id-f0596.viabuscrop.com Open in urlscan Pro
5.206.227.237 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://vistavalleycs.com/f10/68189
Effective URL:
https://id-f0596.viabuscrop.com/public/2086981?page=250
Submission: On February 02 via api (February 2nd 2024, 3:46:18 am UTC) from ES — Scanned from ES

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 5.206.227.237, located in Miranda do Corvo, Portugal and belongs to NETSOLUTIONS, MO. The main domain is id-f0596.viabuscrop.com.
TLS certificate: Issued by R3 on February 2nd 2024. Valid for: 3 months.

This is the only time id-f0596.viabuscrop.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	66.63.189.6 66.63.189.6	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
1 14	5.206.227.237 5.206.227.237	47674 (NETSOLUTIONS) (NETSOLUTIONS)
15	3

1 66.63.189.6 (Secaucus, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 6-host.tombody.com

vistavalleycs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 5.206.227.237 (Miranda do Corvo, Portugal) 1 redirects

ASN47674 (NETSOLUTIONS, MO)
PTR: www.limon.com

id-f0596.viabuscrop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	viabuscrop.com 1 redirects id-f0596.viabuscrop.com	460 KB
1	vistavalleycs.com vistavalleycs.com	397 B
0	Failed function sub() { [native code] }. Failed
15	3

	Domain	Requested by
14	id-f0596.viabuscrop.com	1 redirects vistavalleycs.com id-f0596.viabuscrop.com
1	vistavalleycs.com
0	eofcbnmajmjmplflapaojjnihcjkigck Failed	id-f0596.viabuscrop.com
15	3

This site contains no links.

Subject Issuer	Validity	Valid
vistavalleycs.com R3	`2024-02-01` - `2024-05-01`	3 months	crt.sh
id-f0596.viabuscrop.com R3	`2024-02-02` - `2024-05-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://id-f0596.viabuscrop.com/public/2086981?page=250
Frame ID: 3D0C52D71C8960C923AB2EC6E2558EE4
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL

Page URL History Show full URLs

https://vistavalleycs.com/f10/68189 Page URL
https://id-f0596.viabuscrop.com/adblogin.php?page=250 HTTP 302
https://id-f0596.viabuscrop.com/public/2086981?page=250 Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

460 kB
Transfer

928 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://vistavalleycs.com/f10/68189 Page URL
https://id-f0596.viabuscrop.com/adblogin.php?page=250 HTTP 302
https://id-f0596.viabuscrop.com/public/2086981?page=250 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	68189 vistavalleycs.com/f10/	136 B 397 B	1662ms 1007ms	Document text/html	66.63.189.6 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://vistavalleycs.com/f10/68189 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.63.189.6 Secaucus, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 6-host.tombody.com Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / PHP/5.4.16 Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers Connection Keep-Alive Content-Length 136 Content-Type text/html; charset=utf-8 Date Fri, 02 Feb 2024 03:46:11 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 X-Powered-By PHP/5.4.16
GET H/1.1	200 OK	Primary Request 2086981 Show response id-f0596.viabuscrop.com/public/ Redirect Chain https://id-f0596.viabuscrop.com/adblogin.php?page=250 https://id-f0596.viabuscrop.com/public/2086981?page=250	18 KB 5 KB	397ms 397ms	Document text/html	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/2086981?page=250 Requested by Host: vistavalleycs.com URL: https://vistavalleycs.com/f10/68189 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `fb9b6712c0bcc9e90a6fa73a2ea0e68ae4198e054c64f3f593404ae7a4c9a4e5` Request headers Referer https://vistavalleycs.com/f10/68189 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Length 4679 Content-Type text/html; charset=utf-8 Date Fri, 02 Feb 2024 03:46:13 GMT Server nginx/1.20.1 Vary Accept-Encoding Redirect headers Connection keep-alive Content-Length 62 Content-Type text/html; charset=utf-8 Date Fri, 02 Feb 2024 03:46:13 GMT Server nginx/1.20.1 location public/2086981?page=250
GET H/1.1	200 OK	app.css id-f0596.viabuscrop.com/public/css/	428 KB 56 KB	308ms 306ms	Stylesheet text/css	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/css/app.css Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `a7352743989b2e4e420938b4a2d70efd21d103d04f8011ae31a7fefc5172b93c` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:13 GMT Content-Encoding gzip Last-Modified Sat, 27 Jan 2024 23:43:29 GMT Server nginx/1.20.1 ETag "6ae73-60ff5fac6ca40-gzip" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 56961
GET H/1.1	200 OK	font-awesome.min.css id-f0596.viabuscrop.com/public/css/	30 KB 7 KB	570ms 338ms	Stylesheet text/css	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/css/font-awesome.min.css Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Content-Encoding gzip Last-Modified Thu, 25 Jan 2024 22:11:24 GMT Server nginx/1.20.1 ETag "7918-60fcc75c73b00-gzip" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 7053
GET H/1.1	200 OK	jquery-1.12.2.min.js Show response id-f0596.viabuscrop.com/public/js/	95 KB 33 KB	589ms 357ms	Script application/javascript	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/js/jquery-1.12.2.min.js Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Content-Encoding gzip Last-Modified Wed, 14 Sep 2022 15:27:22 GMT Server nginx/1.20.1 ETag "17bdc-5e8a4c3deea80-gzip" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 33809
GET		fonts.css eofcbnmajmjmplflapaojjnihcjkigck/common/ui/fonts/	0 0

GET H/1.1	200 OK	logo.png id-f0596.viabuscrop.com/public/img/	2 KB 2 KB	569ms 337ms	Image image/png	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Show image Full URL https://id-f0596.viabuscrop.com/public/img/logo.png Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Last-Modified Thu, 25 Jan 2024 21:26:01 GMT Server nginx/1.20.1 ETag "7ce-60fcbd3798c40" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 1998
GET H/1.1	200 OK	all.png id-f0596.viabuscrop.com/public/img/	12 KB 12 KB	570ms 307ms	Image image/png	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Show image Full URL https://id-f0596.viabuscrop.com/public/img/all.png Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `c1d5409eecb402a99f10718b06c266ba314d9e25f0b56c6fd063699334b8be6d` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Last-Modified Thu, 25 Jan 2024 21:21:50 GMT Server nginx/1.20.1 ETag "30d3-60fcbc4839780" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 12499
GET H/1.1	404 Not Found	foo.png id-f0596.viabuscrop.com/images/	285 B 285 B	222ms 222ms	Image text/html	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Show image Full URL https://id-f0596.viabuscrop.com/images/foo.png Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/2086981?page=250 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `20a7bb718f20d1045ef758fcadaac4910ace9a13123e31a7d17bec370874aa01` Request headers accept-language es-ES,es;q=0.9 Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Server nginx/1.20.1 Connection keep-alive Content-Length 285 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	roboto-latin-400-normal.woff2 id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/	0 0	204ms 203ms	Font text/html	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/roboto-latin-400-normal.woff2?4673b4537a84c7f7a130799aa6af329b Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/css/app.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash Request headers Referer https://id-f0596.viabuscrop.com/public/css/app.css Origin https://id-f0596.viabuscrop.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Server nginx/1.20.1 Connection keep-alive Content-Length 285 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	free-fa-solid-900.woff2 id-f0596.viabuscrop.com/public/fonts/	153 KB 153 KB	310ms 309ms	Font font/woff2	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/fonts/free-fa-solid-900.woff2 Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/css/app.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368` Request headers Referer https://id-f0596.viabuscrop.com/public/css/app.css Origin https://id-f0596.viabuscrop.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Last-Modified Fri, 26 Jan 2024 18:55:15 GMT Server nginx/1.20.1 ETag "26358-60fddd621eac0" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 156504
GET H/1.1	200 OK	fontawesome-webfont.woff2 id-f0596.viabuscrop.com/public/fonts/	75 KB 76 KB	310ms 310ms	Font font/woff2	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/css/app.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe` Request headers Referer https://id-f0596.viabuscrop.com/public/css/app.css Origin https://id-f0596.viabuscrop.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Last-Modified Fri, 26 Jan 2024 18:27:12 GMT Server nginx/1.20.1 ETag "12d68-60fdd71d16000" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 77160
GET H/1.1	200 OK	free-fa-brands-400.woff2 id-f0596.viabuscrop.com/public/fonts/	115 KB 115 KB	249ms 249ms	Font font/woff2	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/fonts/free-fa-brands-400.woff2 Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/css/app.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `58522c58cbb9b2231026ce7d65096807a3f97fffaf22cea6fb180590286fa53d` Request headers Referer https://id-f0596.viabuscrop.com/public/css/app.css Origin https://id-f0596.viabuscrop.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Last-Modified Fri, 26 Jan 2024 18:54:58 GMT Server nginx/1.20.1 ETag "1ca80-60fddd51e8480" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 117376
POST H/1.1	200 OK	ajax.php Show response id-f0596.viabuscrop.com/public/phplib/	0 329 B	383ms 253ms	XHR text/html	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/public/phplib/ajax.php?id=2086981 Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/js/jquery-1.12.2.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://id-f0596.viabuscrop.com/public/2086981?page=250 X-Requested-With XMLHttpRequest accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Fri, 02 Feb 2024 03:46:14 GMT Server nginx/1.20.1 Content-Type text/html; charset=utf-8 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 0 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	404 Not Found	roboto-all-400-normal.woff id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/	0 0	230ms 229ms	Font text/html	5.206.227.237 NETSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c Requested by Host: id-f0596.viabuscrop.com URL: https://id-f0596.viabuscrop.com/public/css/app.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 5.206.227.237 Miranda do Corvo, Portugal, ASN47674 (NETSOLUTIONS, MO), Reverse DNS www.limon.com Software nginx/1.20.1 / Resource Hash Request headers Referer https://id-f0596.viabuscrop.com/public/css/app.css Origin https://id-f0596.viabuscrop.com accept-language es-ES,es;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers Date Fri, 02 Feb 2024 03:46:14 GMT Server nginx/1.20.1 Connection keep-alive Content-Length 285 Content-Type text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: eofcbnmajmjmplflapaojjnihcjkigck
URL: chrome-extension://eofcbnmajmjmplflapaojjnihcjkigck/common/ui/fonts/fonts.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			id-f0596.viabuscrop.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: v0b3kke69cud5sdn5hjgn1lhe0

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://eofcbnmajmjmplflapaojjnihcjkigck/common/ui/fonts/fonts.css Message: Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME
network	error	URL: https://id-f0596.viabuscrop.com/images/foo.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/roboto-latin-400-normal.woff2?4673b4537a84c7f7a130799aa6af329b Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://id-f0596.viabuscrop.com/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

eofcbnmajmjmplflapaojjnihcjkigck
id-f0596.viabuscrop.com
vistavalleycs.com
eofcbnmajmjmplflapaojjnihcjkigck
5.206.227.237
66.63.189.6
20a7bb718f20d1045ef758fcadaac4910ace9a13123e31a7d17bec370874aa01
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756
58522c58cbb9b2231026ce7d65096807a3f97fffaf22cea6fb180590286fa53d
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
a7352743989b2e4e420938b4a2d70efd21d103d04f8011ae31a7fefc5172b93c
a93f7f459e0dabc5d86e6b6e3936c07d2dd02b52369f26bb7e8c0005a5d26368
c1d5409eecb402a99f10718b06c266ba314d9e25f0b56c6fd063699334b8be6d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb9b6712c0bcc9e90a6fa73a2ea0e68ae4198e054c64f3f593404ae7a4c9a4e5

id-f0596.viabuscrop.com Open in urlscan Pro 5.206.227.237 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

460 kBTransfer

928 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

id-f0596.viabuscrop.com Open in urlscan Pro
5.206.227.237 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

460 kB
Transfer

928 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!