group-gls-trans.on.fleek.co Open in urlscan Pro
2606:4700::6812:691  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request dispatch Show response group-gls-trans.on.fleek.co/	763 B 1 KB	1075ms 978ms	Document text/html	2606:4700::6812:691 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://group-gls-trans.on.fleek.co/dispatch Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f298aac736d93827525592022b70fb4807d8abe8b56661d7b8a3c0aaf22907ff Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With access-control-allow-methods GET,HEAD,OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output access-control-max-age 86400 cache-control max-age=10, stale-while-revalidate=600 cf-cache-status MISS cf-ray 7c8ba2f14cb5366c-FRA content-encoding gzip content-security-policy upgrade-insecure-requests content-type text/html date Wed, 17 May 2023 11:49:21 GMT expires Wed, 17 May 2023 15:49:21 GMT referrer-policy strict-origin-when-cross-origin server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding x-cache-status MISS x-content-type-options nosniff x-ipfs-path /ipfs/bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy/index.html x-ipfs-roots bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy,QmfTXR3yXS7Sc6YyacwoJv5fupatx3mkLbFtzvZgkwufC2 x-request-id 0990cdd179fb14a0b07ee29c2c7a79a4 x-xss-protection 0
GET H2	200	css2 fonts.googleapis.com/	6 KB 1 KB	138ms 49ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=PT+Serif:ital,wght@0,400;0,700;1,400;1,700&display=swap Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/dispatch Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 97731789d60e04aa4112bc8c2aa89d138fba339518083abb67fc554708989a72 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://group-gls-trans.on.fleek.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 17 May 2023 11:49:21 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 17 May 2023 11:38:12 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 17 May 2023 11:49:21 GMT
GET H2	200	index-b5d47e02.js Show response group-gls-trans.on.fleek.co/assets/	3 MB 940 KB	1066ms 1066ms	Script text/javascript	2606:4700::6812:691 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://group-gls-trans.on.fleek.co/assets/index-b5d47e02.js Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/dispatch Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 41b1359639970173f5465db77285951ec1b332e32aab62328644a9041e6f0d12 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://group-gls-trans.on.fleek.co/dispatch Origin https://group-gls-trans.on.fleek.co accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 17 May 2023 11:49:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status MISS content-encoding gzip content-security-policy upgrade-insecure-requests x-cache-status MISS x-xss-protection 0 x-request-id ff8b9899517f5b1d3ad3126b3b3c2469 referrer-policy strict-origin-when-cross-origin server cloudflare x-ipfs-roots bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy,QmduMydbcytLLEWs3XcWdDL8YQPied1aGbPFuiQQ4AijDD,QmeBwemMHzZuSjNyrUsMgwfiSADL6FSzBEESxg1NfikHmP etag W/"QmeBwemMHzZuSjNyrUsMgwfiSADL6FSzBEESxg1NfikHmP" vary Accept-Encoding access-control-allow-methods GET,HEAD,OPTIONS content-type text/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control max-age=10, stale-while-revalidate=600 x-ipfs-path /ipfs/bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy/assets/index-b5d47e02.js access-control-max-age 86400 cf-ray 7c8ba2f76c4d366c-FRA access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With expires Wed, 17 May 2023 15:49:22 GMT
GET H2	200	index-0cc14975.css group-gls-trans.on.fleek.co/assets/	99 KB 14 KB	953ms 953ms	Stylesheet text/css	2606:4700::6812:691 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://group-gls-trans.on.fleek.co/assets/index-0cc14975.css Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/dispatch Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0cc14975a660d78e9a62bf891600502e80d27c4711d5093df961119057a83221 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://group-gls-trans.on.fleek.co/dispatch User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 17 May 2023 11:49:22 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status MISS content-encoding gzip content-security-policy upgrade-insecure-requests x-cache-status MISS x-xss-protection 0 x-request-id 0352d40cfe3edd654ffabc2492e91a6c referrer-policy strict-origin-when-cross-origin server cloudflare x-ipfs-roots bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy,QmduMydbcytLLEWs3XcWdDL8YQPied1aGbPFuiQQ4AijDD,QmbsR7AdF4xFAB8G7xHdn7ZqerzDcojTFzqj4EaijWL35L etag W/"QmbsR7AdF4xFAB8G7xHdn7ZqerzDcojTFzqj4EaijWL35L" vary Accept-Encoding access-control-allow-methods GET,HEAD,OPTIONS content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control max-age=10, stale-while-revalidate=600 x-ipfs-path /ipfs/bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy/assets/index-0cc14975.css access-control-max-age 86400 cf-ray 7c8ba2f76c4c366c-FRA access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With expires Wed, 17 May 2023 15:49:22 GMT
GET H2	200	logo.png group-gls-trans.on.fleek.co/assets/images/	3 KB 3 KB	859ms 859ms	Image image/png	2606:4700::6812:691 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://group-gls-trans.on.fleek.co/assets/images/logo.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b18441f53458038f8cc98cf82ec198dd448507707b13794d8b7225b191d7019 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://group-gls-trans.on.fleek.co/dispatch User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 17 May 2023 11:49:24 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status MISS content-security-policy upgrade-insecure-requests x-cache-status MISS content-length 3096 x-xss-protection 0 x-request-id 86d7fb90d5f2ce7cb0565c8300c36efd referrer-policy strict-origin-when-cross-origin server cloudflare x-ipfs-roots bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy,QmduMydbcytLLEWs3XcWdDL8YQPied1aGbPFuiQQ4AijDD,QmXCvTVFXe7Ssdef6uVM4XDbxnXuRPfQN1ghWbUqZUqLCN,QmVRQ3iJq4tH4DHqApC9DZWwTpq6XbbVafbfVsETtH37sG etag "QmVRQ3iJq4tH4DHqApC9DZWwTpq6XbbVafbfVsETtH37sG" access-control-max-age 86400 access-control-allow-methods GET,HEAD,OPTIONS content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control max-age=10, stale-while-revalidate=600 x-ipfs-path /ipfs/bafybeie5woelqgcbhc55ucsl54myo4lhv35zeni3s3syssmsulwurvugpy/assets/images/logo.png vary Accept-Encoding accept-ranges bytes cf-ray 7c8ba3052c35366c-FRA access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With expires Wed, 17 May 2023 15:49:24 GMT
GET H/1.1	200 OK	increaseNumberOfVisitors Show response risingangel.cc/api/visitor/	2 B 269 B	235ms 122ms	XHR text/plain	41.216.188.131 PRIVATEHOSTING-NET
General Check archive.org Show headers Download Go to Full URL https://risingangel.cc/api/visitor/increaseNumberOfVisitors Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/assets/index-b5d47e02.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 41.216.188.131 Düsseldorf, Germany, ASN211138 (PRIVATEHOSTING-NET, IT), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Express Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Accept application/json, text/plain, */* Referer https://group-gls-trans.on.fleek.co/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers Date Wed, 17 May 2023 11:49:23 GMT Server nginx/1.18.0 (Ubuntu) X-Powered-By Express ETag W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin * Connection keep-alive Content-Length 2
GET H2	200	uim.json Show response api.iconify.design/	330 B 868 B	155ms 54ms	Fetch application/json	2606:4700:20::681a:ccc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.iconify.design/uim.json?icons=facebook-f Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/assets/index-b5d47e02.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:ccc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3e8d0ab4e7b56ccbff086b7bc3c4e671f51de9ba8db7be8dfcaecfa097bb834 Request headers accept-language de-DE,de;q=0.9 Referer https://group-gls-trans.on.fleek.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 17 May 2023 11:49:23 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare access-control-max-age 86400 access-control-allow-methods GET, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wHK55xc%2FX3PoUz1Kf7hda8196QUbpOlEtYxlofeBJ3jxQQKaXalZQeoq%2Fjr6mxKPzRcrXFzxOIX0t8xrB909DqEs0uRPed11Fl1dLkeXKDZdGR6DxDoXreNJwpayOLkmsRhOq3IkdlS%2FVOZsSOaRJQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control public, max-age=604800, min-refresh=604800, immutable cross-origin-resource-policy cross-origin cf-ray 7c8ba305eb299025-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Encoding
GET H2	200	ri.json Show response api.iconify.design/	889 B 815 B	160ms 59ms	Fetch application/json	2606:4700:20::681a:ccc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.iconify.design/ri.json?icons=linkedin-fill%2Cyoutube-fill Requested by Host: group-gls-trans.on.fleek.co URL: https://group-gls-trans.on.fleek.co/assets/index-b5d47e02.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:ccc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 23a30384a4fc17ac5c945fe4f3664cccd7850951a6c2ed0085c29d34a8ed8f24 Request headers accept-language de-DE,de;q=0.9 Referer https://group-gls-trans.on.fleek.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Wed, 17 May 2023 11:49:23 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare access-control-max-age 86400 access-control-allow-methods GET, OPTIONS content-type application/json; charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Umwrb5kS8%2BdaBvHOX1CI9QUth3fUMCV2Qw0mWicmenWvRK5yqe%2BG8qDkc1PK8BbNEjgh3as%2FS9W9keaESmUJeb1DRePRToKdFdqlhlVMRgyF9%2Fx70H5fWarvLW1D32%2FNxW07F%2Btr4cDP711NRzGdxw%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control public, max-age=604800, min-refresh=604800, immutable cross-origin-resource-policy cross-origin cf-ray 7c8ba305eb2a9025-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Encoding

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: General Logistic Systems (Transportation)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| __extends function| __assign function| __rest function| __decorate function| __param function| __esDecorate function| __runInitializers function| __propKey function| __setFunctionName function| __metadata function| __awaiter function| __generator function| __exportStar function| __createBinding function| __values function| __read function| __spread function| __spreadArrays function| __spreadArray function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| __makeTemplateObject function| __importStar function| __importDefault function| __classPrivateFieldGet function| __classPrivateFieldSet function| __classPrivateFieldIn

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.iconify.design
fonts.googleapis.com
group-gls-trans.on.fleek.co
risingangel.cc
2606:4700:20::681a:ccc
2606:4700::6812:691
2a00:1450:4001:828::200a
41.216.188.131
0cc14975a660d78e9a62bf891600502e80d27c4711d5093df961119057a83221
23a30384a4fc17ac5c945fe4f3664cccd7850951a6c2ed0085c29d34a8ed8f24
41b1359639970173f5465db77285951ec1b332e32aab62328644a9041e6f0d12
4b18441f53458038f8cc98cf82ec198dd448507707b13794d8b7225b191d7019
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
97731789d60e04aa4112bc8c2aa89d138fba339518083abb67fc554708989a72
e3e8d0ab4e7b56ccbff086b7bc3c4e671f51de9ba8db7be8dfcaecfa097bb834
f298aac736d93827525592022b70fb4807d8abe8b56661d7b8a3c0aaf22907ff