sa-fdx-ba11d6.ingress-earth.ewp.live
Open in
urlscan Pro
63.250.43.128
Malicious Activity!
Public Scan
Effective URL: https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/payment.php?sX2FYWkdqfe5glPddH3eImkU6dLqdQlUJx6YgN4cM2vgqV9MkU86bxwYXPRVIXKyKevoDnZ94...
Submission: On August 29 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.
This is the only time sa-fdx-ba11d6.ingress-earth.ewp.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fedex (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 178.63.197.85 178.63.197.85 | 24940 (HETZNER-AS) (HETZNER-AS) | |
2 5 | 63.250.43.128 63.250.43.128 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 18.66.147.60 18.66.147.60 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 4 |
ASN24940 (HETZNER-AS, DE)
PTR: static.85.197.63.178.clients.your-server.de
fedexdelivery.invoice.datepalm.ae |
ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-earth.easywp.com
sa-fdx-ba11d6.ingress-earth.ewp.live |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-60.fra60.r.cloudfront.net
mir-s3-cdn-cf.behance.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
ewp.live
2 redirects
sa-fdx-ba11d6.ingress-earth.ewp.live |
485 KB |
1 |
behance.net
mir-s3-cdn-cf.behance.net — Cisco Umbrella Rank: 24809 |
|
1 |
datepalm.ae
fedexdelivery.invoice.datepalm.ae |
430 B |
7 | 3 |
Domain | Requested by | |
---|---|---|
5 | sa-fdx-ba11d6.ingress-earth.ewp.live |
2 redirects
sa-fdx-ba11d6.ingress-earth.ewp.live
|
1 | mir-s3-cdn-cf.behance.net |
sa-fdx-ba11d6.ingress-earth.ewp.live
|
1 | fedexdelivery.invoice.datepalm.ae | |
7 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.fedex.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
fedexdelivery.invoice.datepalm.ae cPanel, Inc. Certification Authority |
2022-07-07 - 2022-10-05 |
3 months | crt.sh |
*.ingress-earth.ewp.live Sectigo RSA Domain Validation Secure Server CA |
2022-05-24 - 2023-05-24 |
a year | crt.sh |
*.behance.net Amazon |
2022-05-23 - 2023-06-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/payment.php?sX2FYWkdqfe5glPddH3eImkU6dLqdQlUJx6YgN4cM2vgqV9MkU86bxwYXPRVIXKyKevoDnZ94pB04Nf3vDbNX2NEMi4WAvII6LUOwdvs9IGBopBbbHenR2yOzaoZHUbCfh0cN54S6ImDwGLYBA7KFMKQQpP34mDZdoWdDNEHgjU3DdQi&lg=sa
Frame ID: 2C0D3535133C8D20986B201912D8CF58
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
(DE) دفع رسوم الشحنPage URL History Show full URLs
- https://fedexdelivery.invoice.datepalm.ae/destination-saudiarabia.htm Page URL
-
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi
HTTP 301
http://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ HTTP 307
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ Page URL
-
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/index.php
HTTP 302
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/payment.php?sX2FYWkdqfe5glPddH3eImkU6dLqdQlUJx6YgN4cM2vgqV9MkU86b... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: تتبع باستخدام البريد الإلكتروني
Search URL Search Domain Scan URL
Title: الأسئلة المتكررة
Search URL Search Domain Scan URL
Title: شروط النقل
Search URL Search Domain Scan URL
Title: تغيير الدولة / المنطقة
Search URL Search Domain Scan URL
Title: شروط الاستخدام
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://fedexdelivery.invoice.datepalm.ae/destination-saudiarabia.htm Page URL
-
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi
HTTP 301
http://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ HTTP 307
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ Page URL
-
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/index.php
HTTP 302
https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/payment.php?sX2FYWkdqfe5glPddH3eImkU6dLqdQlUJx6YgN4cM2vgqV9MkU86bxwYXPRVIXKyKevoDnZ94pB04Nf3vDbNX2NEMi4WAvII6LUOwdvs9IGBopBbbHenR2yOzaoZHUbCfh0cN54S6ImDwGLYBA7KFMKQQpP34mDZdoWdDNEHgjU3DdQi&lg=sa Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi HTTP 301
- http://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ HTTP 307
- https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
destination-saudiarabia.htm
fedexdelivery.invoice.datepalm.ae/ |
266 B 430 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/ Redirect Chain
|
58 B 402 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
payment.php
sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/ Redirect Chain
|
2 MB 449 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
payment.php
sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
box.jpg
sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/assets/img/ |
35 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c2c8d369020497.5b71f218dd54e.gif
mir-s3-cdn-cf.behance.net/project_modules/max_1200/ |
2 MB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
44 KB 44 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
46 KB 46 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
44 KB 44 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sa-fdx-ba11d6.ingress-earth.ewp.live
- URL
- https://sa-fdx-ba11d6.ingress-earth.ewp.live/saudi/auth/payment.php?sX2FYWkdqfe5glPddH3eImkU6dLqdQlUJx6YgN4cM2vgqV9MkU86bxwYXPRVIXKyKevoDnZ94pB04Nf3vDbNX2NEMi4WAvII6LUOwdvs9IGBopBbbHenR2yOzaoZHUbCfh0cN54S6ImDwGLYBA7KFMKQQpP34mDZdoWdDNEHgjU3DdQi&lg=sa
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fedex (Transportation)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| onReady function| setVisible function| savepage_ShadowLoader object| userName function| restrictNumber function| modifyInput0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fedexdelivery.invoice.datepalm.ae
mir-s3-cdn-cf.behance.net
sa-fdx-ba11d6.ingress-earth.ewp.live
sa-fdx-ba11d6.ingress-earth.ewp.live
178.63.197.85
18.66.147.60
63.250.43.128
3515b2d415906e10e8b508c8fa2404bb8898a533518e7648e119845c25b3cac1
99f7cd905d160e4bf4408195b22a893a45661a8855a0841e207d5bafe7411d90
a0bb0e1a14e37723f7a9b0b13ce4c26969f163c7b07deb696fe4b379f5293e08
a57721f374a176d270b44eddaeded57e0a98eb3981d87064f1c57f226876def4
b6eb141c02454bb6e59981e13c9936dd3b30f84f3d0831a3585c67f7fd1534e2
c18a20f2ba48373c2d4064e6cc511559006444a75a2d0bdd9ae03a4f8cc0d2b1
c361fe5762f2acd3432bf233c0012887c1c2c3523314872675d1924d33b47098
e1b6b1b51dec02bac5c41505b95cbb9056cb1d5f731d98fcb82a1a2cf40824ea