08fc2da9731cecf88d6b904cb953107484f55f

Request headers

:path
/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/L-Z118.css
pragma
no-cache
cookie
PHPSESSID=b889c66d7d222c89ea72fecdf23351a8
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
wearefiberly.com
referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 07:08:28 GMT
content-encoding
gzip
last-modified
Thu, 22 Apr 2021 02:09:41 GMT
server
Apache
etag
"1446a1-3332-5c0862c1c8143-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
3306
jquery.js
wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/js/
84 KB
30 KB
Script
General
Full URL
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/js/jquery.js
Requested by
Host: wearefiberly.com
URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.239.32 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-239-32.ip.secureserver.net
Software
Apache /
Resource Hash
2a1f1370eb7b24a307312112427dfd544fb838a8bef66babc936f5e870a22e52

Request headers

:path
/wp-admin/information/customer_center/customer-IDPP00C616/lib/js/jquery.js
pragma
no-cache
cookie
PHPSESSID=b889c66d7d222c89ea72fecdf23351a8
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
wearefiberly.com
referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 07:08:28 GMT
content-encoding
gzip
last-modified
Thu, 22 Apr 2021 02:09:41 GMT
server
Apache
etag
"144684-15147-5c0862c1c2383-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
30011
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/
12 KB
5 KB
Script
General
Full URL
https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js
Requested by
Host: wearefiberly.com
URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/myaccount/signin/?country.x=DE&locale.x=en_DE
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.16.186.248 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-248.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350

Request headers

Referer
https://wearefiberly.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 07:08:28 GMT
content-encoding
gzip
last-modified
Fri, 31 Mar 2017 16:26:41 GMT
etag
"52ef5c943baad21:0"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
4564
expires
Wed, 27 Apr 2022 07:08:28 GMT
kl_h4aXX6987PO.svg
wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/img/
5 KB
2 KB
Image
General
Full URL
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/img/kl_h4aXX6987PO.svg
Requested by
Host: wearefiberly.com
URL: https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/L-Z118.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
132.148.239.32 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
ip-132-148-239-32.ip.secureserver.net
Software
Apache /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Request headers

:path
/wp-admin/information/customer_center/customer-IDPP00C616/lib/img/kl_h4aXX6987PO.svg
pragma
no-cache
cookie
PHPSESSID=b889c66d7d222c89ea72fecdf23351a8
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
wearefiberly.com
referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/L-Z118.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://wearefiberly.com/wp-admin/information/customer_center/customer-IDPP00C616/lib/css/L-Z118.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 07:08:28 GMT
content-encoding
gzip
last-modified
Thu, 22 Apr 2021 02:09:41 GMT
server
Apache
etag
"14468b-1351-5c0862c1c42c3-gzip"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
accept-ranges
bytes
content-length
1929
event
img.secureserver.net/t/1/tl/
43 B
637 B
Image
General
Full URL
https://img.secureserver.net/t/1/tl/event?cts=1619507309384&tce=1619507308443&tcs=1619507308443&tdc=1619507309182&tdclee=1619507309182&tdcles=1619507309182&tdi=1619507309182&tdl=1619507308647&tdle=1619507308443&tdls=1619507308443&tfs=1619507308443&tns=1619507307899&trqs=1619507308444&tre=1619507308644&trps=1619507308644&tles=1619507309182&tlee=1619507309183&ht=perf&dh=wearefiberly.com&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F89.0.4389.72%20Safari%2F537.36&vci=770040630&cv=1.0.6&z=737059483&vg=24ecee6d-9392-40f0-b4f1-07c48e5f6715&vtg=24ecee6d-9392-40f0-b4f1-07c48e5f6715&ap=cpbh&trfd=%7B%22cts%22%3A1619507309182%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpbh%22%2C%22server%22%3A%22p3plvcpnl402870%22%2C%22id%22%3A%226955795%22%7D&dp=%2Fwp-admin%2Finformation%2Fcustomer_center%2Fcustomer-IDPP00C616%2Fmyaccount%2Fsignin
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://wearefiberly.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 ; includeSubDomains
X-Content-Type-Options
nosniff
Date
Tue, 27 Apr 2021 07:08:29 GMT
X-Frame-Options
DENY
Access-Control-Allow-Methods
GET, PUT, POST, DELETE, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://wearefiberly.com, *
Access-Control-Max-Age
1000
Cache-Control
private
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
43
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true

1 Cookies

Domain/Path Name / Value
wearefiberly.com/ Name: PHPSESSID
Value: b889c66d7d222c89ea72fecdf23351a8