refundyg.beget.tech
Open in
urlscan Pro
5.101.152.204
Malicious Activity!
Public Scan
Effective URL: http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/
Submission: On August 22 via manual from CA
Summary
This is the only time refundyg.beget.tech was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2400:cb00:204... 2400:cb00:2048:1::6819:1d70 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 8 | 5.101.152.204 5.101.152.204 | 198610 (BEGET-AS) (BEGET-AS) | |
9 | 198.103.206.11 198.103.206.11 | 2665 (CDAGOVN) (CDAGOVN - Shared Services Canada) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6813:c397 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
17 | 4 |
ASN198610 (BEGET-AS, RU)
PTR: m2.hippo.beget.com
refundyg.beget.tech |
ASN2665 (CDAGOVN - Shared Services Canada, CA)
PTR: apps.cra-arc.gc.ca
apps.cra-arc.gc.ca |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
cra-arc.gc.ca
apps.cra-arc.gc.ca |
228 KB |
8 |
beget.tech
2 redirects
refundyg.beget.tech |
19 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
3 KB |
1 |
googleapis.com
translate.googleapis.com |
4 KB |
1 |
gg.gg
1 redirects
gg.gg |
1 KB |
17 | 5 |
Domain | Requested by | |
---|---|---|
9 | apps.cra-arc.gc.ca |
refundyg.beget.tech
|
8 | refundyg.beget.tech |
2 redirects
refundyg.beget.tech
|
1 | cdnjs.cloudflare.com |
refundyg.beget.tech
|
1 | translate.googleapis.com |
refundyg.beget.tech
|
1 | gg.gg | 1 redirects |
17 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
impots-gouv.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
apps.cra-arc.gc.ca Entrust Certification Authority - L1K |
2017-10-19 - 2020-10-19 |
3 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-08-07 - 2018-10-16 |
2 months | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-04-14 - 2018-10-21 |
6 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/
Frame ID: 8A609F2218BE6DAA212A0C1B98556820
Requests: 15 HTTP requests in this frame
Frame:
https://apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/sig-en.svg
Frame ID: EFE21AB238EAEF8B7B85103E5C137434
Requests: 1 HTTP requests in this frame
Frame:
https://apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/wmms.svg
Frame ID: 1A03096A6FFBFB5A5EA3EFA4ECB6B57F
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://gg.gg/bgh4k
HTTP 301
http://refundyg.beget.tech/Support-refunded/ HTTP 302
http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb HTTP 301
http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/ Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Francais
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://gg.gg/bgh4k
HTTP 301
http://refundyg.beget.tech/Support-refunded/ HTTP 302
http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb HTTP 301
http://refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/ Redirect Chain
|
27 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.min.css
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/css/ |
195 KB 196 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apps.css
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/cra-arc/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
apps.cra-arc.gc.ca/ebci/fppp/mypymnt/pub/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
translateelement.css
translate.googleapis.com/translate_static/css/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.1.0.min.js
refundyg.beget.tech/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.maskedinput.js
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.png
refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.png
refundyg.beget.tech/Support-refunded/95374840f98a8ae3441f7ec0d425a7cb/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-leaf.jpg
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-bg.jpg
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sft-deco.gif
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ |
80 B 489 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sft-deco-leaf.gif
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ |
3 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.png
refundyg.beget.tech/ |
286 B 286 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.png
refundyg.beget.tech/ |
286 B 286 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig-en.svg
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ Frame EFE2 |
0 0 |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wmms.svg
apps.cra-arc.gc.ca/ebci/wet/v4.0.21/theme-gcwu-fegc/assets/ Frame 1A03 |
0 0 |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| type_carte1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
refundyg.beget.tech/ | Name: PHPSESSID Value: dd06b4d24edf9cbbab60811cb1378581 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apps.cra-arc.gc.ca
cdnjs.cloudflare.com
gg.gg
refundyg.beget.tech
translate.googleapis.com
198.103.206.11
2400:cb00:2048:1::6813:c397
2400:cb00:2048:1::6819:1d70
2a00:1450:4001:819::200a
5.101.152.204
00f2ee4ca169fdecfbec02820a7a7261338af760609fdcfb3a8279263e13a424
0a700c72c5db3eaab6ce5246d7b378fa51b92e01a01f321cbb55c963a6c6d02c
352e74be133b2633ede15ab1d9f60703978fe5c748571d79df4eb5b78cc11bdd
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
4bc84d72ddd5f02fe04613d1f1f7d5ee028eb9d108ba363808c9ee3aaf8c2d44
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
5b2157920d27ddba57a2902d89e3d3e1700132328ddb430bf77808d919151364
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
8d7f2ba2399633714abc5f8d0dbf0b2d8c2f6579651fbd40cd69ba6ed1ded06e
936d18afdc84cbe96028ca3ceb5266d3e3ee6564fe2856f7b466d924d9cb9b1a
b6b63296dc173ffd2fe053b7533057c0aaf9d9dbfd9ad18433587f2205886e2d
df336b3b45deb21ed39bd82713825f42b3aea311980b93c11bdc25e1a22d53e1
f8efe45ed564782a73052d1e76d64346b91005c491af7416bd1b5500c7e1f1e9