www.zumbofm.com Open in urlscan Pro
173.254.47.109  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request garcia.php Show response www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/	4 KB 2 KB	676ms 339ms	Document text/html	173.254.47.109 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol HTTP/1.1 Server 173.254.47.109 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 173-254-47-109.unifiedlayer.com Software Apache / Resource Hash 43e5db6bf56ecddbf61e2f383669d45b6cb6a67b72ae0210bb5fb5e6e6a2531c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Fri, 12 Nov 2021 13:25:07 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 1852 Keep-Alive timeout=5, max=75 Content-Type text/html; charset=UTF-8
GET H2	200	screen.css acs4.3dsecure.no/mdpayacs/content/040/	3 KB 1 KB	838ms 26ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/screen.css Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 13:25:08 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-c14" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	gh-buttons.css acs4.3dsecure.no/mdpayacs/content/040/dk/	13 KB 3 KB	838ms 27ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 13:25:08 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag W/"614bbd7f-3290" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	commons.js Show response acs4.3dsecure.no/mdpayacs/content/	1 KB 823 B	838ms 27ms	Script application/javascript	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/commons.js Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 13:25:08 GMT content-encoding gzip last-modified Thu, 04 Oct 2018 00:56:30 GMT server nginx etag W/"1202-1538614590000" vary Accept-Encoding content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	839ms 28ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers
GET H/1.1	200 OK	date_time.js Show response www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/Autentisering_files/	823 B 645 B	159ms 159ms	Script application/javascript	173.254.47.109 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/Autentisering_files/date_time.js Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol HTTP/1.1 Server 173.254.47.109 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 173-254-47-109.unifiedlayer.com Software Apache / Resource Hash c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Fri, 12 Nov 2021 13:25:07 GMT Content-Encoding gzip Last-Modified Fri, 12 Nov 2021 08:00:07 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=74 Content-Length 344
GET H2	200	Posten-Norge-AS-Logo-1.jpg logosrated.net/wp-content/uploads/parser/	184 KB 185 KB	598ms 150ms	Image image/jpeg	162.241.224.242 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://logosrated.net/wp-content/uploads/parser/Posten-Norge-AS-Logo-1.jpg Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.224.242 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5223.bluehost.com Software Apache / Resource Hash 2c30d508035aaeed0ad33b46deab160ac7acc53236e1639b0a15755f8d36d04e Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers accept-ranges bytes last-modified Sat, 17 Feb 2018 14:09:22 GMT server Apache host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== date Fri, 12 Nov 2021 13:25:09 GMT content-length 188271 content-type image/jpeg
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	27ms 27ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: www.zumbofm.com URL: http://www.zumbofm.com/IsraelPost/595783dd00fe35d0387647ae166a0e97/garcia.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://www.zumbofm.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers
GET H2	200	gh-icons.png acs4.3dsecure.no/mdpayacs/content/040/dk/	4 KB 4 KB	27ms 26ms	Image image/png	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Show image Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-icons.png Requested by Host: acs4.3dsecure.no URL: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 12 Nov 2021 13:25:08 GMT last-modified Wed, 22 Sep 2021 23:34:23 GMT server nginx etag "614bbd7f-f6c" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3948

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| date_time function| onBodyLoad function| validate object| date number| year number| month object| months number| d number| day object| days number| h number| m number| s string| result

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
logosrated.net
www.zumbofm.com
162.241.224.242
173.254.47.109
185.42.168.133
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
2c30d508035aaeed0ad33b46deab160ac7acc53236e1639b0a15755f8d36d04e
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
43e5db6bf56ecddbf61e2f383669d45b6cb6a67b72ae0210bb5fb5e6e6a2531c
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb