www.bestsatbooks.com Open in urlscan Pro
158.69.28.113 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bestsatbooks.com/token.php
Submission: On February 14 via automatic, source openphish (February 14th 2023, 1:13:42 pm UTC) — Scanned from CA

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 158.69.28.113, located in Montreal, Canada and belongs to OVH, FR. The main domain is www.bestsatbooks.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 12th 2023. Valid for: 3 months.

This is the only time www.bestsatbooks.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ficohsa (Banking)

Domain & IP information

	IP Address	AS Autonomous System
11	158.69.28.113 158.69.28.113	16276 (OVH) (OVH)
3	2600:1f18:18e... 2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d	14618 (AMAZON-AES) (AMAZON-AES)
14	3

11 158.69.28.113 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ip113.ip-158-69-28.net

www.bestsatbooks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

spmfondo.ficohsa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	bestsatbooks.com www.bestsatbooks.com	914 KB
3	ficohsa.com spmfondo.ficohsa.com — Cisco Umbrella Rank: 540380	61 KB
14	2

	Domain	Requested by
11	www.bestsatbooks.com	www.bestsatbooks.com
3	spmfondo.ficohsa.com	www.bestsatbooks.com spmfondo.ficohsa.com
14	2

This site contains links to these domains. Also see Links.

Domain
www.ficohsa.com

Subject Issuer	Validity	Valid
bestsatbooks.com cPanel, Inc. Certification Authority	`2023-01-12` - `2023-04-12`	3 months	crt.sh
spmfondo.ficohsa.com DigiCert SHA2 Extended Validation Server CA	`2022-05-10` - `2023-04-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.bestsatbooks.com/token.php
Frame ID: 56B05F8E66979165B8622A8B922B9562
Requests: 14 HTTP requests in this frame

Frame: https://www.bestsatbooks.com/Ficohsa_files/index.html
Frame ID: DE39A035599C9244D0C790AEFC3B5804
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ficohsa

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

985 kB
Transfer

986 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ficohsa.com/
Title: www.ficohsa.com

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request token.php Show response
www.bestsatbooks.com/ 602 KB
602 KB 70ms
46ms Document
text/html 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: 35948c790adfc14835f9526dc98a6905b230a2fdb537c25a4018df8025ec63e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 14 Feb 2023 13:13:38 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK styles.b1d6cdcc40a888de1051.bundle.css
www.bestsatbooks.com/Ficohsa_files/ 149 KB
150 KB 31ms
10ms Stylesheet
text/css 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:17 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 152931

GET
H/1.1 200 login.js Show response
spmfondo.ficohsa.com/scriptdealer/script/v1/f49vdl/ 60 KB
60 KB 118ms
68ms Script
application/javascript 2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/scriptdealer/script/v1/f49vdl/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Requested by

Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0e4c40bc28eccb92bd4a57325326b5c73dd2f7db26d27e43058bcf7be42faca

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: no-referrer-when-downgrade
content-security-policy: script-src 'self'
x-content-type-options: nosniff
x-frame-options: DENY
Content-Type: application/javascript
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
Connection: keep-alive
Content-Length: 61294
x-xss-protection: 1;mode=block

GET
H/1.1 200
OK prismaWeb.css
www.bestsatbooks.com/Ficohsa_files/ 123 KB
123 KB 10ms
10ms Stylesheet
text/css 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/prismaWeb.css
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: 9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:17 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 125903

GET
H/1.1 200
OK keyboardLowerCaseLowContrast.png
www.bestsatbooks.com/Ficohsa_files/ 6 KB
6 KB 17ms
17ms Image
image/png 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bestsatbooks.com/Ficohsa_files/keyboardLowerCaseLowContrast.png
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:16 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5633

GET
H/1.1 200
OK 13f6ebd6-3a21-4455-8ac2-f131aaf35295
www.bestsatbooks.com/Ficohsa_files/ 26 KB
26 KB 16ms
16ms Image
image/jpeg 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bestsatbooks.com/Ficohsa_files/13f6ebd6-3a21-4455-8ac2-f131aaf35295
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: 49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:16 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 26472

GET
H/1.1 200
OK inline.ca44eecbf42bd41b6278.bundle.js.descarga Show response
www.bestsatbooks.com/Ficohsa_files/ 3 KB
3 KB 29ms
11ms Script
application/javascript 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/inline.ca44eecbf42bd41b6278.bundle.js.descarga
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: c22d821094b3d472f6f18084c1b86acaff29b3592d4991a931c3b4d4eb2ed45a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:16 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2663

GET
H/1.1 200
OK b.png
www.bestsatbooks.com/Ficohsa_files/ 3 KB
3 KB 32ms
10ms Image
image/png 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bestsatbooks.com/Ficohsa_files/b.png
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: 86276561ee24a6a86f5368e2ddbf9581253d60bbbd6b9a2df02ad5fd4f2152c5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/token.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Last-Modified: Sat, 11 Feb 2023 20:55:15 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3079

GET
H/1.1 404
Not Found prisma_fonts.css
www.bestsatbooks.com/css/ 0
0 19ms
11ms Stylesheet
text/html 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/css/prisma_fonts.css
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/Ficohsa_files/prismaWeb.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.bestsatbooks.com/Ficohsa_files/prismaWeb.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

Request headers

Referer
Origin: https://www.bestsatbooks.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H/1.1 404
Not Found streamline.8d9b0fde522024284eb5.woff
www.bestsatbooks.com/Ficohsa_files/ 0
0 11ms
10ms Font
text/html 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/streamline.8d9b0fde522024284eb5.woff?19c5cw
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bestsatbooks.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Origin: https://www.bestsatbooks.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found streamline.e985056bc25713f2f8cd.ttf
www.bestsatbooks.com/Ficohsa_files/ 0
0 10ms
10ms Font
text/html 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/streamline.e985056bc25713f2f8cd.ttf?19c5cw
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash

Request headers

Referer: https://www.bestsatbooks.com/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Origin: https://www.bestsatbooks.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found index.html Show response
www.bestsatbooks.com/Ficohsa_files/ Frame DE39 315 B
515 B 10ms
10ms Document
text/html 158.69.28.113
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bestsatbooks.com/Ficohsa_files/index.html
Requested by: Host: www.bestsatbooks.com
URL: https://www.bestsatbooks.com/token.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 158.69.28.113 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip113.ip-158-69-28.net
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://www.bestsatbooks.com/token.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1
Date: Tue, 14 Feb 2023 13:13:38 GMT
Keep-Alive: timeout=5, max=97
Server: Apache

OPTIONS
H/1.1 200 pageFeatures
spmfondo.ficohsa.com/requestserver/rest/v1/ Frame 0
0 77ms
27ms Preflight 2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/requestserver/rest/v1/pageFeatures?sessionId=x&clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bestsatbooks.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 14 Feb 2023 13:13:38 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-requested-with, content-type
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://www.bestsatbooks.com
access-control-max-age: 3600
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-security-policy: script-src 'self'
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1;mode=block

POST
H/1.1 200 pageFeatures Show response
spmfondo.ficohsa.com/requestserver/rest/v1/ 81 B
1 KB 75ms
74ms XHR
application/json 2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://spmfondo.ficohsa.com/requestserver/rest/v1/pageFeatures?sessionId=x&clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394

Requested by

Host: spmfondo.ficohsa.com
URL: https://spmfondo.ficohsa.com/scriptdealer/script/v1/f49vdl/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a31cf4ad543cdd5a8e1eb02faf46d3ece367e19dd51bb1645e3687423b7353a4

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1;mode=block

Request headers

Referer: https://www.bestsatbooks.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/json

Response headers

Date: Tue, 14 Feb 2023 13:13:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: script-src 'self'
Transfer-Encoding: chunked
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
Connection: keep-alive
x-xss-protection: 1;mode=block
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 3600
access-control-allow-methods: POST, OPTIONS
Content-Type: application/json
access-control-allow-origin: https://www.bestsatbooks.com
x-frame-options: DENY
access-control-allow-credentials: true
permissions-policy: fullscreen=();microphone=();camera=();speaker=();
access-control-allow-headers: x-requested-with, content-type

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ficohsa (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spmfondo.ficohsa.com/requestserver/rest/v1	1970-01-20 09:39:42	Name: herok Value: 2886860804yEdpRKJYUAvKNspi3k8HuNhfqAKuWQ
			spmfondo.ficohsa.com/requestserver/rest/v1	1969-12-31 23:59:59	Name: kirby Value: 2886860804yEdpRKJYUAvKNspi3k8HuNhfqAKuWQ

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.bestsatbooks.com/css/prisma_fonts.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bestsatbooks.com/Ficohsa_files/streamline.8d9b0fde522024284eb5.woff?19c5cw Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bestsatbooks.com/Ficohsa_files/streamline.e985056bc25713f2f8cd.ttf?19c5cw Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.bestsatbooks.com/Ficohsa_files/index.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spmfondo.ficohsa.com
www.bestsatbooks.com
158.69.28.113
2600:1f18:18ef:ed10:9038:d87b:a79a:2d0d
35948c790adfc14835f9526dc98a6905b230a2fdb537c25a4018df8025ec63e0
49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e
86276561ee24a6a86f5368e2ddbf9581253d60bbbd6b9a2df02ad5fd4f2152c5
9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0
a0e4c40bc28eccb92bd4a57325326b5c73dd2f7db26d27e43058bcf7be42faca
a31cf4ad543cdd5a8e1eb02faf46d3ece367e19dd51bb1645e3687423b7353a4
b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd
c22d821094b3d472f6f18084c1b86acaff29b3592d4991a931c3b4d4eb2ed45a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d7d908335b484d3310b807cbf69b666341a6234b6eeaa337f8b779dc9411d025
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

www.bestsatbooks.com Open in urlscan Pro 158.69.28.113 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

985 kBTransfer

986 kBSize

2 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

4 Console Messages

Indicators

www.bestsatbooks.com Open in urlscan Pro
158.69.28.113 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

985 kB
Transfer

986 kB
Size

2
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!