springwaterszim.co.zw Open in urlscan Pro
78.128.6.246  Malicious Activity! Public Scan

Submitted URL: https://mc.ht/s/A2A-PxF
Effective URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Submission: On September 01 via manual from SA — Scanned from DE

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 18 HTTP transactions. The main IP is 78.128.6.246, located in Bulgaria and belongs to TELEPOINT, BG. The main domain is springwaterszim.co.zw.
TLS certificate: Issued by R3 on July 12th 2022. Valid for: 3 months.
This is the only time springwaterszim.co.zw was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 18.185.191.84 16509 (AMAZON-02)
1 2a00:1288:110... 34010 (YAHOO-IRD)
1 78.137.164.103 31122 (DIGIWEB-AS)
1 13 78.128.6.246 31083 (TELEPOINT)
2 2a02:26f0:11a... ()
18 5
Apex Domain
Subdomains
Transfer
13 springwaterszim.co.zw
springwaterszim.co.zw
276 KB
2 typekit.net
use.typekit.net
1 cbrazzillweb.com
cbrazzillweb.com
420 B
1 yahoo.com
r.search.yahoo.com — Cisco Umbrella Rank: 7787
1 KB
1 manychat.com
my.manychat.com — Cisco Umbrella Rank: 467228
435 B
1 mc.ht
mc.ht
153 B
18 6
Domain Requested by
13 springwaterszim.co.zw 1 redirects springwaterszim.co.zw
2 use.typekit.net springwaterszim.co.zw
1 cbrazzillweb.com r.search.yahoo.com
1 r.search.yahoo.com
1 my.manychat.com 1 redirects
1 mc.ht 1 redirects
18 6

This site contains no links.

Subject Issuer Validity Valid
*.answers.search.yahoo.com
DigiCert SHA2 High Assurance Server CA
2022-05-31 -
2022-11-23
6 months crt.sh
cbrazzillweb.com
Sectigo RSA Domain Validation Secure Server CA
2022-01-18 -
2023-01-18
a year crt.sh
springwaterszim.co.zw
R3
2022-07-12 -
2022-10-10
3 months crt.sh
use.typekit.net
DigiCert TLS RSA SHA256 2020 CA1
2022-03-07 -
2023-04-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Frame ID: F82200ADD465376E40DBCA78BED6980D
Requests: 18 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://mc.ht/s/A2A-PxF HTTP 302
    https://my.manychat.com/r?act=330d4a112d9c965935509a5c3774271a&u=1270286856&p=110444111701477&h=0b67... HTTP 302
    https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2... Page URL
  2. https://cbrazzillweb.com/category/questions/ Page URL
  3. https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/ HTTP 302
    https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery-ui[.-]([\d.]*\d)[^/]*\.js
  • jquery-ui.*\.js

Page Statistics

18
Requests

89 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

277 kB
Transfer

1226 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mc.ht/s/A2A-PxF HTTP 302
    https://my.manychat.com/r?act=330d4a112d9c965935509a5c3774271a&u=1270286856&p=110444111701477&h=0b67fa25b6 HTTP 302
    https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ Page URL
  2. https://cbrazzillweb.com/category/questions/ Page URL
  3. https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/ HTTP 302
    https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://mc.ht/s/A2A-PxF HTTP 302
  • https://my.manychat.com/r?act=330d4a112d9c965935509a5c3774271a&u=1270286856&p=110444111701477&h=0b67fa25b6 HTTP 302
  • https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
RS=IfujaljCqpZLYzfXb2LkoAoPKaw-
r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/
Redirect Chain
  • https://mc.ht/s/A2A-PxF
  • https://my.manychat.com/r?act=330d4a112d9c965935509a5c3774271a&u=1270286856&p=110444111701477&h=0b67fa25b6
  • https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=Ifuja...
409 B
1 KB
Document
General
Full URL
https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:110:c104::2000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://csp.search.yahoo.com/xssreport

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
0
content-encoding
gzip
content-length
298
content-type
text/html; charset="UTF-8"
date
Thu, 01 Sep 2022 14:08:10 GMT
expect-ct
max-age=31536000, enforce
p3p
policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
referrer-policy
no-referrer-when-downgrade
server
ATS
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
1; mode=block; report=https://csp.search.yahoo.com/xssreport

Redirect headers

access-control-allow-origin
*
content-type
text/html; charset=UTF-8
date
Thu, 01 Sep 2022 14:08:10 GMT
location
https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ
server
openresty/1.19.9.1
/
cbrazzillweb.com/category/questions/
213 B
420 B
Document
General
Full URL
https://cbrazzillweb.com/category/questions/
Requested by
Host: r.search.yahoo.com
URL: https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
78.137.164.103 Dublin, Ireland, ASN31122 (DIGIWEB-AS, IE),
Reverse DNS
lh63.dnsireland.com
Software
Apache /
Resource Hash
3db0a94e444513aafd4c3245ca546ed29ee72283c090e600acad8875452bb668

Request headers

Referer
https://r.search.yahoo.com/_ylt=AwrNY0jhmhBjp5cIjmlXNyoA;_ylu=Y29sbwNiZjEEcG9zAzMEdnRpZAMEc2VjA3Ny/RV=2/RE=1662061410/RO=10/RU=https%3a%2f%2fcbrazzillweb.com%2fcategory%2fquestions%2f/RK=2/RS=IfujaljCqpZLYzfXb2LkoAoPKaw-?mcp_token=eyJwaWQiOjExMDQ0NDExMTcwMTQ3Nywic2lkIjoxMjcwMjg2ODU2LCJheCI6IjMzMGQ0YTExMmQ5Yzk2NTkzNTUwOWE1YzM3NzQyNzFhIiwidHMiOjE2NjIwNDEyOTAsImV4cCI6MTY2NDQ2MDQ5MH0.N79ig1mSY7bkO9mWUY4Otq2J07UncnbV-kimSwCNXzQ
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 01 Sep 2022 14:08:10 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
Primary Request Seleccione_medio_de_pago.php
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/
Redirect Chain
  • https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/
  • https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
28 KB
7 KB
Document
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache / PHP/7.2.34
Resource Hash
e6516868c13afda8b57d00ca85459a2e5e4f369e7bb4724de9eb6ba7d99558f9

Request headers

Referer
https://cbrazzillweb.com/category/questions/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 01 Sep 2022 14:08:14 GMT
server
Apache
vary
Accept-Encoding,User-Agent
x-powered-by
PHP/7.2.34

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 01 Sep 2022 14:08:13 GMT
location
Seleccione_medio_de_pago.php
server
Apache
vary
User-Agent
x-powered-by
PHP/7.2.34
typeKit.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
18 KB
7 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/typeKit.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
0cfa72c034d5c3ddfa8c6845af7dd7a62e0540d1b3190e100ef42758bb73fcc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"4618-5e79c14d76cc9-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
7210
bootstrap.css
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
149 KB
21 KB
Stylesheet
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/bootstrap.css
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
a29236eed54ff257f34dd88abfd5a2f14b9190d84802f6703152d6b4ea511ca9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"254c2-5e79c14d6f620-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
21187
main.css
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
22 KB
4 KB
Stylesheet
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/main.css
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
3cbab4ba18af9c0b3132c0e91509314d9eb810611ceec63b3a3f18a441e063b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"584e-5e79c14d72ace-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
3779
jquery-1.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
242 KB
71 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/jquery-1.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
9fcc241093405946885039df428cfa7f0051a1f2bdbcc5a313a177a9e35f8806

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"3c9ab-5e79c14d709ed-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
jquery-1_002.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
92 KB
33 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/jquery-1_002.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"16eac-5e79c14d714a2-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
33074
jquery-ui-1.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
206 KB
51 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/jquery-ui-1.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
794bf1ff4b8bbc981cb280b4efeb6e5b040afb34b85f6e3cd2546ace15910301

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"337d6-5e79c14d72566-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
52022
WebResource.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
22 KB
4 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/WebResource.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
1d1532c6ed3f42083f24c27b1971aa59ef6bfe07b4126d4666f319e43d011054

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"574a-5e79c14d771cb-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
4386
ScriptResource_002.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
349 KB
59 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/ScriptResource_002.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
0cfc4a70c37cecef342f0e14a9204008485665202a40ae48a2af09d381554435

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"575c1-5e79c14d766cd-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
60430
ScriptResource.js
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
93 KB
15 KB
Script
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/ScriptResource.js
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
06831185e31b1a87a5b40a61252ab31da46e5517f7899a1697a7ec8674adf5ab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
content-encoding
gzip
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"17598-5e79c14d751d4-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
15000
POST.svg
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Redsys_files/
2 KB
2 KB
Image
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Redsys_files/POST.svg
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
135b3e975a07622009b38d953e58526082588b1ad0795820c50af504742e1646

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"750-5e79c14d6ba85"
vary
User-Agent
content-type
image/svg+xml
accept-ranges
bytes
content-length
1872
ogilvy-iconoTarjeta.png
springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/
1 KB
1 KB
Image
General
Full URL
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione%20medio%20de%20pago_fichiers/ogilvy-iconoTarjeta.png
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
78.128.6.246 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS
ip-6-246.telehouse.bg
Software
Apache /
Resource Hash
ecc047250aed883bd0038ba4cdf2b4b7f7105e28fae93712ad1a9090b014a9c9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 14:08:14 GMT
last-modified
Thu, 01 Sep 2022 11:40:34 GMT
server
Apache
etag
"4a8-5e79c14d738c2"
vary
User-Agent
content-type
image/png
accept-ranges
bytes
content-length
1192
l
use.typekit.net/af/802da8/0000000000000000000124f9/27/
0
0
Font
General
Full URL
https://use.typekit.net/af/802da8/0000000000000000000124f9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::6867:4841 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
https://springwaterszim.co.zw/
Origin
https://springwaterszim.co.zw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
server
nginx
date
Thu, 01 Sep 2022 14:08:14 GMT
content-type
text/plain;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
x-cascade
pass
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
9
l
use.typekit.net/af/7505b0/0000000000000000000124fa/27/
0
0
Font
General
Full URL
https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D
Requested by
Host: springwaterszim.co.zw
URL: https://springwaterszim.co.zw/wp-admin/includes/Sa/Spl/saudipost2/saudipost/Seleccione_medio_de_pago.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::6867:4841 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
https://springwaterszim.co.zw/
Origin
https://springwaterszim.co.zw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
server
nginx
date
Thu, 01 Sep 2022 14:08:14 GMT
content-type
text/plain;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
x-cascade
pass
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
9
d
use.typekit.net/af/802da8/0000000000000000000124f9/27/
0
0

d
use.typekit.net/af/7505b0/0000000000000000000124fa/27/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
use.typekit.net
URL
https://use.typekit.net/af/802da8/0000000000000000000124f9/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D
Domain
use.typekit.net
URL
https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| Typekit

3 Cookies

Domain/Path Name / Value
.yahoo.com/ Name: A1
Value: d=AQABBMq8EGMCEBjF658gqCiA3yZN2HQ7CDY&S=AQAAAoeKEqg34Q3UhYPjNTGVW-k
.yahoo.com/ Name: A3
Value: d=AQABBMq8EGMCEBjF658gqCiA3yZN2HQ7CDY&S=AQAAAoeKEqg34Q3UhYPjNTGVW-k
.yahoo.com/ Name: A1S
Value: d=AQABBMq8EGMCEBjF658gqCiA3yZN2HQ7CDY&S=AQAAAoeKEqg34Q3UhYPjNTGVW-k&j=GDPR

2 Console Messages

Source Level URL
Text
network error URL: https://use.typekit.net/af/802da8/0000000000000000000124f9/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://use.typekit.net/af/7505b0/0000000000000000000124fa/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&token=yjzt92fIDu%2Bi2yE%2FC%2FROvpoHRueJpI3lKQz6Qi7aWTw%3D
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://csp.search.yahoo.com/xssreport