winbestgift.live
Open in
urlscan Pro
185.150.117.181
Malicious Activity!
Public Scan
Effective URL: https://winbestgift.live/upsca/?cep=qcMPP6FNE6vq9e7-7PA0NQnoyRtvx1dZE-ljUSXqQmRMdV75nwq31GnjP5_0YFIw0np8TbFpht_8HgP5pm3oI...
Submission: On November 09 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on November 1st 2021. Valid for: 3 months.
This is the only time winbestgift.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Tracking (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 165.227.186.88 165.227.186.88 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 1 | 18.195.174.160 18.195.174.160 | 16509 (AMAZON-02) (AMAZON-02) | |
1 11 | 185.150.117.181 185.150.117.181 | 16125 (CHERRYSER...) (CHERRYSERVERS1-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2003 | () () | |
1 | 51.77.64.70 51.77.64.70 | 16276 (OVH) (OVH) | |
1 1 | 216.58.212.142 216.58.212.142 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2004 | () () | |
14 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
track.trckcell.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
winbestgift.live
1 redirects
winbestgift.live |
196 KB |
2 |
google.com
1 redirects
google.com www.google.com |
455 B |
1 |
ip-api.com
pro.ip-api.com |
461 B |
1 |
gstatic.com
fonts.gstatic.com |
|
1 |
googleapis.com
fonts.googleapis.com |
980 B |
1 |
trckcell.com
1 redirects
track.trckcell.com |
1 KB |
1 |
d27.me
1 redirects
d27.me |
263 B |
14 | 7 |
Domain | Requested by | |
---|---|---|
11 | winbestgift.live |
1 redirects
winbestgift.live
|
1 | www.google.com |
winbestgift.live
|
1 | google.com | 1 redirects |
1 | pro.ip-api.com |
winbestgift.live
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
winbestgift.live
|
1 | track.trckcell.com | 1 redirects |
1 | d27.me | 1 redirects |
14 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
winbestgift.live R3 |
2021-11-01 - 2022-01-30 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
*.ip-api.com Sectigo RSA Domain Validation Secure Server CA |
2021-10-28 - 2022-11-27 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
This page contains 1 frames:
Frame:
https://www.google.com/
Frame ID: 74566021563AD54149D840E6A42EA950
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://d27.me/9lOLRk
HTTP 302
https://track.trckcell.com/4f8f1c5c-237e-46ec-bc89-9ff8d5e12f35 HTTP 302
https://winbestgift.live/upsca?cep=qcMPP6FNE6vq9e7-7PA0NQnoyRtvx1dZE-ljUSXqQmRMdV75nwq31GnjP5_0YFIw0n... HTTP 301
https://winbestgift.live/upsca/?cep=qcMPP6FNE6vq9e7-7PA0NQnoyRtvx1dZE-ljUSXqQmRMdV75nwq31GnjP5_0YFIw0... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://d27.me/9lOLRk
HTTP 302
https://track.trckcell.com/4f8f1c5c-237e-46ec-bc89-9ff8d5e12f35 HTTP 302
https://winbestgift.live/upsca?cep=qcMPP6FNE6vq9e7-7PA0NQnoyRtvx1dZE-ljUSXqQmRMdV75nwq31GnjP5_0YFIw0np8TbFpht_8HgP5pm3oIT1lV72r6UBzJF70cg7TIS01PQVKHHmXRj9oh1JXxBqVbf9y0OtAu9qXzH7BJTcDCrQ_TX1PmmvIRI2V-8rJVgMd4HrANwo47Z_KsCKtILfkyAw8qXmY5-p0rjO0g10hSSeRwNZns0OPAHzoDIy3upNlSBtunimqVpWo5eP135-f6HB8_cPPwHy1IQZOV6cyYAizF53CZyWJqmZVsLS0DWOzg1VYLlRJaQTSYjuKplD_NG2H3MsMDL7ts9fSShstecqeM4zq7pAs8_XsWYAHTR0&lptoken=16a4360248f844c48333 HTTP 301
https://winbestgift.live/upsca/?cep=qcMPP6FNE6vq9e7-7PA0NQnoyRtvx1dZE-ljUSXqQmRMdV75nwq31GnjP5_0YFIw0np8TbFpht_8HgP5pm3oIT1lV72r6UBzJF70cg7TIS01PQVKHHmXRj9oh1JXxBqVbf9y0OtAu9qXzH7BJTcDCrQ_TX1PmmvIRI2V-8rJVgMd4HrANwo47Z_KsCKtILfkyAw8qXmY5-p0rjO0g10hSSeRwNZns0OPAHzoDIy3upNlSBtunimqVpWo5eP135-f6HB8_cPPwHy1IQZOV6cyYAizF53CZyWJqmZVsLS0DWOzg1VYLlRJaQTSYjuKplD_NG2H3MsMDL7ts9fSShstecqeM4zq7pAs8_XsWYAHTR0&lptoken=16a4360248f844c48333 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://google.com/ HTTP 301
- https://www.google.com/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
winbestgift.live/upsca/ Redirect Chain
|
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 980 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
winbestgift.live/upsca/assets/css/ |
34 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr.js
winbestgift.live/upsca/assets/js/ |
51 KB 52 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
winbestgift.live/upsca/assets/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
svg4everybody.min.js
winbestgift.live/upsca/assets/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
init.js
winbestgift.live/upsca/assets/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
winbestgift.live/upsca/assets/js/ |
822 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-IPS.png
winbestgift.live/upsca/assets/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-box.svg
winbestgift.live/upsca/assets/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ |
1 KB 0 |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
json
pro.ip-api.com/ |
305 B 461 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.svg
winbestgift.live/upsca/icons/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/ Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Tracking (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.track.trckcell.com/ | Name: 4f8f1c5c-237e-46ec-bc89-9ff8d5e12f35-v4 Value: v7c6TmTVEmdyHbe_C5A1pkT8RMz6ACu8vWm2gEgi6Kw |
|
.track.trckcell.com/ | Name: cep-v4 Value: DbOLBGn0vbdXjlONMM2RWjoumZeLYCV5Vh38x-5Z-tQpnuTlRLybr7SogIs7J5mrLsBnze82HTTfSRsecZSI6WHn4Lm5cYZrA4M7lyObOGccvHpt319B_s4dwzIRuQG-xdPVSz87gDKoMYBB3nuHWCKHk7r76iDw2UenxOzGQ1y5qqvvIiXbNnUZegjNgIHenN7CHytfCdi4_C9qWro7tYGYxkH8AUWGNuCcRRGDZmo-kvsAckW7_KVp2LJpbusfcvbSofzLdw3Y6Z2HgVmZSrwrNiohyBApUAxm34UCvSv9kzpritqubOVaq3S0WG-IL1ZRYbuOxZGTQL6kZ-Jt-FyZbCZ-WCcHXqHrMNTK_Jw |
|
.google.com/ | Name: CONSENT Value: PENDING+942 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d27.me
fonts.googleapis.com
fonts.gstatic.com
google.com
pro.ip-api.com
track.trckcell.com
winbestgift.live
www.google.com
165.227.186.88
18.195.174.160
185.150.117.181
216.58.212.142
2a00:1450:4001:808::2003
2a00:1450:4001:809::200a
2a00:1450:4001:810::2004
51.77.64.70
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2398c8646b883a1083728c264db3aadecdc7ba6cf15aea928da0b66093fc7f58
3076c80eafb62b744c1565061b83c8d999e1b7c5aa0dd609c3539efff8ecef50
53608723aa31f6fd7faeb61c827bbd1c9c2a0926bc7dbe529c7beb34a46d7a0b
62f7ef6281d5e0db3f14298ca3707ee3a9f61d1ee85ac5fa5dade011eafb32e9
77db7a255409ecd1036154011cabd46ba94ddd3b7a091f1b866e3c1f90db7229
8c7c8a10e19e2e3bdf6d4fce49a8805a11996caed3d0e450f59276406258e6b0
9d35285186da7d9bd029f1e2f9b787c1c83b702988bf28f8b72a64902f21f4c3
dd9ea35cb75623d8ebc40c9303200c50ee7f652b8cdb3ff1d28246e92d3dd89d
fa81b5e4f963094a1cfe0a07f0ff3385c7f79513974c1023d34df795b9f9834f