aagroup.com.ph Open in urlscan Pro
111.221.45.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://aagroup.com.ph/pes/
Submission Tags: @phish_report
Submission: On August 08 via api (August 8th 2024, 2:58:08 pm UTC) from FI — Scanned from SG

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 16 HTTP transactions. The main IP is 111.221.45.75, located in Singapore and belongs to NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG. The main domain is aagroup.com.ph.
TLS certificate: Issued by R11 on August 7th 2024. Valid for: 3 months.

This is the only time aagroup.com.ph was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nequi (Financial)

Domain & IP information

	IP Address	AS Autonomous System
14	111.221.45.75 111.221.45.75	38001 (NEWMEDIAE...) (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd)
1	2404:6800:400... 2404:6800:4003:c0f::5e	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4003:c02::5e	15169 (GOOGLE) (GOOGLE)
16	4

14 111.221.45.75 (Singapore)

ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG)
PTR: sgvip4.noc401.com

aagroup.com.ph	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4003:c0f::5e (Singapore, Singapore)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4003:c02::5e (Singapore, Singapore)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	aagroup.com.ph aagroup.com.ph	447 KB
2	gstatic.com www.gstatic.com fonts.gstatic.com	18 KB
16	2

	Domain	Requested by
14	aagroup.com.ph	aagroup.com.ph
1	fonts.gstatic.com	aagroup.com.ph
1	www.gstatic.com	aagroup.com.ph
16	3

This site contains no links.

Subject Issuer	Validity	Valid
aagroup.com.ph R11	`2024-08-07` - `2024-11-05`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://aagroup.com.ph/pes/
Frame ID: ED50C068BCEB9F9C00DC4DAB8C865A23
Requests: 12 HTTP requests in this frame

Frame: https://aagroup.com.ph/pes/inc/anchor.html
Frame ID: 5C1C774E16313FF2AC8869784181AE31
Requests: 5 HTTP requests in this frame

Frame: https://aagroup.com.ph/pes/inc/anchor_files/saved_resource.htm
Frame ID: 4BEC15DD14FABCE48AD9992EBD6199E5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Recarga

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

465 kB
Transfer

846 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
aagroup.com.ph/pes/ 18 KB
4 KB 264ms
39ms Document
text/html 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 9a81ef5d1eada35c6153b780a8b51adf6719dc4f09bbbb9a8c1571c86695ba8a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 3939
content-type: text/html; charset=UTF-8
date: Thu, 08 Aug 2024 14:58:03 GMT
vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
aagroup.com.ph/pes/inc/ 149 KB
19 KB 22ms
18ms Stylesheet
text/css 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/bootstrap.min.css
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: bee2ffdc4bba32f8bc53681dea720db2c9382ccfde206d7e18820955056098f6

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 19772
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H2 200 angular-tooltips.min.css
aagroup.com.ph/pes/inc/ 6 KB
1003 B 22ms
20ms Stylesheet
text/css 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/angular-tooltips.min.css
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 8c09b4f5ea3740231251f556d737c1fa111f8a829d5cf717585fef79b59436b4

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 971
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H2 200 animate.min.css
aagroup.com.ph/pes/inc/ 82 KB
4 KB 22ms
20ms Stylesheet
text/css 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/animate.min.css
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 1b57004d81d1c2c765ef74b9dd93a75de620cc1c6d4a9cc1c8ebbf2877721dc9

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4370
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H2 200 main.css
aagroup.com.ph/pes/inc/ 23 KB
4 KB 21ms
20ms Stylesheet
text/css 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/main.css
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: e6e64fe7dd22ab65a0e8a877e27ffd278fa6f545a0168c14cf0bbc6ac79ec6a1

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4038
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H2 200 cargando.gif
aagroup.com.ph/pes/inc/ 250 KB
250 KB 11ms
10ms Image
image/gif 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aagroup.com.ph/pes/inc/cargando.gif
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 65ca2c09441d56fb6aa6e792947c1150dd07233d313a2679be754a38c4cc1c28

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

expires: Thu, 15 Aug 2024 14:58:03 GMT
date: Thu, 08 Aug 2024 14:58:03 GMT
cache-control: public, max-age=604800
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
accept-ranges: bytes
content-length: 255531
content-type: image/gif

GET
H2 200 n.svg
aagroup.com.ph/pes/inc/ 3 KB
1 KB 20ms
19ms Image
image/svg+xml 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aagroup.com.ph/pes/inc/n.svg
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: e00039a29756a066522d5d10dde1ab1c9b429bd894c80920d04b7c2aaa00cb6a

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1168
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H3 200 anchor.html Show response
aagroup.com.ph/pes/inc/ Frame 5C1C 44 KB
22 KB 10ms
9ms Document
text/html 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/anchor.html
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 0813643b5053fefa524fb966f3c15b78bfdfe760155619940899e8b67f17ffb0

Request headers

Referer: https://aagroup.com.ph/pes/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 22132
content-type: text/html
date: Thu, 08 Aug 2024 14:58:03 GMT
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding

GET
H3 404 flecha.png
aagroup.com.ph/pes/images/ 708 B
708 B 7ms
7ms Image
text/html 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aagroup.com.ph/pes/images/flecha.png
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/main.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Referer: https://aagroup.com.ph/pes/inc/main.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 08 Aug 2024 14:58:03 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
content-type: text/html

GET
H3 200 Manrope-VariableFont_wght.ttf
aagroup.com.ph/pes/inc/ 161 KB
63 KB 12ms
11ms Font
font/ttf 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/Manrope-VariableFont_wght.ttf
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/main.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 42814a407491bfe54e4bfbc51ff6500d39445e49cc3feedea984cb5a768b04aa

Request headers

Referer: https://aagroup.com.ph/pes/inc/main.css
Origin: https://aagroup.com.ph
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 08 Aug 2024 14:58:03 GMT
content-encoding: br
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 64396
expires: Thu, 15 Aug 2024 14:58:03 GMT

GET
H3 200 AvenirNextLTPro-Medium.woff
aagroup.com.ph/pes/inc/ 39 KB
39 KB 7ms
6ms Font
font/woff 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/AvenirNextLTPro-Medium.woff
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/main.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 51d8f18ada19b5e1a633aa192f5b0558135f0d491a91d80f558c9e14b717c41f

Request headers

Referer: https://aagroup.com.ph/pes/inc/main.css
Origin: https://aagroup.com.ph
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

expires: Thu, 15 Aug 2024 14:58:03 GMT
date: Thu, 08 Aug 2024 14:58:03 GMT
cache-control: public, max-age=604800
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
accept-ranges: bytes
content-length: 39568
content-type: font/woff

GET
H3 200 AvenirNextLTPro-Regular.woff
aagroup.com.ph/pes/inc/ 38 KB
38 KB 21ms
21ms Font
font/woff 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/AvenirNextLTPro-Regular.woff
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/main.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: a824d133a8823d309f2f80f4ced4200adb33c3e446f5287a1f5ada5d8bd144ee

Request headers

Referer: https://aagroup.com.ph/pes/inc/main.css
Origin: https://aagroup.com.ph
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

expires: Thu, 15 Aug 2024 14:58:03 GMT
date: Thu, 08 Aug 2024 14:58:03 GMT
cache-control: public, max-age=604800
last-modified: Sat, 27 Jul 2024 07:11:36 GMT
accept-ranges: bytes
content-length: 38616
content-type: font/woff

GET
H3 404 saved_resource.htm Show response
aagroup.com.ph/pes/inc/anchor_files/ Frame 4BEC 708 B
721 B 21ms
21ms Document
text/html 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/anchor_files/saved_resource.htm
Requested by: Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/anchor.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Referer: https://aagroup.com.ph/pes/inc/anchor.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
content-type: text/html
date: Thu, 08 Aug 2024 14:58:03 GMT
pragma: no-cache

GET
DATA 200
OK truncated
/ Frame 5C1C 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5C1C 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
H2 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 5C1C 2 KB
3 KB 37ms
4ms Image
image/png 2404:6800:4003:c0f::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/anchor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c0f::5e Singapore, Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://aagroup.com.ph/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 05 Aug 2024 14:10:40 GMT
x-content-type-options: nosniff
age: 262043
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 12 Aug 2024 14:10:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 5C1C 15 KB
16 KB 34ms
4ms Font
font/woff2 2404:6800:4003:c02::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: aagroup.com.ph
URL: https://aagroup.com.ph/pes/inc/anchor.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4003:c02::5e Singapore, Singapore, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://aagroup.com.ph/
Origin: https://aagroup.com.ph
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 07 Aug 2024 14:18:22 GMT
x-content-type-options: nosniff
age: 88781
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Aug 2025 14:18:22 GMT

GET
H3 404 favicon.ico
aagroup.com.ph/pes/inc/ 708 B
721 B 6ms
5ms Other
text/html 111.221.45.75
NEWMEDIAEXPRESS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://aagroup.com.ph/pes/inc/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 111.221.45.75 , Singapore, ASN38001 (NEWMEDIAEXPRESS-AS-AP NewMedia Express Pte Ltd, SG),
Reverse DNS: sgvip4.noc401.com
Software: /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

Referer: https://aagroup.com.ph/pes/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

pragma: no-cache
date: Thu, 08 Aug 2024 14:58:03 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 708
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nequi (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDiv function| formatInput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://aagroup.com.ph/pes/images/flecha.png Message: Failed to load resource: the server responded with a status of 404 ()
security	warning	URL: https://aagroup.com.ph/pes/inc/anchor.html Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://aagroup.com.ph/pes/inc/anchor_files/saved_resource.htm Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://aagroup.com.ph/pes/inc/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aagroup.com.ph
fonts.gstatic.com
www.gstatic.com
111.221.45.75
2404:6800:4003:c02::5e
2404:6800:4003:c0f::5e
0813643b5053fefa524fb966f3c15b78bfdfe760155619940899e8b67f17ffb0
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
1b57004d81d1c2c765ef74b9dd93a75de620cc1c6d4a9cc1c8ebbf2877721dc9
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
42814a407491bfe54e4bfbc51ff6500d39445e49cc3feedea984cb5a768b04aa
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
51d8f18ada19b5e1a633aa192f5b0558135f0d491a91d80f558c9e14b717c41f
65ca2c09441d56fb6aa6e792947c1150dd07233d313a2679be754a38c4cc1c28
8c09b4f5ea3740231251f556d737c1fa111f8a829d5cf717585fef79b59436b4
9a81ef5d1eada35c6153b780a8b51adf6719dc4f09bbbb9a8c1571c86695ba8a
a824d133a8823d309f2f80f4ced4200adb33c3e446f5287a1f5ada5d8bd144ee
bee2ffdc4bba32f8bc53681dea720db2c9382ccfde206d7e18820955056098f6
e00039a29756a066522d5d10dde1ab1c9b429bd894c80920d04b7c2aaa00cb6a
e6e64fe7dd22ab65a0e8a877e27ffd278fa6f545a0168c14cf0bbc6ac79ec6a1

aagroup.com.ph Open in urlscan Pro 111.221.45.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

4 IPs

1 Countries

465 kBTransfer

846 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

aagroup.com.ph Open in urlscan Pro
111.221.45.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

465 kB
Transfer

846 kB
Size

0
Cookies

16 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!