m2healthtravel.com
Open in
urlscan Pro
62.141.35.239
Malicious Activity!
Public Scan
Effective URL: https://m2healthtravel.com/lands/
Submission Tags: 7175131
Submission: On June 14 via api from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 7th 2021. Valid for: 3 months.
This is the only time m2healthtravel.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: IRS (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.14 67.199.248.14 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:827::200e | 15169 (GOOGLE) (GOOGLE) | |
1 8 | 62.141.35.239 62.141.35.239 | 24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG) | |
1 | 162.247.243.147 162.247.243.147 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.114.110 151.101.114.110 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700:10:... 2606:4700:10::6816:47c5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
6 | 2600:1400:d:3... 2600:1400:d:383::f50 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 99.86.241.2 99.86.241.2 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200e | 15169 (GOOGLE) (GOOGLE) | |
33 | 9 |
ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: ve928.venus.dedi.server-hosting.expert
m2healthtravel.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com | |
www.youtube.com |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-241-2.vie50.r.cloudfront.net
gateway.foresee.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
m2healthtravel.com
1 redirects
m2healthtravel.com |
158 KB |
6 |
irs.gov
www.irs.gov |
66 KB |
3 |
foresee.com
gateway.foresee.com |
60 KB |
3 |
youtube.com
www.youtube.com |
163 KB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
2 |
addtoany.com
static.addtoany.com |
59 KB |
1 |
newrelic.com
js-agent.newrelic.com |
12 KB |
1 |
nr-data.net
bam-cell.nr-data.net |
911 B |
1 |
page.link
1 redirects
govrn.page.link |
889 B |
1 |
bitly.com
1 redirects
bitly.com |
345 B |
33 | 10 |
Domain | Requested by | |
---|---|---|
8 | m2healthtravel.com |
1 redirects
m2healthtravel.com
|
6 | www.irs.gov |
m2healthtravel.com
|
3 | gateway.foresee.com |
m2healthtravel.com
|
3 | www.youtube.com |
m2healthtravel.com
www.youtube.com |
2 | www.google-analytics.com |
m2healthtravel.com
|
2 | static.addtoany.com |
m2healthtravel.com
|
1 | js-agent.newrelic.com |
m2healthtravel.com
|
1 | bam-cell.nr-data.net |
m2healthtravel.com
|
1 | govrn.page.link | 1 redirects |
1 | bitly.com | 1 redirects |
33 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
m2healthtravel.com cPanel, Inc. Certification Authority |
2021-06-07 - 2021-09-05 |
3 months | crt.sh |
*.nr-data.net DigiCert SHA2 Secure Server CA |
2020-02-05 - 2022-02-08 |
2 years | crt.sh |
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2021-05-21 - 2022-04-10 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-05 - 2021-08-05 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
www.irs.gov Entrust Certification Authority - L1K |
2020-08-14 - 2022-11-13 |
2 years | crt.sh |
foresee.com Amazon |
2020-07-25 - 2021-08-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://m2healthtravel.com/lands/
Frame ID: CB194EA7D5E4B85B787D41A0771EFC4B
Requests: 33 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bitly.com/3xolEBZ
HTTP 301
https://govrn.page.link/NLtk HTTP 302
https://m2healthtravel.com/lands HTTP 301
https://m2healthtravel.com/lands/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bitly.com/3xolEBZ
HTTP 301
https://govrn.page.link/NLtk HTTP 302
https://m2healthtravel.com/lands HTTP 301
https://m2healthtravel.com/lands/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
m2healthtravel.com/lands/ Redirect Chain
|
158 KB 158 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b67fc6a152
bam-cell.nr-data.net/1/ |
49 B 911 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1209.min.js
js-agent.newrelic.com/ |
31 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.29.svg.js
static.addtoany.com/menu/svg/ |
78 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkid.js
www.google-analytics.com/plugins/ua/ |
2 KB 996 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
www-widgetapi.js
www.youtube.com/s/player/5d56cf74/www-widgetapi.vflset/ |
122 KB 40 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe_api
www.youtube.com/ |
980 B 861 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google_tag.script.js
m2healthtravel.com/pub/google_tag/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css_hsAPjLX-mpRCXiSbHpHBq0wU8_NeP4-nfbMOmsVlqBM.css
www.irs.gov/pub/css/ |
33 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css_YiKoomumvkf5F2gYstPVwI9VbTpxwJfjcR3hWjD_xOw.css
www.irs.gov/pub/css/ |
326 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css_TPMs-A75V-DLtMvJGynwCucQqlu318W9uQct2FBqdmA.css
www.irs.gov/pub/css/ |
192 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js_JL5-xpD24I600Ahcw5Q4vP2Cfa69VcdR4zEsiFjClFY.js
m2healthtravel.com/pub/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
google-analytics.js
m2healthtravel.com/static_assets/js/reporting/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
height.js
m2healthtravel.com/static_assets/js/leftnav/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
https.js
m2healthtravel.com/static_assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
federated-analytics.js
m2healthtravel.com/static_assets/js/reporting/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gateway.min.js
gateway.foresee.com/sites/irs-gov/production/ |
156 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mpathy-modern.js
gateway.foresee.com/code/5.5.5-mp/ |
75 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
gateway.foresee.com/code/19.14.6-fs/templates/feedback/default/ |
76 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IRS-Logo.svg
www.irs.gov/themes/custom/pup_base/ |
14 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-print.svg
www.irs.gov/themes/custom/pup_irs/images/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
IRS-Logo.svg
m2healthtravel.com/themes/custom/pup_base/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
logo-print.svg
m2healthtravel.com/themes/custom/pup_irs/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
irs_horiz_logo.svg
m2healthtravel.com/pub/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.min.js
m2healthtravel.com/static_assets/js/libs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
autotracker.js
m2healthtravel.com/static_assets/js/reporting/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
js_Uz25YiAagN6XBVUpi6MBmWorQT5RN0WPySSZbvrY1fE.js
m2healthtravel.com/pub/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page.js
static.addtoany.com/menu/ |
84 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
js_G6kd2scOaOndZAas-NRCZsMfAcQ69yp0Jiahp8afv5g.js
m2healthtravel.com/pub/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
www-widgetapi.js
www.youtube.com/s/player/a7cbbf24/www-widgetapi.vflset/ |
122 KB 122 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css_0WJnFhAXYvl-YnOfEvwEoCRnCqyELBuRNJp137oT7DA.css
www.irs.gov/pub/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
js_JL5-xpD24I600Ahcw5Q4vP2Cfa69VcdR4zEsiFjClFY.js
m2healthtravel.com/pub/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/themes/custom/pup_base/IRS-Logo.svg
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/themes/custom/pup_irs/images/logo-print.svg
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/pub/irs_horiz_logo.svg
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/static_assets/js/libs/jquery.min.js
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/static_assets/js/reporting/autotracker.js
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/pub/js/js_Uz25YiAagN6XBVUpi6MBmWorQT5RN0WPySSZbvrY1fE.js
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/pub/js/js_G6kd2scOaOndZAas-NRCZsMfAcQ69yp0Jiahp8afv5g.js
- Domain
- m2healthtravel.com
- URL
- https://m2healthtravel.com/pub/js/js_JL5-xpD24I600Ahcw5Q4vP2Cfa69VcdR4zEsiFjClFY.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: IRS (Government)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| NREUM object| newrelic function| __nr_require object| dataLayer object| gaplugins function| ga object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| google_tag_data object| a2a_config0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam-cell.nr-data.net
bitly.com
gateway.foresee.com
govrn.page.link
js-agent.newrelic.com
m2healthtravel.com
static.addtoany.com
www.google-analytics.com
www.irs.gov
www.youtube.com
m2healthtravel.com
151.101.114.110
162.247.243.147
2600:1400:d:383::f50
2606:4700:10::6816:47c5
2a00:1450:4001:811::200e
2a00:1450:4001:812::200e
2a00:1450:4001:827::200e
62.141.35.239
67.199.248.14
99.86.241.2
03e19a9670313aa9e3bc07bece0eebd1893095e327a90363ba21231aaf065faf
090c538bb629082bd4f229876075c6702039af99f331947f4488cf8ebb8f1c11
1676a8158867ca736ff0a960b9300b8e0e8c016faa2b3211d54d1317213be669
17f2a2170aeb9d05033ed9f2634feae058086d5b918351b3f4c7537ecf08e384
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
3536108234988f9febfce80ca86c2fd44acc995593240c0e9e30399f46b27087
4cf32cf80ef957e0cbb4cbc91b29f00ae710aa5bb7d7c5bdb9072dd8506a7660
5fcf8378d662c036e1412af20e143aa1ed6bd0e7eac1cb1d72a15d29e56b403a
6222a8a26ba6be47f9176818b2d3d5c08f556d3a71c097e3711de15a30ffc4ec
66466573e4c2cffdc636e13e76758dcf83f0ce235083c2098ad471cf419481d8
86c00f8cb5fe9a94425e249b1e91c1ab4c14f3f35e3f8fa77db30e9ac565a813
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
a42a1122f6628a0b4221b2f66f72c4d216870ca5f8ce5e125f75a81aa00eeea3
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
d1626716101762f97e62739f12fc04a024670aac842c1b91349a75dfba13ec30
d2281fa4c167ea82397491114da8ab1adbe03317c87070642210faea981b2b72
e30f848c353b8ab801c18d2109527cb32a27f145262dccb3cd4db9f309cc53bb
e51e3779ae12850720dc93eb44ce836494249beceb5c73b039774d3e62ae7a1a
f909a31bfd7a13b9dd53e98b5652f13f4782fdfd1653dc4befade7386c087371