omg-group.com
Open in
urlscan Pro
2a06:98c1:3121::c
Malicious Activity!
Public Scan
Submission: On August 03 via automatic, source openphish — Scanned from NL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 7th 2022. Valid for: a year.
This is the only time omg-group.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a06:98c1:312... 2a06:98c1:3121::c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 172.64.147.33 172.64.147.33 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 34.251.201.224 34.251.201.224 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 35.196.226.51 35.196.226.51 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 109.169.71.112 109.169.71.112 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 3.220.57.224 3.220.57.224 | 14618 (AMAZON-AES) (AMAZON-AES) | |
19 | 8 |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-201-224.eu-west-1.compute.amazonaws.com
ppllabs.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 51.226.196.35.bc.googleusercontent.com
risingsunopp.org |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-57-224.compute-1.amazonaws.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
visaprepaidprocessing.com
www.visaprepaidprocessing.com — Cisco Umbrella Rank: 323356 |
74 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2902 |
253 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 262 |
30 KB |
1 |
smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 116535 |
1 KB |
1 |
risingsunopp.org
risingsunopp.org |
39 KB |
1 |
ppllabs.com
ppllabs.com |
|
1 |
omg-group.com
omg-group.com — Cisco Umbrella Rank: 524954 |
7 KB |
19 | 7 |
Domain | Requested by | |
---|---|---|
7 | www.visaprepaidprocessing.com |
omg-group.com
www.visaprepaidprocessing.com |
1 | api.ipify.org |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
omg-group.com
|
1 | smtpjs.com |
omg-group.com
|
1 | risingsunopp.org |
omg-group.com
|
1 | ppllabs.com |
omg-group.com
|
1 | omg-group.com | |
19 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-07 - 2023-05-07 |
a year | crt.sh |
www.visaprepaidprocessing.com Cloudflare Inc ECC CA-3 |
2022-05-07 - 2023-05-07 |
a year | crt.sh |
ppllabs.com R3 |
2022-06-21 - 2022-09-19 |
3 months | crt.sh |
risingsunopp.org R3 |
2022-06-06 - 2022-09-04 |
3 months | crt.sh |
smtpjs.com R3 |
2022-07-18 - 2022-10-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-07-11 - 2022-10-03 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2022-02-07 - 2023-03-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://omg-group.com/wp-admin/includes/tt/EDDUpdateForm.html
Frame ID: CF9BB2E19A0B92079347ADC798A29DAC
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
RRDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
ZURB Foundation (Web Frameworks) Expand
Detected patterns
- <link[^>]+foundation[^>"]+css
- <div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
EDDUpdateForm.html
omg-group.com/wp-admin/includes/tt/ |
42 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
www.visaprepaidprocessing.com/bundles/foundation/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
www.visaprepaidprocessing.com/bundles/ |
290 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
preventEarlyClickCss
www.visaprepaidprocessing.com/bundles/ |
45 B 372 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site.css
www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Styles/ |
65 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.gif
ppllabs.com/wp-content/uploads/2018/10/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
print
www.visaprepaidprocessing.com/bundles/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
California-Emplorment-Development-Department.png
risingsunopp.org/wp-content/uploads/ |
38 KB 39 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EmailLogo.png
www.visaprepaidprocessing.com/content/PRC384/_images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Regular-webfont.woff
www.visaprepaidprocessing.com/Content/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Connections.woff
www.visaprepaidprocessing.com/content/PRC384/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Bold-webfont.woff
www.visaprepaidprocessing.com/Content/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
23 B 253 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Connections.ttf
www.visaprepaidprocessing.com/content/PRC384/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Regular-webfont.ttf
www.visaprepaidprocessing.com/Content/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Bold-webfont.ttf
www.visaprepaidprocessing.com/Content/_Fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.woff
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.woff
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.woff
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.ttf
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.ttf
- Domain
- www.visaprepaidprocessing.com
- URL
- https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| Email function| sendEmailL function| sendEmailC function| sendEmail function| sendEmail2 function| sendEmail3 function| sendEmail4 function| sendEmail5 function| sendEmail6 function| $ function| jQuery3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.visaprepaidprocessing.com/ | Name: __cflb Value: 0H28uxchcBYFcUJ7agzKikmQw5nqRP4BNiRPkvXnqoJ |
|
.visaprepaidprocessing.com/ | Name: __cfruid Value: 7656b1e54afce816a8ca700953ec318f841f02d8-1659488563 |
|
.visaprepaidprocessing.com/ | Name: __cf_bm Value: igA4VCuS02D.O.uDVuRQsl9cWFhBsa_jNmQLoO6qp.4-1659488563-0-AUY6Yn5sTFX75gdKy0ypoNL/ixxT9+v2v2LZwM/EKL5syq1RChp4KXoG4wK9hKO/aBAQo6oFqya04tPbOMesOAE= |
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
omg-group.com
ppllabs.com
risingsunopp.org
smtpjs.com
www.visaprepaidprocessing.com
www.visaprepaidprocessing.com
109.169.71.112
172.64.147.33
2a00:1450:4001:80e::200a
2a06:98c1:3121::c
3.220.57.224
34.251.201.224
35.196.226.51
0dc0f45d9a73d5280864572618e856d9d2b3d8d1aa94d5ba976edd2880113c70
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
3858f34e4486a332c393949478d230625a2c07507dd54bfe274cafb93cadbb3a
42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49
5e2aabe93299c82250d8d6952e7eec0d120c95b45ddc24175f187dd530543205
6d926638fec19cfb6b7c198a7cbd5ba4933a966bc20aea5fb14db35c3318c46c
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9125b08d73099fe6cc8ec181f39edc63439b48442010ec2635791578f9e3b4ed
9ac51812f3c5052b6c14281e132a55b2c5603b4170e8440cca32ebbff26fe866
ad62eb85667532488d032273c196c7ea1c10e0897223c4b66cd38b8c5e5215a4
db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42a916188a514a0a199e43604cade7a8ea93c324b5b661a5dbb11055d10d459