mpgrup.ro Open in urlscan Pro
188.212.252.11  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://hamariaawaz.com/kc.php Page URL
2. https://mpgrup.ro/wp-admin/main/continue Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	kc.php Show response hamariaawaz.com/	84 B 601 B	413ms 76ms	Document text/html	2606:4700:3034::ac43:98d2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hamariaawaz.com/kc.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:98d2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/8.1.17 Resource Hash dcf5678b949e5508b7cf6159443b82d36b2896e64a30da86f03e34f54ca8b7c4 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7ba32a77683c6955-FRA content-encoding br content-type text/html; charset=UTF-8 date Wed, 19 Apr 2023 06:42:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCCwPj4H9RFNQgXCu9Lw6YJJXgGZX%2FglsnDx5RTwboKPuRDUnQxz2GYhvIaHq%2FaxKm3y9yUB2NVn9G57zmdOi3WBtYFkL1SzZdti8%2FRV%2B%2FKCWtisNUDBPXW8%2BJXN1JOnbvUKwKoMR5tCbOM70oE%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/8.1.17 x-turbo-charged-by LiteSpeed
GET H2	200	Primary Request continue Show response mpgrup.ro/wp-admin/main/	15 KB 11 KB	1232ms 993ms	Document text/html	188.212.252.11 CLAUSWEB
General Check archive.org Show headers Download Go to Full URL https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 188.212.252.11 Bucharest, Romania, ASN203053 (CLAUSWEB, RO), Reverse DNS cw188-bab-beb11.romania-webhosting.com Software LiteSpeed / Resource Hash 43c412f54626d9f35bd333575decf7bbef35c6e2079c997c525d8da6c242d45a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://hamariaawaz.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Wed, 19 Apr 2023 06:42:10 GMT expect-ct enforce, max-age=21600 expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache referrer-policy no-referrer server LiteSpeed strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H2	404	recaptcha__id.js www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/	0 0	645ms 592ms	Script text/html	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer Origin https://mpgrup.ro accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Wed, 19 Apr 2023 06:42:11 GMT x-content-type-options nosniff server sffe content-type text/html; charset=UTF-8 access-control-allow-origin * cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1621 x-xss-protection 0
GET H2	200	api.js Show response www.google.com/recaptcha/	850 B 874 B	146ms 93ms	Script text/javascript	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 4e69c68f5c5b6c87b4b0437ddce158f64c43653e489a7f0731492243ea115ad7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Wed, 19 Apr 2023 06:42:10 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 554 x-xss-protection 1; mode=block expires Wed, 19 Apr 2023 06:42:10 GMT
GET H/1.1	200 OK	index.815c601ede0bda3f6d4b.css accounts.scdn.co/css/	280 KB 49 KB	123ms 60ms	Stylesheet text/css	2a04:4e42:8d::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Date Wed, 19 Apr 2023 06:42:10 GMT Content-Encoding gzip Age 596314 x-amz-meta-goog-reserved-file-mtime 1551867855 X-Cache HIT, HIT x-goog-metageneration 1 x-goog-stored-content-encoding identity Connection keep-alive Content-Length 49311 X-Served-By cache-chi-kigq8000093-CHI, cache-fra-eddf8230056-FRA Last-Modified Wed, 06 Mar 2019 10:24:23 GMT ETag "cef7c640274beae0e4bb740e11be8ee3" x-goog-generation 1551867863234713 Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=31536000, no-transform x-goog-stored-content-length 286521 Accept-Ranges bytes X-Cache-Hits 36, 1
GET H2	404	recaptcha__fr.js www.gstatic.com/recaptcha/api2/v1550471573786/	0 0	78ms 29ms	Script text/html	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__fr.js Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	79ms 22ms	Script text/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 19 Apr 2023 06:35:43 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 387 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Wed, 19 Apr 2023 08:35:43 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.1.1/	85 KB 30 KB	142ms 24ms	Script text/javascript	2a00:1450:4001:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js Requested by Host: mpgrup.ro URL: https://mpgrup.ro/wp-admin/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Tue, 18 Apr 2023 02:30:51 GMT content-encoding gzip x-content-type-options nosniff age 101479 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30244 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 17 Apr 2024 02:30:51 GMT
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/6MY32oPwFCn9SUKWt8czDsDw/	409 KB 165 KB	22ms 21ms	Script text/javascript	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/6MY32oPwFCn9SUKWt8czDsDw/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 669df991bc101ce8036b07e4431b837c3afcfaedd8e18356f1930bdd8235a6ab Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer Origin https://mpgrup.ro accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Tue, 18 Apr 2023 15:09:59 GMT content-encoding gzip x-content-type-options nosniff age 55931 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 168106 x-xss-protection 0 last-modified Sun, 02 Apr 2023 18:01:18 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 17 Apr 2024 15:09:59 GMT
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3ffac94b04d10b7a680d0111c0ea6b11b812ee80d240e30658de4e80bbbf824b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	circular-book.woff2 sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/	68 KB 69 KB	81ms 21ms	Font font/woff2	151.101.129.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/circular-book.woff2 Requested by Host: accounts.scdn.co URL: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d Request headers Referer https://accounts.scdn.co/ Origin https://mpgrup.ro accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Date Wed, 19 Apr 2023 06:42:10 GMT Age 2406558 x-amz-meta-goog-reserved-file-mtime 1541621104 X-Cache HIT, HIT x-goog-metageneration 1 x-goog-stored-content-encoding identity Connection keep-alive Content-Length 70092 X-Served-By cache-chi-klot8100075-CHI, cache-hhn-etou8220068-HHN Last-Modified Mon, 21 Mar 2022 12:56:32 GMT ETag "c4f753e765823b94234e7f5ccd733f44" x-goog-generation 1647867392860779 Content-Type font/woff2 Access-Control-Allow-Origin * Cache-Control max-age=86400 x-goog-stored-content-length 70092 Accept-Ranges bytes X-Cache-Hits 327, 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates NBD (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery object| google_tag_data function| ga object| gaplugins object| recaptcha

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mpgrup.ro/	1969-12-31 23:59:59	Name: PHPSESSID Value: 633de8a6373bde618563dc54042ea27d

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__fr.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://mpgrup.ro/wp-admin/main/continue Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://mpgrup.ro/wp-admin/main/continue Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.scdn.co
ajax.googleapis.com
hamariaawaz.com
mpgrup.ro
sp-bootstrap.global.ssl.fastly.net
www.google-analytics.com
www.google.com
www.gstatic.com
151.101.129.194
188.212.252.11
2606:4700:3034::ac43:98d2
2a00:1450:4001:803::2003
2a00:1450:4001:809::200a
2a00:1450:4001:812::200e
2a00:1450:4001:82b::2004
2a04:4e42:8d::760
3ffac94b04d10b7a680d0111c0ea6b11b812ee80d240e30658de4e80bbbf824b
43c412f54626d9f35bd333575decf7bbef35c6e2079c997c525d8da6c242d45a
48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40
4e69c68f5c5b6c87b4b0437ddce158f64c43653e489a7f0731492243ea115ad7
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
669df991bc101ce8036b07e4431b837c3afcfaedd8e18356f1930bdd8235a6ab
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
dcf5678b949e5508b7cf6159443b82d36b2896e64a30da86f03e34f54ca8b7c4