wisereview.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2caa  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response wisereview.pages.dev/	2 KB 2 KB	248ms 215ms	Document text/html	2606:4700:310c::ac42:2caa CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wisereview.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2caa , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44d6e6421ea2a609111b5d9dc3ee0130dabe3cabd45a608b3edaf72ea1744ef5 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 801f9773cc228c8d-EWR content-encoding br content-type text/html; charset=utf-8 date Tue, 05 Sep 2023 15:44:05 GMT etag W/"2b9329ead94c7e7d1afb8e83c49385d7" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5x7KB1vKxEYSvxjGXii0rkuWXqSSfHRR6qaS1cFfM3Z0vnGPX%2F53tIV1un1wtCP6iyXFiBpOtnkX6SmWhj5wZueDMGoR%2FbLEunG8ZRKIEiFE%2BfnpVvGj%2FG9NKKOK3PsflGnmdQALkgVT8R%2F7sbrwHNFreQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	loading.gif 1.bp.blogspot.com/-RTK0ll2Vx0g/YJKC00ZeOPI/AAAAAAAABLk/VFG-YBkJOYIJTdPpS4SOEZV0XF2Q8HmcACLcBGAsYHQ/s0/	125 KB 126 KB	71ms 16ms	Image image/gif	2607:f8b0:4020:806::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-RTK0ll2Vx0g/YJKC00ZeOPI/AAAAAAAABLk/VFG-YBkJOYIJTdPpS4SOEZV0XF2Q8HmcACLcBGAsYHQ/s0/loading.gif Requested by Host: wisereview.pages.dev URL: https://wisereview.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 2a1e20235f63638e93ea2c61e69822ae63f5782fbceeb332ce23dbdd018f5d09 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://wisereview.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 12:54:27 GMT x-content-type-options nosniff age 10179 content-disposition inline;filename="loading.gif" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 128421 x-xss-protection 0 server fife etag "v4ba" vary Origin content-type image/gif access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Wed, 06 Sep 2023 12:54:27 GMT
GET H2	200	api.js Show response larissa.my.id/	63 KB 24 KB	308ms 13ms	Script application/javascript	75.2.60.5 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://larissa.my.id/api.js Requested by Host: wisereview.pages.dev URL: https://wisereview.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 75.2.60.5 , United States, ASN16509 (AMAZON-02, US), Reverse DNS acd89244c803f7181.awsglobalaccelerator.com Software Netlify / Resource Hash db0610c11517de44622cf958cc0390be0502885e3363b6408db2db8ed1049958 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-US,en;q=0.9 Referer https://wisereview.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers x-nf-request-id 01H9K07SJZ69AMXM3TARZ311YH date Tue, 05 Sep 2023 15:44:06 GMT content-encoding br strict-transport-security max-age=31536000 server Netlify age 68509 etag "7272fd514670ced2ea8a88b697619fb5-ssl-df" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 24542
GET H2	200	js15_as.js Show response s10.histats.com/	11 KB 5 KB	53ms 13ms	Script text/javascript	2606:4700:10::6814:91f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://s10.histats.com/js15_as.js Requested by Host: wisereview.pages.dev URL: https://wisereview.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:91f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede Request headers accept-language en-US,en;q=0.9 Referer https://wisereview.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers date Tue, 05 Sep 2023 15:44:06 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 16 Apr 2020 10:44:16 GMT server cloudflare age 85484 etag "-375139978" vary Accept-Encoding content-type text/javascript cache-control max-age=28800 accept-ranges bytes cf-ray 801f9775798018b1-EWR content-length 4547
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	50 B 184 B	45ms 10ms	Script text/html	149.56.240.127 OVH
General Check archive.org Show headers Download Go to Full URL https://s4.histats.com/stats/0.php?4602512&@f16&@g1&@h1&@i1&@j1693928646016&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:156946153&@b3:1693928646&@b4:js15_as.js&@b5:-600&@a-_0.2.1&@vhttps%3A%2F%2Fwisereview.pages.dev%2F&@w Requested by Host: s10.histats.com URL: https://s10.histats.com/js15_as.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 149.56.240.127 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ns534295.ip-149-56-240.net Software / Resource Hash 2eba4539cd541e37e7e19c4fe8ac0b2614b29ab73d2601b76f4265014e57c643 Request headers accept-language en-US,en;q=0.9 Referer https://wisereview.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 15:44:06 GMT Connection close Content-Length 50 Content-Type text/html;charset=UTF-8
GET H2	200	aliexpress.js Show response wget.my.id/aliexpress/	373 KB 134 KB	334ms 95ms	Script application/javascript	2606:4700:3035::ac43:9df1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wget.my.id/aliexpress/aliexpress.js?v=13009 Requested by Host: larissa.my.id URL: https://larissa.my.id/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:9df1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b397db442e08b3be360a951a20f324094e2d2cecfdf6d1861c6757412dca7fef Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://wisereview.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 05 Sep 2023 15:44:06 GMT content-encoding br referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-cache-status MISS etag W/"a60dd55e0911251fdbc44214ff14a1bd" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fB5U4jIIzhQm0YYDen7B37xht%2F%2BOGWxv%2BOKKoyOaAPW%2BIocYb%2FDj1EpZNdtznVPGQRXFW0j4m1H8sQsbSkqJCxmHlGF7%2FuGfkbeT7gLfELKpmWvtJp030mPHxlod3MVuouT77GSsP2i0"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 801f977a5c05c43e-EWR alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	0.gif sstatic1.histats.com/	43 B 163 B	45ms 12ms	Image image/gif	158.69.254.144 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://sstatic1.histats.com/0.gif?4270884&101 Requested by Host: wisereview.pages.dev URL: https://wisereview.pages.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 158.69.254.144 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ns548341.ip-158-69-254.net Software / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers accept-language en-US,en;q=0.9 Referer https://wisereview.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36 Response headers Date Tue, 05 Sep 2023 15:44:06 GMT Connection close Content-Length 43 Content-Type image/gif

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| _Hasync function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues function| _0x4eac82 function| _0x5aec86 function| _0x4b1cb2 function| _0x5665 function| _0x5edcce function| _0x5c7596 function| _0x435c89 function| _0x4600b1 function| _0x4f01a3 number| version function| _0x37d91a function| _0x396204 function| _0xd7bd function| _0x1064 function| _0x2ee889 function| _0x1786 function| _0xfa3638 function| _0x1fa030 function| _0x3eb97d function| _0x19f7 function| _0x1086b3

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstCfa4602512 Value: 1693928646016
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstCla4602512 Value: 1693928646016
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstCmu4602512 Value: 1693928646016
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstPn4602512 Value: 1
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstPt4602512 Value: 1
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstCnv4602512 Value: 1
			wisereview.pages.dev/	1970-01-20 23:17:44	Name: HstCns4602512 Value: 1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://larissa.my.id/api.js(Line 5) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://wget.my.id/aliexpress/aliexpress.js?v=13009, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://larissa.my.id/api.js(Line 5) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://wget.my.id/aliexpress/aliexpress.js?v=13009, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
larissa.my.id
s10.histats.com
s4.histats.com
sstatic1.histats.com
wget.my.id
wisereview.pages.dev
149.56.240.127
158.69.254.144
2606:4700:10::6814:91f
2606:4700:3035::ac43:9df1
2606:4700:310c::ac42:2caa
2607:f8b0:4020:806::2001
75.2.60.5
2a1e20235f63638e93ea2c61e69822ae63f5782fbceeb332ce23dbdd018f5d09
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
2eba4539cd541e37e7e19c4fe8ac0b2614b29ab73d2601b76f4265014e57c643
44d6e6421ea2a609111b5d9dc3ee0130dabe3cabd45a608b3edaf72ea1744ef5
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
b397db442e08b3be360a951a20f324094e2d2cecfdf6d1861c6757412dca7fef
db0610c11517de44622cf958cc0390be0502885e3363b6408db2db8ed1049958