URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1h...
Submission: On September 26 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 185.2.66.211, located in Ireland and belongs to BLACKNIGHT-AS, IE. The main domain is greyhound.ie.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 3rd 2020. Valid for: a year.
This is the only time greyhound.ie was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Global Sources (E-commerce)

Domain & IP information

IP Address AS Autonomous System
2 185.2.66.211 39122 (BLACKNIGH...)
7 203.92.211.29 2687 (ATGS-MMD-AS)
9 2
Apex Domain
Subdomains
Transfer
7 globalsources.com
login.globalsources.com
65 KB
2 greyhound.ie
greyhound.ie
4 KB
9 2
Domain Requested by
7 login.globalsources.com greyhound.ie
2 greyhound.ie greyhound.ie
9 2

This site contains links to these domains. Also see Links.

Domain
www.globalsources.com
login.globalsources.com
Subject Issuer Validity Valid
greyhound.ie
Sectigo RSA Domain Validation Secure Server CA
2020-12-03 -
2021-12-03
a year crt.sh
login.globalsources.com
Thawte RSA CA 2018
2021-09-08 -
2022-10-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Frame ID: 224454E2CBD78F741A72B08D2F79A0C4
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Global Sources

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

69 kB
Transfer

201 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request GeneralManager.php
greyhound.ie/.well-known/login.globalsources.com/sso/
12 KB
4 KB
Document
General
Full URL
https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.2.66.211 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
66-211.colo.sta.blacknight.ie
Software
Apache /
Resource Hash
1d006b68b83b88ecc4e9a5f999de07bf0c4fc8e6040b43c298c69aad6d14fb02

Request headers

Host
greyhound.ie
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sun, 26 Sep 2021 13:06:40 GMT
Server
Apache
Content-Encoding
gzip
Vary
Accept-Encoding
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
BASE.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/
4 KB
2 KB
Stylesheet
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/BASE.CSS
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
a0ff7bd26675d0bd632c14628c1dbf2dd81ff6f092575f1616551d2eca4700b3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:42 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Sep 2021 02:13:44 GMT
Server
Apache
ntCoent-Length
3613
Vary
Accept-Encoding, grlnclientipaddr
X-Han
shotFirst
Transfer-Encoding
chunked
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Content-Type
text/css
Expires
Mon, 01 Jan 1999 00:00:00 GMT
SSO.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/
42 KB
10 KB
Stylesheet
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/SSO.CSS
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
a902a54ef745281d6db09a88afc32e80efbb5b355bfb7828a49a6899d2865613
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Sep 2021 02:13:44 GMT
Server
Apache
ntCoent-Length
42892
Vary
Accept-Encoding, grlnclientipaddr
X-Han
shotFirst
Transfer-Encoding
chunked
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Content-Type
text/css
Expires
Mon, 01 Jan 1999 00:00:00 GMT
jqueryandplugins.js
login.globalsources.com/sso/gsol/pex/en/balat/includes/
99 KB
35 KB
Script
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/includes/jqueryandplugins.js
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
5ee7561a3a5c0bcfd620ab6004ff7cab8ee16c800aada8a165c32cd104086cd5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 May 2021 05:54:43 GMT
Server
Apache
ntCoent-Length
101169
Vary
Accept-Encoding, grlnclientipaddr
X-Han
shotFirst
Transfer-Encoding
chunked
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Content-Type
application/x-javascript
Expires
Mon, 01 Jan 1999 00:00:00 GMT
ssoscripts.js
login.globalsources.com/sso/gsol/pex/en/common/includes/
40 KB
11 KB
Script
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/common/includes/ssoscripts.js
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
c0ba0663f26313407e5a8a3a76ee809a75bff25960b9371b88827134b54390ed
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 Sep 2021 02:12:01 GMT
Server
Apache
ntCoent-Length
40516
Vary
Accept-Encoding, grlnclientipaddr
X-Han
shotFirst
Transfer-Encoding
chunked
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Content-Type
application/x-javascript
Expires
Mon, 01 Jan 1999 00:00:00 GMT
GSLOGO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/
4 KB
4 KB
Image
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/GSLOGO.PNG
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
465c8b941a45a964b3c73162a3357083c03e807f2eb45a6e0cc03658f686ece6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Last-Modified
Tue, 25 May 2021 00:56:58 GMT
Server
Apache
Vary
grlnclientipaddr
X-Han
shotFirst
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
3788
Expires
Mon, 01 Jan 1999 00:00:00 GMT
BLANK.GIF
login.globalsources.com/sso/gsol/pex/en/balat/images/
43 B
651 B
Image
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/BLANK.GIF
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Last-Modified
Wed, 19 May 2021 05:54:43 GMT
Server
Apache
Vary
grlnclientipaddr
X-Han
shotFirst
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01 Jan 1999 00:00:00 GMT
Cookie set webtrends-prod.js
greyhound.ie/sso/gsol/pex/en/balat/includes/
0
0
Script
General
Full URL
https://greyhound.ie/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.2.66.211 , Ireland, ASN39122 (BLACKNIGHT-AS, IE),
Reverse DNS
66-211.colo.sta.blacknight.ie
Software
Apache /
Resource Hash

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
greyhound.ie
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Sun, 26 Sep 2021 13:06:42 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Connection
Keep-Alive
Pragma
no-cache
Link
<https://greyhound.ie/wp-json/>; rel="https://api.w.org/"
X-Nitro-Disabled-Reason
404
Server
Apache
Vary
Accept-Encoding
X-Nitro-Disabled
1
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
X-Nitro-Cache
MISS
Set-Cookie
PHPSESSID=33852f74dffdca0699eabf7e49ae53d3; path=/; secure; HttpOnly
Keep-Alive
timeout=5, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
LINKEDIN_BUTTON.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/
2 KB
2 KB
Image
General
Full URL
https://login.globalsources.com/sso/gsol/pex/en/balat/images/LINKEDIN_BUTTON.PNG
Requested by
Host: greyhound.ie
URL: https://greyhound.ie/.well-known/login.globalsources.com/sso/GeneralManager.php?action=Login&cid=YWJvbGhhc25pcGV6aG1hbkBnbWlsLmNvbQ==&rand=1858101360
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
203.92.211.29 Central, Hong Kong, ASN2687 (ATGS-MMD-AS, US),
Reverse DNS
hkgs29.globalsources.com
Software
Apache /
Resource Hash
d0f108ac5521a079f476c836ca9612310bd8da9e75ba91ff412653453939ae51
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.globalsources.com;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://greyhound.ie/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 26 Sep 2021 13:06:43 GMT
Last-Modified
Wed, 19 May 2021 05:56:22 GMT
Server
Apache
Vary
grlnclientipaddr
X-Han
shotFirst
Content-Security-Policy
frame-ancestors 'self' *.globalsources.com;
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
1634
Expires
Mon, 01 Jan 1999 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Global Sources (E-commerce)

152 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster object| sldpnl function| $ function| jQuery object| Color number| DELAY_SHOW_HIDE string| RFI_MINILOGIN string| RFI_MINIREG string| RFI_MINIREG_PALITE string| USER_REGISTRATION string| PALITE_UPGRADE string| USER_PROFILE string| RFQ_REG string| M_REG string| M_RFI_REG string| EMAGLITE_REG string| LOGIN_LINKEDIN string| BUYER_REGISTRATION_LINKEDIN string| LINKEDIN_EXISTING string| LINKEDIN_NEWREG string| LINKEDIN_EXISTING_NOAPP object| WTSI_P_PREFIX function| winPop function| winPop2 function| winPop3 function| sortThis function| toggleDefValue function| syncCheckboxToHidden function| checkValidID function| getRandom boolean| isMSIE3 string| path number| expDays object| exp string| value function| GetCookie function| SetCookie function| DeleteCookie function| setUniqCookie function| showBox function| hideBox function| delayShowBox function| delayHideBox function| delayShowBox2 function| delayHideBox2 function| toggleHiddenByCheckbox function| checkKeyword function| LTrim function| RTrim function| Trim function| checkIsFilledMandatory function| checkForEmailError function| validateEmailValue function| trimFieldValue function| checkforEmail function| checkEmailFieldNoTrack function| checkEmailIsNotInError function| checkEmailField function| showEmailTipWithError function| showEmailTipWithErrorEmag function| showEmailTipWithErrorEmagCheck function| showErrorEmagLoginCheck function| hasSpecialChars function| hasSpaceChars function| checkUidChar function| showUidTipWithError function| checkPwdChar function| checkValuesMatch function| isNum function| isNumWithSpace function| isPhone function| extendisPhone function| checkNameBg function| changeNameBg function| checkFieldIsNotInError function| changePhoneBg function| toggleLabelColor function| checkEmailBg function| checkPhoneBg function| validatePhoneForEmag function| validatePhoneNumberForEmag function| validatePhoneForOTP function| validateOTPInput function| hideErrorBoxForOTP function| checkPhoneBgEmag function| changeCompanyNameBg function| checkCompanyNameBgEmag function| checkNameBgEmagLiteForm function| checkEmagSelected function| validateCompanyNameForEmag function| checkCombineNameEmag function| checkNameBgEmagLiteFormNew function| checkCompanyURL function| checkCompanyURLFieldError function| checkCompanyURLField function| checkCompanyURLFieldMobile function| checkCompanyDescriptionField function| WTFieldErrorTag function| WTFieldPWLengthErrorTag function| WTFieldTag function| WTNumFieldTag string| msg_invalidemailchar string| msg_invalidemail string| invalidemailchar string| invalidemail string| iChar string| iEmail boolean| goWT_Track function| getEvent function| automailKeydown function| automail function| fillinmaill function| hideAutomailBox undefined| req undefined| ctyflag function| checkCountryFieldMobile function| validatingCountryMobile boolean| first_load function| processCountryMobile function| checkUid function| requestReminder function| removeSpaceTelFax function| removeSpaceTelMobile function| removeSpaces function| checkIMoption function| checkEMoption function| isEmpty function| validatePAKW function| toggleCheckBox undefined| compurl function| appendSuggestedCompUrl function| showOverlayLogin function| downloadfile function| checkCompanyURLFieldForSmallRFI function| InvalidMsg object| today number| timetoday number| randm string| timenow boolean| nets boolean| nseven number| bVer function| displayFocus function| login_decodeappURL function| login_decodeRegAppURL function| login_decodeSubAppURL function| displayAlert object| snooky function| showMsg undefined| _tag

1 Cookies

Domain/Path Name / Value
greyhound.ie/ Name: PHPSESSID
Value: 33852f74dffdca0699eabf7e49ae53d3

1 Console Messages

Source Level URL
Text
network error URL: https://greyhound.ie/sso/gsol/pex/en/balat/includes/webtrends-prod.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)