thinktechservicellc.com Open in urlscan Pro
192.129.167.178 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://thinktechservicellc.com/confirm.php?regh=
Submission: On July 08 via automatic, source openphish (July 8th 2023, 3:20:39 pm UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 192.129.167.178, located in United States and belongs to HOSTWINDS, US. The main domain is thinktechservicellc.com.

This is the only time thinktechservicellc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ficohsa (Banking)

Domain & IP information

	IP Address	AS Autonomous System
11	192.129.167.178 192.129.167.178	54290 (HOSTWINDS) (HOSTWINDS)
3	2600:1f18:18e... 2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687	14618 (AMAZON-AES) (AMAZON-AES)
14	3

11 192.129.167.178 (United States)

ASN54290 (HOSTWINDS, US)
PTR: client-192-129-167-178.hostwindsdns.com

thinktechservicellc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

spmfondo.ficohsa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	thinktechservicellc.com thinktechservicellc.com	914 KB
3	ficohsa.com spmfondo.ficohsa.com — Cisco Umbrella Rank: 520560	61 KB
14	2

	Domain	Requested by
11	thinktechservicellc.com	thinktechservicellc.com
3	spmfondo.ficohsa.com	thinktechservicellc.com spmfondo.ficohsa.com
14	2

This site contains links to these domains. Also see Links.

Domain
www.ficohsa.com

Subject Issuer	Validity	Valid
spmfondo.ficohsa.com DigiCert EV RSA CA G2	`2023-04-20` - `2024-04-16`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://thinktechservicellc.com/confirm.php?regh=
Frame ID: C7629095CD39B961FFE45315EC743FCC
Requests: 14 HTTP requests in this frame

Frame: http://thinktechservicellc.com/Ficohsa_files/index.html
Frame ID: CCD6D2DA6E8C71B3EE862BDB6D246FD7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ficohsa

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

14
Requests

21 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

984 kB
Transfer

986 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ficohsa.com/
Title: www.ficohsa.com

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request confirm.php Show response
thinktechservicellc.com/ 602 KB
602 KB 413ms
145ms Document
text/html 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: fc97c4ac405f6c69dc94f260f62b2b997946664f20f36c5b65bc523eacc73af5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sat, 08 Jul 2023 15:20:34 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK styles.b1d6cdcc40a888de1051.bundle.css
thinktechservicellc.com/Ficohsa_files/ 149 KB
150 KB 141ms
141ms Stylesheet
text/css 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:34 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 152931

GET
H/1.1 200 login.js Show response
spmfondo.ficohsa.com/scriptdealer/script/v1/zmkfo6/ 60 KB
60 KB 1677ms
146ms Script
application/javascript 2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/scriptdealer/script/v1/zmkfo6/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Requested by

Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

68b86a7320da4855f1482477cc616ef1e33f193db558207be122edb0f065d125

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: no-referrer-when-downgrade
content-security-policy: script-src 'self'
x-content-type-options: nosniff
x-frame-options: DENY
Content-Type: application/javascript
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
Connection: keep-alive
Content-Length: 61141
x-xss-protection: 1;mode=block

GET
H/1.1 200
OK prismaWeb.css
thinktechservicellc.com/Ficohsa_files/ 123 KB
123 KB 142ms
141ms Stylesheet
text/css 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/prismaWeb.css
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: 9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 125903

GET
H/1.1 200
OK keyboardLowerCaseLowContrast.png
thinktechservicellc.com/Ficohsa_files/ 6 KB
6 KB 140ms
140ms Image
image/png 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://thinktechservicellc.com/Ficohsa_files/keyboardLowerCaseLowContrast.png
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5633

GET
H/1.1 200
OK b.png
thinktechservicellc.com/Ficohsa_files/ 3 KB
3 KB 287ms
144ms Image
image/png 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://thinktechservicellc.com/Ficohsa_files/b.png
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: 86276561ee24a6a86f5368e2ddbf9581253d60bbbd6b9a2df02ad5fd4f2152c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3079

GET
H/1.1 200
OK 13f6ebd6-3a21-4455-8ac2-f131aaf35295
thinktechservicellc.com/Ficohsa_files/ 26 KB
26 KB 286ms
143ms Image
image/jpeg 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://thinktechservicellc.com/Ficohsa_files/13f6ebd6-3a21-4455-8ac2-f131aaf35295
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: 49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 26472

GET
H/1.1 200
OK inline.ca44eecbf42bd41b6278.bundle.js.descarga Show response
thinktechservicellc.com/Ficohsa_files/ 3 KB
3 KB 281ms
142ms Script
application/javascript 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/inline.ca44eecbf42bd41b6278.bundle.js.descarga
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: c22d821094b3d472f6f18084c1b86acaff29b3592d4991a931c3b4d4eb2ed45a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/confirm.php?regh=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Last-Modified: Sat, 28 Jan 2023 20:25:08 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2663

GET
H/1.1 404
Not Found prisma_fonts.css
thinktechservicellc.com/css/ 0
0 141ms
141ms Stylesheet
text/html 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/css/prisma_fonts.css
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/Ficohsa_files/prismaWeb.css
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/Ficohsa_files/prismaWeb.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://thinktechservicellc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

Request headers

Referer: http://thinktechservicellc.com/
Origin: http://thinktechservicellc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H/1.1 404
Not Found streamline.8d9b0fde522024284eb5.woff
thinktechservicellc.com/Ficohsa_files/ 0
0 143ms
143ms Font
text/html 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/streamline.8d9b0fde522024284eb5.woff?19c5cw
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://thinktechservicellc.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Origin: http://thinktechservicellc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found index.html Show response
thinktechservicellc.com/Ficohsa_files/ Frame CCD6 315 B
515 B 141ms
141ms Document
text/html 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/index.html
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/confirm.php?regh=
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: http://thinktechservicellc.com/confirm.php?regh=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1
Date: Sat, 08 Jul 2023 15:20:35 GMT
Keep-Alive: timeout=5, max=97
Server: Apache

GET
H/1.1 404
Not Found streamline.e985056bc25713f2f8cd.ttf
thinktechservicellc.com/Ficohsa_files/ 0
0 143ms
143ms Font
text/html 192.129.167.178
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL: http://thinktechservicellc.com/Ficohsa_files/streamline.e985056bc25713f2f8cd.ttf?19c5cw
Requested by: Host: thinktechservicellc.com
URL: http://thinktechservicellc.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Protocol: HTTP/1.1
Server: 192.129.167.178 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS: client-192-129-167-178.hostwindsdns.com
Software: Apache /
Resource Hash

Request headers

Referer: http://thinktechservicellc.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Origin: http://thinktechservicellc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 08 Jul 2023 15:20:35 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

OPTIONS
H/1.1 200 pageFeatures
spmfondo.ficohsa.com/requestserver/rest/v1/ Frame 0
0 339ms
114ms Preflight 2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/requestserver/rest/v1/pageFeatures?sessionId=x&clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://thinktechservicellc.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Sat, 08 Jul 2023 15:20:36 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-requested-with, content-type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: http://thinktechservicellc.com
access-control-max-age: 3600
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-security-policy: script-src 'self'
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1;mode=block

POST
H/1.1 200 pageFeatures Show response
spmfondo.ficohsa.com/requestserver/rest/v1/ 81 B
1 KB 301ms
301ms XHR
application/json 2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/requestserver/rest/v1/pageFeatures?sessionId=x&clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394

Requested by

Host: spmfondo.ficohsa.com
URL: https://spmfondo.ficohsa.com/scriptdealer/script/v1/zmkfo6/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

50ed77dae7bff5098429933e474b9f6a82edfc60e62c595f16abe5ad6846a955

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

Referer: http://thinktechservicellc.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

Date: Sat, 08 Jul 2023 15:20:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: script-src 'self'
Transfer-Encoding: chunked
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
Connection: keep-alive
x-xss-protection: 1;mode=block
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 3600
access-control-allow-methods: POST, OPTIONS
Content-Type: application/json
access-control-allow-origin: http://thinktechservicellc.com
x-frame-options: DENY
access-control-allow-credentials: true
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
access-control-allow-headers: x-requested-with, content-type

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ficohsa (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spmfondo.ficohsa.com/requestserver/rest/v1	1970-01-20 13:07:11	Name: herok Value: 2886860804CaAvoIUOYilz1v6zleJD847AeeVEuu
			spmfondo.ficohsa.com/requestserver/rest/v1	1969-12-31 23:59:59	Name: kirby Value: 2886860804CaAvoIUOYilz1v6zleJD847AeeVEuu

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://thinktechservicellc.com/css/prisma_fonts.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://thinktechservicellc.com/Ficohsa_files/streamline.8d9b0fde522024284eb5.woff?19c5cw Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://thinktechservicellc.com/Ficohsa_files/index.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://thinktechservicellc.com/Ficohsa_files/streamline.e985056bc25713f2f8cd.ttf?19c5cw Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spmfondo.ficohsa.com
thinktechservicellc.com
192.129.167.178
2600:1f18:18ef:ed11:d2a2:6d1f:2f9e:8687
49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e
50ed77dae7bff5098429933e474b9f6a82edfc60e62c595f16abe5ad6846a955
68b86a7320da4855f1482477cc616ef1e33f193db558207be122edb0f065d125
86276561ee24a6a86f5368e2ddbf9581253d60bbbd6b9a2df02ad5fd4f2152c5
9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0
b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd
c22d821094b3d472f6f18084c1b86acaff29b3592d4991a931c3b4d4eb2ed45a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62
fc97c4ac405f6c69dc94f260f62b2b997946664f20f36c5b65bc523eacc73af5

thinktechservicellc.com Open in urlscan Pro 192.129.167.178 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

21 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

984 kBTransfer

986 kBSize

2 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

2 Cookies

4 Console Messages

Indicators

thinktechservicellc.com Open in urlscan Pro
192.129.167.178 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

21 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

984 kB
Transfer

986 kB
Size

2
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!