![](/screenshots/4280bc58-7454-43bd-b31f-69653563cff2.png)
mediaroomshop.com
Open in
urlscan Pro
2606:4700:3034::ac43:d7fd
Malicious Activity!
Public Scan
Effective URL: https://mediaroomshop.com/tra/?p=200&cep=CcBsCjUJZRFyhNsN6Z1pQrMP5JHhK8svSKJ2GQxzgJltCihfCU7-VGvX4mEoI4JwoACtQMl5SU7BzgUZX...
Submission: On June 15 via manual from CA
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 25th 2021. Valid for: a year.
This is the only time mediaroomshop.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 193.110.160.100 193.110.160.100 | 213273 (NRA Netwo...) (NRA Networks SRL.) | |
1 1 | 18.193.146.82 18.193.146.82 | 16509 (AMAZON-02) (AMAZON-02) | |
9 | 2606:4700:303... 2606:4700:3034::ac43:d7fd | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-146-82.eu-central-1.compute.amazonaws.com
click.go-4.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
mediaroomshop.com
mediaroomshop.com |
3 MB |
3 |
gstatic.com
fonts.gstatic.com |
24 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
83 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
32 KB |
1 |
go-4.xyz
1 redirects
click.go-4.xyz |
2 KB |
1 |
inigol.me
1 redirects
inigol.me |
420 B |
16 | 6 |
Domain | Requested by | |
---|---|---|
9 | mediaroomshop.com |
mediaroomshop.com
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | stackpath.bootstrapcdn.com |
mediaroomshop.com
stackpath.bootstrapcdn.com |
1 | ajax.googleapis.com |
mediaroomshop.com
|
1 | fonts.googleapis.com |
mediaroomshop.com
|
1 | click.go-4.xyz | 1 redirects |
1 | inigol.me | 1 redirects |
16 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
click.go-4.xyz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-25 - 2022-03-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-05-17 - 2021-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mediaroomshop.com/tra/?p=200&cep=CcBsCjUJZRFyhNsN6Z1pQrMP5JHhK8svSKJ2GQxzgJltCihfCU7-VGvX4mEoI4JwoACtQMl5SU7BzgUZX-_lk5Dtt6DWN7iSgQjnccCiQNhM347d314YkP4dFyIaPsl1lotpANRFOUNJnOJz03gAmLgGMVCmCAVkj5wQQDbHYoYMSgDGEc8CF-b-KX2hl1Y99blRTpiO1iyUXwJkhsm2FfXpdrxei7pnTUfGj46oGSUPu75GYW_YxMascHCcrMi8TEyf-HCYYt2IbWMcviI3LpOhFQqF45ekZIl_R84aS8kT4TLXGC5jO27FlbbZ4J87yjSCrdNmKy1snTLseA_gvbxINtINdCzVVg_shhPQzx0CnazVzNL0NMjWyoB5MsJkVbEqC_LBAQGSdzh_vXsj_d-mjDOv7Stv7F3MYix89NJwVvzA6N7mQOEEupiqv_5df112VYPf-cdVqEUTvEpQrfTiByF051ciBWGRRN2LxCZIbpWrAoA2l7aAc8bpmPEC&lptoken=167623a9788c00ce5825&click_id=DH1FuBl&var2=&var3=S60C8D4F87CC1C&var4=tx&var5=3&var6=&var7=&var8=Ella&var9=16047732797&var10=
Frame ID: 72C124CF7049A414902BB3232D208061
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/4280bc58-7454-43bd-b31f-69653563cff2.png)
Page URL History Show full URLs
-
http://inigol.me/DH1FuBl
HTTP 302
https://click.go-4.xyz/2edccad2-cfbf-4df0-8f0b-7ce5fc746a0a?click_id=DH1FuBl&var2=&var3=S60C8D4F87C... HTTP 302
https://mediaroomshop.com/tra/?p=200&cep=CcBsCjUJZRFyhNsN6Z1pQrMP5JHhK8svSKJ2GQxzgJltCihfCU7-VGvX4mEoI... Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
Detected patterns
- headers server /^cloudflare$/i
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Enter Shipping information
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://inigol.me/DH1FuBl
HTTP 302
https://click.go-4.xyz/2edccad2-cfbf-4df0-8f0b-7ce5fc746a0a?click_id=DH1FuBl&var2=&var3=S60C8D4F87CC1C&var4=tx&var5=3&var6=&var7=&var8=Ella&var9=16047732797&var10= HTTP 302
https://mediaroomshop.com/tra/?p=200&cep=CcBsCjUJZRFyhNsN6Z1pQrMP5JHhK8svSKJ2GQxzgJltCihfCU7-VGvX4mEoI4JwoACtQMl5SU7BzgUZX-_lk5Dtt6DWN7iSgQjnccCiQNhM347d314YkP4dFyIaPsl1lotpANRFOUNJnOJz03gAmLgGMVCmCAVkj5wQQDbHYoYMSgDGEc8CF-b-KX2hl1Y99blRTpiO1iyUXwJkhsm2FfXpdrxei7pnTUfGj46oGSUPu75GYW_YxMascHCcrMi8TEyf-HCYYt2IbWMcviI3LpOhFQqF45ekZIl_R84aS8kT4TLXGC5jO27FlbbZ4J87yjSCrdNmKy1snTLseA_gvbxINtINdCzVVg_shhPQzx0CnazVzNL0NMjWyoB5MsJkVbEqC_LBAQGSdzh_vXsj_d-mjDOv7Stv7F3MYix89NJwVvzA6N7mQOEEupiqv_5df112VYPf-cdVqEUTvEpQrfTiByF051ciBWGRRN2LxCZIbpWrAoA2l7aAc8bpmPEC&lptoken=167623a9788c00ce5825&click_id=DH1FuBl&var2=&var3=S60C8D4F87CC1C&var4=tx&var5=3&var6=&var7=&var8=Ella&var9=16047732797&var10= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
mediaroomshop.com/tra/ Redirect Chain
|
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
mediaroomshop.com/tra/css/ |
96 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles_dhl.css
mediaroomshop.com/tra/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.js
mediaroomshop.com/tra/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
logo-dhl.png
mediaroomshop.com/tra/images/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
box.png
mediaroomshop.com/tra/images/ |
44 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
Animation%20for%20DHL.gif
mediaroomshop.com/tra/images/ |
3 MB 3 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
icons.svg
mediaroomshop.com/tra/icons/ |
7 KB 3 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
dhl_hands_cutter_aotw.jpg
mediaroomshop.com/tra/images/ |
624 KB 624 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
click.go-4.xyz
fonts.googleapis.com
fonts.gstatic.com
inigol.me
mediaroomshop.com
stackpath.bootstrapcdn.com
18.193.146.82
193.110.160.100
2606:4700:3034::ac43:d7fd
2606:4700::6812:acf
2a00:1450:4001:808::2003
2a00:1450:4001:828::200a
2a00:1450:4001:82a::200a
13ed792d1208cb794c7eecefa59932a73bd6342d00f28d996e208bb6c8cfb764
209a354ab9cb2f34b9c6dac3b42271525c84ae3942ccbbf0aeb0c27df690b208
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
453fc9ef16bea9e93c1bca5dd859d3ebf4650264fa24a7f24eb447eae37bd393
590e2796f2345351966ce7398f8bf3bcbae960f7e0e85a8f25ee77393cbdb69a
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a23eaaf0c1b277524d529a57f109aace093eb355ab54221f30ff919b353ffc35
b0b43e548e691662dac85b1dc159d148a273d5cb9139f3fcf457cdeebe7bdf3f
c6390b2930b23fb5c4c4196001f994fbfaa5beb1c7670edd10f4c705eabb8e70
ca67a4bd2b5cd654fed617c04b74eb0ce7039e2ba7b7331adf447ae2573d0763
d4fcef067976a896ef0c86edf88ba396c1297ba1800976e993a39bd89a6bed1f
d657f5f4559dc7ca2114aa5c0b19d4da699bbcc7590e497a01f52b9967d4423d
d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fbbb8f7597c9e6ec1ae6aec2431ded8d711f4787be639239910f49698f45162b