urlscan.io logo urlscan.io
SecurityTrails logo

wordpress-96498-0.cloudclusters.net Open in urlscan Pro
68.64.164.88  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://uammalam.blogspot.com/
Effective URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Submission: On November 22 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 20 HTTP transactions. The main IP is 68.64.164.88, located in United States and belongs to NETRANGE, US. The main domain is wordpress-96498-0.cloudclusters.net.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on February 23rd 2022. Valid for: a year.
This is the only time wordpress-96498-0.cloudclusters.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nickel (Financial)

Domain & IP information

IP Address AS Autonomous System
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 11 68.64.164.88 17139 (NETRANGE)
4 2.20.143.107 20940 (AKAMAI-ASN1)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
20 6
2    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
uammalam.blogspot.com
2    2a00:1450:4001:802::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.blogger.com
11    68.64.164.88 (United States)

ASN17139 (NETRANGE, US)
wordpress-96498-0.cloudclusters.net
4    2.20.143.107 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-20-143-107.deploy.static.akamaitechnologies.com
app.nickel.eu
static-resources.nickel.eu
1    2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
rawgit.com
Apex Domain
Subdomains		 Transfer
11 cloudclusters.net
wordpress-96498-0.cloudclusters.net
39 KB
4 nickel.eu
app.nickel.eu
static-resources.nickel.eu
289 KB
2 blogger.com
www.blogger.com — Cisco Umbrella Rank: 8797
162 KB
2 blogspot.com
uammalam.blogspot.com
6 KB
1 rawgit.com
rawgit.com — Cisco Umbrella Rank: 9108
38 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 669
30 KB
20 6
Domain Requested by
11 wordpress-96498-0.cloudclusters.net 1 redirects uammalam.blogspot.com
wordpress-96498-0.cloudclusters.net
3 static-resources.nickel.eu wordpress-96498-0.cloudclusters.net
2 www.blogger.com uammalam.blogspot.com
2 uammalam.blogspot.com uammalam.blogspot.com
1 rawgit.com wordpress-96498-0.cloudclusters.net
1 code.jquery.com wordpress-96498-0.cloudclusters.net
1 app.nickel.eu wordpress-96498-0.cloudclusters.net
20 7

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2022-11-02 -
2023-01-25		 3 months crt.sh
*.blogger.com
GTS CA 1C3		 2022-11-02 -
2023-01-25		 3 months crt.sh
*.cloudclusters.net
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2022-02-23 -
2023-03-26		 a year crt.sh
bnp09s.bnpparibas.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-11 -
2023-03-22		 5 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-06 -
2023-06-05		 a year crt.sh

This page contains 1 frames:

Primary Page: https://wordpress-96498-0.cloudclusters.net/post/clients/
Frame ID: 8CC4660F2E69D3D56C8A302BA721BB02
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Espace client : Gérer son compte | Nickel

Page URL History Show full URLs

  1. https://uammalam.blogspot.com/ Page URL
  2. https://wordpress-96498-0.cloudclusters.net/post/?op=1&ref=&date=undefined&courriel=undefined&0.3248252112175207 HTTP 302
    https://wordpress-96498-0.cloudclusters.net/post/clients/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

564 kB
Transfer

1048 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://uammalam.blogspot.com/ Page URL
  2. https://wordpress-96498-0.cloudclusters.net/post/?op=1&ref=&date=undefined&courriel=undefined&0.3248252112175207 HTTP 302
    https://wordpress-96498-0.cloudclusters.net/post/clients/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
uammalam.blogspot.com/ 		9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://uammalam.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
69f6616f5fa8a99580b19cdf2aa02c8765945ebdb353f1f925cf91db5668005a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
3357
content-type
text/html; charset=UTF-8
date
Tue, 22 Nov 2022 01:27:30 GMT
etag
W/"b71e1ca62e3544696583d4c8a415616d6faf1ee6fde0b942f114370d0ffd5196"
expires
Tue, 22 Nov 2022 01:27:30 GMT
last-modified
Sun, 20 Nov 2022 09:32:03 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
2975350028-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 		35 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/widgets/2975350028-css_bundle_v2.css
Requested by
Host: uammalam.blogspot.com
URL: https://uammalam.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://uammalam.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:08:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1129
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7776
x-xss-protection
0
last-modified
Mon, 21 Nov 2022 15:52:34 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Wed, 22 Nov 2023 01:08:41 GMT
cookienotice.js
uammalam.blogspot.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://uammalam.blogspot.com/js/cookienotice.js
Requested by
Host: uammalam.blogspot.com
URL: https://uammalam.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://uammalam.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Mon, 21 Nov 2022 14:07:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
40818
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2026
x-xss-protection
0
last-modified
Mon, 21 Nov 2022 13:51:27 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Mon, 28 Nov 2022 14:07:12 GMT
2342155703-widgets.js
www.blogger.com/static/v1/widgets/ 		153 KB
153 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/widgets/2342155703-widgets.js
Requested by
Host: uammalam.blogspot.com
URL: https://uammalam.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://uammalam.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:04:22 GMT
x-content-type-options
nosniff
age
1388
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
156915
x-xss-protection
0
last-modified
Mon, 21 Nov 2022 19:52:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Wed, 22 Nov 2023 01:04:22 GMT
Primary Request /
wordpress-96498-0.cloudclusters.net/post/clients/
Redirect Chain
  • https://wordpress-96498-0.cloudclusters.net/post/?op=1&ref=&date=undefined&courriel=undefined&0.3248252112175207
  • https://wordpress-96498-0.cloudclusters.net/post/clients/
188 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/clients/
Requested by
Host: uammalam.blogspot.com
URL: https://uammalam.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
939a1d3c8c49ee6551aa504ca8f5a47ef5e8eba28ebae68336801e7f09938685
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://uammalam.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
25166
content-type
text/html; charset=UTF-8
date
Tue, 22 Nov 2022 01:27:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 22 Nov 2022 01:27:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
clients/
pragma
no-cache
strict-transport-security
max-age=15724800; includeSubDomains
86fffa26.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		25 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/86fffa26.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
222662d0ed5617d8df9772f5394fdb715acdd3296f00d6db261b682e8400ecd2
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:38 GMT
etag
"65df-5edd7f46ba480-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
2431
expires
Wed, 22 Nov 2023 01:27:31 GMT
24571a40.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		32 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/24571a40.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
4da7ff58a085e3c3fdc781d9e38117c808d7d3425dda5ab7d605d05ad7025493
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:38 GMT
etag
"803e-5edd7f46ba480-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
5004
expires
Wed, 22 Nov 2023 01:27:31 GMT
des.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/des.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
5ce7979af69c35c2381677bbb13f2c07717278dbbb31c09984310e34408d5c4b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:38 GMT
etag
"27c8-5edd7f46ba480-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1951
expires
Wed, 22 Nov 2023 01:27:31 GMT
f55d3599.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/f55d3599.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
29a377530b36d1a9e568c24f4539126c6342ce8bc14de3843fdcf7a3dc18add4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:38 GMT
etag
"16e3-5edd7f46ba480-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
911
expires
Wed, 22 Nov 2023 01:27:31 GMT
645939e1.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		10 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/645939e1.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
368d3e222fb20951615a298ab3bd932813679981b92d448183a988068c113d77
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:38 GMT
etag
"27f9-5edd7f46ba480-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1558
expires
Wed, 22 Nov 2023 01:27:31 GMT
fe9185d1.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/fe9185d1.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
6392a748f3002e48611ba86cd3f3bec9ff95a4f2c11449e15dc1253ce3585028
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sat, 19 Nov 2022 19:37:37 GMT
etag
"15db-5edd7f45c6240-gzip"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
902
expires
Wed, 22 Nov 2023 01:27:31 GMT
2282daa7.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/2282daa7.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate, max-age=0
link
<https://wordpress-96498-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
content-length
20703
expires
Wed, 11 Jan 1984 05:00:00 GMT
74.b7389af6.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/74.b7389af6.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate, max-age=0
link
<https://wordpress-96498-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
content-length
20732
expires
Wed, 11 Jan 1984 05:00:00 GMT
65.045f2d82.chunk.css
wordpress-96498-0.cloudclusters.net/post/assets/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-96498-0.cloudclusters.net/post/assets/css/65.045f2d82.chunk.css
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
68.64.164.88 , United States, ASN17139 (NETRANGE, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/post/clients/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate, max-age=0
link
<https://wordpress-96498-0.cloudclusters.net/wp-json/>; rel="https://api.w.org/"
content-length
20686
expires
Wed, 11 Jan 1984 05:00:00 GMT
sketch-homepage.a14b9180.png
app.nickel.eu/static/media/ 		193 KB
194 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.nickel.eu/static/media/sketch-homepage.a14b9180.png
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.107 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-107.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
234a61d9c004512f92960323b0e8ea01bf7138f7e3daa22648f50000bec54301
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
x-envoy-decorator-operation
espace-perso.spartacus-frontend.svc.cluster.local:80/*
X-Content-Type-Options
nosniff
Content-Security-Policy
frame-ancestors 'self'
Last-Modified
Wed, 02 Nov 2022 13:55:29 GMT
Date
Tue, 22 Nov 2022 01:27:31 GMT
ETag
"636276d1-304db"
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
public
x-envoy-upstream-service-time
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
197851
X-Xss-Protection
1; mode=block
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d9d"
vary
Accept-Encoding
x-hw
1669080451.dop143.fr8.t,1669080451.cds289.fr8.hn,1669080451.cds144.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
jquery.inputmask.js
rawgit.com/RobinHerbots/Inputmask/5.x/dist/ 		193 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rawgit.com/RobinHerbots/Inputmask/5.x/dist/jquery.inputmask.js
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/clients/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cfaa794a00f343478348b84cfbde43882c5bb941286c4b55cefab5c6b4ae87f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://wordpress-96498-0.cloudclusters.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 01:27:31 GMT
strict-transport-security
max-age=31536000; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
rawgit-cache-status
EXPIRED
server
cloudflare
etag
W/"20aa94bbd069958096e367bf33d6b2ae71d2aa5e42eff352dfe954421b15d673"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1oG3d3Nfba98YAZl%2BTCwVJY2Z0S5EWrbSPpDrheFw0KMC%2Fr4Vs4laF3cwSSDIa5YplgYXsonAPvM8FR5WnMxa2zzTVNw1bElJ%2BC4NMCP1MahHSV1YhbnZq%2FwpYW43P2t0IgKFviknbTR"}],"group":"cf-nel","max_age":604800}
sunset
Tue, 01 Oct 2019 00:00:00 GMT
access-control-allow-origin
*
content-type
application/javascript;charset=utf-8
cache-control
max-age=3600, s-maxage=300
x-robots-tag
none
link
<https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."
cf-ray
76dde215ce87bb49-FRA
MullerNarrow-Light.woff2
static-resources.nickel.eu/fonts/ 		31 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static-resources.nickel.eu/fonts/MullerNarrow-Light.woff2
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/86fffa26.chunk.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.107 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-107.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f0e7fef75b97057f33e9ba884f068688dd6514ad2e303685ab29418e1390b842
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://wordpress-96498-0.cloudclusters.net/
Origin
https://wordpress-96498-0.cloudclusters.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
x-envoy-decorator-operation
static-resources.spartacus-frontend.svc.cluster.local:80/*
Date
Tue, 22 Nov 2022 01:27:32 GMT
Last-Modified
Wed, 01 Sep 2021 15:49:38 GMT
ETag
"612fa112-7d18"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
x-envoy-upstream-service-time
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32024
MullerNarrow-ExtraBold.woff2
static-resources.nickel.eu/fonts/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static-resources.nickel.eu/fonts/MullerNarrow-ExtraBold.woff2
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/86fffa26.chunk.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.107 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-107.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e671416c9ac25a7877362f1c6581b91fbe987ec04e187b365a96a3feecc2bb1a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://wordpress-96498-0.cloudclusters.net/
Origin
https://wordpress-96498-0.cloudclusters.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
x-envoy-decorator-operation
static-resources.spartacus-frontend.svc.cluster.local:80/*
Date
Tue, 22 Nov 2022 01:27:32 GMT
Last-Modified
Wed, 01 Sep 2021 15:49:38 GMT
ETag
"612fa112-78f8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
x-envoy-upstream-service-time
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30968
MullerNarrow-Medium.woff2
static-resources.nickel.eu/fonts/ 		32 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static-resources.nickel.eu/fonts/MullerNarrow-Medium.woff2
Requested by
Host: wordpress-96498-0.cloudclusters.net
URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/86fffa26.chunk.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.20.143.107 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-20-143-107.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f996d7eb10768373376f60c455f38135808f5ad7d6a347aec0584362de092fa7
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://wordpress-96498-0.cloudclusters.net/
Origin
https://wordpress-96498-0.cloudclusters.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
x-envoy-decorator-operation
static-resources.spartacus-frontend.svc.cluster.local:80/*
Date
Tue, 22 Nov 2022 01:27:32 GMT
Last-Modified
Wed, 01 Sep 2021 15:49:38 GMT
ETag
"612fa112-8114"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
x-envoy-upstream-service-time
0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33044

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nickel (Financial)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Inputmask function| default function| resetpass function| refreshpass

1 Cookies

Domain/Path Name / Value
wordpress-96498-0.cloudclusters.net/ Name: PHPSESSID
Value: p4h86ldegt36vqnsa58galpp61

3 Console Messages

Source Level URL
Text
network error URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/74.b7389af6.chunk.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/2282daa7.chunk.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://wordpress-96498-0.cloudclusters.net/post/assets/css/65.045f2d82.chunk.css
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block