![](/screenshots/47d51b3b-1b4b-42f4-8375-c87dd374f567.png)
championlighting.com
Open in
urlscan Pro
2606:4700:20::681a:9aa
Malicious Activity!
Public Scan
Effective URL: https://championlighting.com/tvls.online_portal-clients.signon/auth/pM5zH2/msg.php?id=14459237
Submission: On May 31 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 16th 2023. Valid for: a year.
This is the only time championlighting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 107.181.162.130 107.181.162.130 | 46562 (PERFORMIVE) (PERFORMIVE) | |
2 11 | 2606:4700:20:... 2606:4700:20::681a:9aa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
championlighting.com
2 redirects
championlighting.com |
19 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 249 |
413 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 367 |
49 KB |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 66 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 745 |
30 KB |
1 |
getvimax.com
1 redirects
getvimax.com |
265 B |
16 | 7 |
Domain | Requested by | |
---|---|---|
11 | championlighting.com |
2 redirects
championlighting.com
|
2 | cdnjs.cloudflare.com |
championlighting.com
|
2 | cdn.jsdelivr.net |
championlighting.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
championlighting.com
|
1 | code.jquery.com |
championlighting.com
|
1 | getvimax.com | 1 redirects |
16 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-16 - 2024-04-15 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://championlighting.com/tvls.online_portal-clients.signon/auth/pM5zH2/msg.php?id=14459237
Frame ID: 58DC07D125AA0FB95C1C41776E3324E3
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/47d51b3b-1b4b-42f4-8375-c87dd374f567.png)
Page Title
TV LicensingPage URL History Show full URLs
-
https://getvimax.com/
HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/ HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/auth/?pwd=tvlicensing HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/auth/pM5zH2/msg.php?id=14459237 Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://getvimax.com/
HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/ HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/auth/?pwd=tvlicensing HTTP 302
https://championlighting.com/tvls.online_portal-clients.signon/auth/pM5zH2/msg.php?id=14459237 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
msg.php
championlighting.com/tvls.online_portal-clients.signon/auth/pM5zH2/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
championlighting.com/tvls.online_portal-clients.signon/auth/media/css/ |
41 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
championlighting.com/tvls.online_portal-clients.signon/auth/media/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
championlighting.com/tvls.online_portal-clients.signon/auth/media/imgs/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu.png
championlighting.com/tvls.online_portal-clients.signon/auth/media/imgs/ |
396 B 712 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-right.png
championlighting.com/tvls.online_portal-clients.signon/auth/media/imgs/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search.png
championlighting.com/tvls.online_portal-clients.signon/auth/media/imgs/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/ |
1 MB 410 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js.js
championlighting.com/tvls.online_portal-clients.signon/auth/media/js/ |
43 B 358 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bt.png
championlighting.com/tvls.online_portal-clients.signon/auth/media/imgs/ |
409 B 721 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp boolean| loaded1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
championlighting.com/ | Name: PHPSESSID Value: notgc8dp6hql1qrgqnrqt8p2e6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
championlighting.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
getvimax.com
107.181.162.130
2001:4de0:ac18::1:a:2b
2606:4700:20::681a:9aa
2606:4700::6811:190e
2a00:1450:4001:812::2003
2a00:1450:4001:82a::200a
2a04:4e42:200::485
1c107e36a8cbddc2c38faae506943d599db9e614bd069edbbb6bcac564f4bbca
1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615
1e11d92805491cdc5b21b0fe6f4ad5ee01bc040167083f6a644cf2d7927b39ad
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
46d8fed6494121a9a8de4972f558b26214c1168d4837b2d7a5efc75389ddf7c6
56bbba27aca000ef07b7211c45376d973edb78279c3f5b5f81c370d2654b6924
61598ff99a2e8e72ee61f76fc44d68cd49364cefa3e84f8610d3a9efa9df9e21
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
75d899a261acba8ec184111db23c704247d22c16a14fe65b9cbaf47498c3f6ef
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
d6e7b2f15bb117fdfd961186bee4f91db45f59b59a94699c76f88af23e7840eb
dccbc0756d0d7cda854a0996097cc96d020ab71369282b68dd1b824cea50ace2