![](/screenshots/143aa207-49b3-4778-873d-6e1ffc6cb049.png)
sansec.io
Open in
urlscan Pro
2606:4700:3037::ac43:996e
Public Scan
Effective URL: https://sansec.io/research/magento-xml-backdoor?is=fddd7500a68763510e252bf429e021eedaee1997e642c2c632bafb6a16bb6d74
Submission: On April 10 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on March 29th 2024. Valid for: 3 months.
This is the only time sansec.io was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 136.147.189.155 136.147.189.155 | 14340 (SALESFORCE) (SALESFORCE) | |
20 | 2606:4700:303... 2606:4700:3037::ac43:996e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:1a32 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 190.2.151.160 190.2.151.160 | 49981 (WORLDSTREAM) (WORLDSTREAM) | |
2 | 2001:1af8:402... 2001:1af8:4020:a058::20:44 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
29 | 5 |
ASN14340 (SALESFORCE, US)
PTR: click.email.sans.org
click.email.sans.org |
ASN49981 (WORLDSTREAM, NL)
PTR: 190-2-151-160.hosted-by-worldstream.net
queue.simpleanalyticscdn.com |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
o2.mouseflow.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
sansec.io
sansec.io api.sansec.io |
292 KB |
5 |
gstatic.com
fonts.gstatic.com |
44 KB |
3 |
mouseflow.com
cdn.mouseflow.com — Cisco Umbrella Rank: 10351 o2.mouseflow.com — Cisco Umbrella Rank: 66033 |
51 KB |
1 |
simpleanalyticscdn.com
queue.simpleanalyticscdn.com — Cisco Umbrella Rank: 84729 |
410 B |
1 |
sans.org
1 redirects
click.email.sans.org — Cisco Umbrella Rank: 802418 |
290 B |
29 | 5 |
Domain | Requested by | |
---|---|---|
19 | sansec.io |
sansec.io
|
5 | fonts.gstatic.com |
sansec.io
|
2 | o2.mouseflow.com |
cdn.mouseflow.com
|
1 | queue.simpleanalyticscdn.com |
sansec.io
|
1 | api.sansec.io |
sansec.io
|
1 | cdn.mouseflow.com |
sansec.io
|
1 | click.email.sans.org | 1 redirects |
29 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
helpx.adobe.com |
hackerone.com |
docs.google.com |
status.sansec.io |
t.me |
twitter.com |
www.linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sansec.io GTS CA 1P5 |
2024-03-29 - 2024-06-27 |
3 months | crt.sh |
cdn.mouseflow.com Cloudflare Inc ECC CA-3 |
2023-10-25 - 2024-10-23 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
queue.simpleanalyticscdn.com R3 |
2024-04-07 - 2024-07-06 |
3 months | crt.sh |
*.mouseflow.com Sectigo RSA Domain Validation Secure Server CA |
2023-08-28 - 2024-09-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://sansec.io/research/magento-xml-backdoor?is=fddd7500a68763510e252bf429e021eedaee1997e642c2c632bafb6a16bb6d74
Frame ID: D0DACBD438DBAFDA8D73805A8BFF36C7
Requests: 29 HTTP requests in this frame
Screenshot
![](/screenshots/143aa207-49b3-4778-873d-6e1ffc6cb049.png)
Page Title
Persistent Magento backdoor hidden in XMLPage URL History Show full URLs
-
https://click.email.sans.org/?qs=c7eea00bf2a97ffc7583bfba9bfbf17ea287e6a94cafeb3e46fd0631dea2c6ba4130f34b...
HTTP 302
https://sansec.io/research/magento-xml-backdoor?is=fddd7500a68763510e252bf429e021eedaee1997e64... Page URL
Detected technologies
![](/vendor/wappa/icons/Alpine.js.png)
Detected patterns
- <[^>]+[^\w-]x-data[^\w-][^<]+
- /alpine(?:\.min)?\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/mouseflow.png)
Detected patterns
- cdn\.mouseflow\.com
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: CVE-2024-20720
Search URL Search Domain Scan URL
Title: blaklis
Search URL Search Domain Scan URL
Title: See our version matrix for a useful overview
Search URL Search Domain Scan URL
Title: System status
Search URL Search Domain Scan URL
Title: Telegram
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://click.email.sans.org/?qs=c7eea00bf2a97ffc7583bfba9bfbf17ea287e6a94cafeb3e46fd0631dea2c6ba4130f34b8ee954959fd10bf21829a50cfb812eb387b04beb
HTTP 302
https://sansec.io/research/magento-xml-backdoor?is=fddd7500a68763510e252bf429e021eedaee1997e642c2c632bafb6a16bb6d74 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
magento-xml-backdoor
sansec.io/research/ Redirect Chain
|
24 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tailwind.css
sansec.io/assets/2023/ |
49 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alpine.js
sansec.io/assets/2023/ |
42 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sansec-black.svg
sansec.io/assets/2023/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sansec-social.svg
sansec.io/assets/images/ |
1 KB 963 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
og-graphic-12.webp
sansec.io/assets/2023/og/720/ |
25 KB 25 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image-20240404144919004.png
sansec.io/assets/posts/ |
118 KB 118 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
copyfile.svg
sansec.io/assets/2023/ |
303 B 911 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
trafficlight.svg
sansec.io/assets/2023/ |
278 B 918 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ecomdemo.webp
sansec.io/assets/2023/ |
86 KB 87 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pango-icon-100.webp
sansec.io/assets/images/ |
4 KB 4 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sansec-white.svg
sansec.io/assets/2023/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
x.svg
sansec.io/assets/2023/ |
570 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
linkedin.svg
sansec.io/assets/2023/ |
832 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mail.svg
sansec.io/assets/2023/ |
523 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
sansec.io/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
newsletter.js
sansec.io/assets/2023/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
simple.js
sansec.io/assets/2023/ |
7 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
b8b33745-29ba-4a8d-8a21-4019ba29e934.js
cdn.mouseflow.com/projects/ |
171 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLEj6Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLCz7Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFd2JQEk.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecnFHGPc.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2_ROW4AJi8SJQt.woff2
fonts.gstatic.com/s/robotomono/v23/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ping
api.sansec.io/v1/ |
0 505 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
simple.gif
queue.simpleanalyticscdn.com/ |
43 B 410 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
init
o2.mouseflow.com/ |
0 254 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
sansec.io/assets/images/ |
4 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
html
o2.mouseflow.com/ |
0 248 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _mfq object| Alpine function| ready function| ready_default object| EVENT_TYPES object| STATE_CLASSES function| NON_EMPTY string| FORM_DOM boolean| isAllowed boolean| sa_event_loaded boolean| sa_loaded function| sa_event boolean| mouseflowDisableKeyLogging object| mouseflowHeatmap object| mouseflow2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.sansec.io/ | Name: mf_user Value: 9bb974b778d561ad045745fab42c3032| |
|
.sansec.io/ | Name: mf_b8b33745-29ba-4a8d-8a21-4019ba29e934 Value: 32e8a797d78f8237c7e91a0081a2164c|041010526732ecc705e7fa8878600633b0892dcd.6678550918.1712723710353|1712723710352||0||||0|18.00|0.90817 |
25 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.sansec.io
cdn.mouseflow.com
click.email.sans.org
fonts.gstatic.com
o2.mouseflow.com
queue.simpleanalyticscdn.com
sansec.io
136.147.189.155
190.2.151.160
2001:1af8:4020:a058::20:44
2606:4700:3037::ac43:996e
2606:4700::6812:1a32
2a00:1450:4001:809::2003
037fbdcacb9b81beee4b30af2e017373160bc86445e574adffb98a47f281fb11
1158026deeb9f74cb2b822c048c122bfcca85dd207fd5cfe335051a4b2ba7a4b
1b97d35a17f6829bfe0f5ae8f695a075114e324f7ad3ac9670f6ad979e70c32e
1ff7021015e2254d9b9957638b1d847c456c17bfa1f9b8829d2343b4690ba642
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
3244e530e266cff75c9aee0c088c87b6469a20ba6b7f21ea37fe29c41b814652
3848a6f7c173dda24d9e97ac4d7bce0c977e0f847af6f52b30d7fa84446eedf3
3ffed64d2401a02cbb3694ad89e1c24e43084d2b5ce9244789c7519c698c5641
54051dee059a94adf66d3181db85d1394fb0c7f52ee77eee03069eb44a4a32aa
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
64b4b4fbfbc9259d9f368c84fedcbcd8e545c8320961f365a0a321eaecd2198f
68dbe780cefde72db68b8bc410e224c5156dd6ec96e246a813d48dce7d196820
6bb2d30928397291c267a57605309d304d6333eb6963935db500e46be34761f5
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
7dedf3888635d7afe7ecff760413bf692984fdccc3a79e12697f4e08963fe04d
86453342bdf35a64839e6870f7966641267de3dba9a83f8c2fd7a388dd142081
8e0536353571a75601a7f19b4915a6d8f579de6a3f898cfc34f005f23f25c4db
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
9c683a2d3ca5e2a0107fc8962439c1b95d883dfe4b61a14edfde600fe7520983
9f5b173f5794c8bc17da2d8cc43783a859255065b0f398df57695f4d671a573e
c8fa8ff457abdcd212f37a07ef2f292c999011dffabcaa577fb1e1e0076ca658
cb184b98ef46f9a0917d5b0832a2f71468679c8befc102807fc04591ef28e9f9
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eac1b0331fcdc1af1e7f8db8268f13c370cb1e33c55b1f82ae4af53ddae017bf
f2e3b42fad1c8c2adc891e572e01603328506963d2c671e9d37e84f9cef613c5
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149