ezpvatoll.com
Open in
urlscan Pro
45.202.32.12
Malicious Activity!
Public Scan
Effective URL: https://ezpvatoll.com/
Submission: On August 14 via api from BE — Scanned from US
Summary
TLS certificate: Issued by E5 on August 11th 2024. Valid for: 3 months.
This is the only time ezpvatoll.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: E-ZPass (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 45.202.32.12 45.202.32.12 | 215208 (DOLPHINNE...) (DOLPHINNETWORKS) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c01::68 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c0d::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c1d::5e | 15169 (GOOGLE) (GOOGLE) | |
2 | 173.194.66.106 173.194.66.106 | 15169 (GOOGLE) (GOOGLE) | |
7 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
google.com
www.google.com — Cisco Umbrella Rank: 10 |
1 KB |
2 |
ezpvatoll.com
ezpvatoll.com |
2 KB |
1 |
gstatic.com
www.gstatic.com |
210 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
33 KB |
7 | 4 |
Domain | Requested by | |
---|---|---|
3 | www.google.com |
ezpvatoll.com
www.gstatic.com |
2 | ezpvatoll.com | |
1 | www.gstatic.com |
www.google.com
|
1 | ajax.googleapis.com |
ezpvatoll.com
|
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ezpvatoll.com E5 |
2024-08-11 - 2024-11-09 |
3 months | crt.sh |
www.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://ezpvatoll.com/
Frame ID: 8FB22EE498143C2FA2AD1F3D2EBCD48F
Requests: 5 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdrGtUpAAAAAK-dbfz86CGmMFXc80wCwsEVjzGb&co=aHR0cHM6Ly9lenB2YXRvbGwuY29tOjQ0Mw..&hl=en&v=hfUfsXWZFeg83qqxrK27GB8P&theme=light&size=normal&cb=p61xdwjvunuh
Frame ID: 57D8F036C799588A3BDB04A8997234E1
Requests: 1 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=en&v=hfUfsXWZFeg83qqxrK27GB8P&k=6LdrGtUpAAAAAK-dbfz86CGmMFXc80wCwsEVjzGb
Frame ID: 31EDF7068A6C08ECE1F9D64837E290EF
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://ezpvatoll.com/
HTTP 307
https://ezpvatoll.com/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- <div[^>]+class="g-recaptcha"
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ezpvatoll.com/
HTTP 307
https://ezpvatoll.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ezpvatoll.com/ Redirect Chain
|
1 KB 934 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/hfUfsXWZFeg83qqxrK27GB8P/ |
531 KB 210 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame 57D8 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 31ED |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
ezpvatoll.com/ |
1 KB 809 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: E-ZPass (Transportation)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery function| onReturnCallback object| recaptcha object| closure_lm_4975551 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ezpvatoll.com/ | Name: PHPSESSID Value: ec2e5toi4e4cdnttatm1u7j627 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
ezpvatoll.com
www.google.com
www.gstatic.com
173.194.66.106
2607:f8b0:400d:c01::68
2607:f8b0:400d:c0d::5f
2607:f8b0:400d:c1d::5e
45.202.32.12
679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43
70925c4bda48e2ae325950aab67fe70a75dc2984b9e4f5844f4858c5adf6ef2b
9b6d2f09aa2416468dec4e312d1d959497aca309e7d8eb0fc85494d6e81a1967
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
e96a5e1e04ee3d7ffd8118f853ec2c0bcbf73b571cfa1c710238557baf5dd896