zoomy.teslathemes.com Open in urlscan Pro
35.231.219.73  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin.php Show response zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/	5 KB 2 KB	446ms 159ms	Document text/html	35.231.219.73 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 35.231.219.73 , United States, ASN15169 (GOOGLE, US), Reverse DNS 73.219.231.35.bc.googleusercontent.com Software nginx/1.13.1 / PHP/7.1.33 Resource Hash bfa310fd011405bcc9ef7b6947b7030538417a3d8f6732c52a60341dee126cf4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority zoomy.teslathemes.com :scheme https :path /wp-content/plugins/ubh/protect-account-id/signin.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server nginx/1.13.1 date Fri, 06 Nov 2020 17:11:43 GMT content-type text/html; charset=UTF-8 content-length 1998 x-powered-by PHP/7.1.33 cache-control max-age=0 expires Fri, 06 Nov 2020 17:11:43 GMT vary Accept-Encoding content-encoding gzip accept-ranges bytes x-varnish 520831333 age 0 via 1.1 varnish strict-transport-security max-age=31536000
GET H2	200	style.css zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/css/	1 KB 860 B	132ms 132ms	Stylesheet text/css	35.231.219.73 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/css/style.css Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 35.231.219.73 , United States, ASN15169 (GOOGLE, US), Reverse DNS 73.219.231.35.bc.googleusercontent.com Software nginx/1.13.1 / Resource Hash cbf57f7edfa6e78d8ce3098d633c279c51cf5389164871abcef8b45dd93506a4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:43 GMT content-encoding gzip last-modified Fri, 06 Nov 2020 12:11:03 GMT server nginx/1.13.1 age 1240 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=31536000 x-varnish 520831334 520831162 strict-transport-security max-age=31536000 accept-ranges bytes content-length 556 via 1.1 varnish expires Sat, 06 Nov 2021 16:51:03 GMT
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/	156 KB 23 KB	9ms 7ms	Stylesheet text/css	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6 Security Headers Name Value X-Content-Type-Options nosniff Request headers Origin https://zoomy.teslathemes.com Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:43 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 28 Nov 2019 17:52:46 GMT status 200 etag "1574963566" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 23681
GET H2	200	logo.svg zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/img/	4 KB 2 KB	133ms 132ms	Image image/svg+xml	35.231.219.73 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/img/logo.svg Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 35.231.219.73 , United States, ASN15169 (GOOGLE, US), Reverse DNS 73.219.231.35.bc.googleusercontent.com Software nginx/1.13.1 / Resource Hash ad25ca4052e317ed079264f7dc8ff4f2a8c15417647e56afc8cec6eea3eb0de9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:43 GMT content-encoding gzip last-modified Fri, 06 Nov 2020 12:11:03 GMT server nginx/1.13.1 age 1240 vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=2592000 x-varnish 520831335 520831163 strict-transport-security max-age=31536000 accept-ranges bytes content-length 1402 via 1.1 varnish expires Sun, 06 Dec 2020 16:51:03 GMT
GET H2	200	bankcards_simplepay.png zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/img/	45 KB 46 KB	133ms 132ms	Image image/png	35.231.219.73 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/style/img/bankcards_simplepay.png Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 35.231.219.73 , United States, ASN15169 (GOOGLE, US), Reverse DNS 73.219.231.35.bc.googleusercontent.com Software nginx/1.13.1 / Resource Hash 87b2809f80ac77f0f0dfd9ce70bb7af1f5c49ed00061c92badc94399017b1352 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:43 GMT content-encoding gzip last-modified Fri, 06 Nov 2020 12:11:03 GMT server nginx/1.13.1 age 1240 vary Accept-Encoding content-type image/png status 200 cache-control max-age=10368000 x-varnish 520831336 520831164 strict-transport-security max-age=31536000 accept-ranges bytes content-length 46284 via 1.1 varnish expires Sat, 06 Mar 2021 16:51:03 GMT
GET H2	200	jquery-3.4.1.slim.min.js Show response code.jquery.com/	69 KB 24 KB	6500ms 10ms	Script application/javascript	2001:4de0:ac19::1:b:1b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.slim.min.js Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f Request headers Origin https://zoomy.teslathemes.com Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:49 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx status 200 etag W/"5cca0c33-1157d" vary Accept-Encoding x-hw 1604682709.dop129.fr8.t,1604682709.cds263.fr8.hn,1604682709.cds260.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24328
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/	21 KB 8 KB	22ms 6ms	Script application/javascript	2a04:4e42:1b::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://zoomy.teslathemes.com Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 8647800 x-cache HIT, HIT status 200 content-length 7510 etag W/"5309-YvI45zNIx3656GVCan0bfeI8uy0" x-served-by cache-fra19170-FRA, cache-hhn4053-HHN date Fri, 06 Nov 2020 17:11:43 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/	59 KB 16 KB	13ms 12ms	Script text/javascript	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js Requested by Host: zoomy.teslathemes.com URL: https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548 Security Headers Name Value X-Content-Type-Options nosniff Request headers Origin https://zoomy.teslathemes.com Referer https://zoomy.teslathemes.com/wp-content/plugins/ubh/protect-account-id/signin.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 06 Nov 2020 17:11:43 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 28 Nov 2019 17:52:52 GMT status 200 etag "1574963572" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * content-length 15919

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: E.ON (Utility)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
zoomy.teslathemes.com
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:2a
2a04:4e42:1b::621
35.231.219.73
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
87b2809f80ac77f0f0dfd9ce70bb7af1f5c49ed00061c92badc94399017b1352
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
ad25ca4052e317ed079264f7dc8ff4f2a8c15417647e56afc8cec6eea3eb0de9
bfa310fd011405bcc9ef7b6947b7030538417a3d8f6732c52a60341dee126cf4
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
cbf57f7edfa6e78d8ce3098d633c279c51cf5389164871abcef8b45dd93506a4