test.worldwidecleaningsupport.com Open in urlscan Pro
2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://urlz.fr/lRqs
Effective URL:
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
Submission: On May 17 via automatic, source phishtank (May 17th 2023, 7:41:25 am UTC) — Scanned from FR

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3108::ac42:292e, located in United States and belongs to CLOUDFLARENET, US. The main domain is test.worldwidecleaningsupport.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 25th 2022. Valid for: a year.

This is the only time test.worldwidecleaningsupport.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3038::6815:ead6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	107.180.0.232 107.180.0.232	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
3 11	2606:4700:310... 2606:4700:3108::ac42:292e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.193.194 151.101.193.194	54113 (FASTLY) (FASTLY)
12	3

1 2606:4700:3038::6815:ead6 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

urlz.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.180.0.232 (Ashburn, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 232.0.180.107.host.secureserver.net

berlinestudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:3108::ac42:292e (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

test.worldwidecleaningsupport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.193.194 (United States)

ASN54113 (FASTLY, US)

sp-bootstrap.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	worldwidecleaningsupport.com 3 redirects test.worldwidecleaningsupport.com	163 KB
3	fastly.net sp-bootstrap.global.ssl.fastly.net — Cisco Umbrella Rank: 850215	216 KB
1	berlinestudio.com berlinestudio.com	560 B
1	urlz.fr 1 redirects urlz.fr	515 B
12	4

	Domain	Requested by
11	test.worldwidecleaningsupport.com	3 redirects berlinestudio.com test.worldwidecleaningsupport.com
3	sp-bootstrap.global.ssl.fastly.net	test.worldwidecleaningsupport.com
1	berlinestudio.com
1	urlz.fr	1 redirects
12	4

This site contains no links.

Subject Issuer	Validity	Valid
worldwidecleaningsupport.com Cloudflare Inc ECC CA-3	`2022-07-25` - `2023-07-24`	a year	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-05` - `2024-03-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
Frame ID: CE2B1970F4DFCCB1E45151ED4E6E1C39
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - Spotify

Page URL History Show full URLs

https://urlz.fr/lRqs HTTP 302
http://berlinestudio.com/storage_/services/ Page URL
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/ HTTP 302
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp HTTP 301
http://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/ HTTP 307
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/ HTTP 302
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

92 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

378 kB
Transfer

816 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://urlz.fr/lRqs HTTP 302
http://berlinestudio.com/storage_/services/ Page URL
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/ HTTP 302
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp HTTP 301
http://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/ HTTP 307
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/ HTTP 302
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://urlz.fr/lRqs HTTP 302
http://berlinestudio.com/storage_/services/

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/
berlinestudio.com/storage_/services/
Redirect Chain

https://urlz.fr/lRqs
http://berlinestudio.com/storage_/services/

433 B
560 B

521ms
414ms

Document
text/html

107.180.0.232
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://berlinestudio.com/storage_/services/
Protocol: HTTP/1.1
Server: 107.180.0.232 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 232.0.180.107.host.secureserver.net
Software: Apache / PHP/7.3.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 281
Content-Type: text/html; charset=UTF-8
Date: Wed, 17 May 2023 07:41:18 GMT
Keep-Alive: timeout=5
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=60
cf-cache-status: DYNAMIC
cf-ray: 7c8a379d0d5a01b5-CDG
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 07:41:18 GMT
expires: Wed, 17 May 2023 07:42:18 GMT
location: http://berlinestudio.com/storage_/services/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y9frkhy8mYIYYbpCNWhMIdXXnZAE%2BC6PfFTUmME%2FKa1WyCyq3W5JFncRJxlHF0Vj55fLJ5fMfFYbrQ5Tl1jTUXcpferedUxFm2idsRRDfdwZmOm%2F7AQR6HjMzYE3lgaPVaXjsY%2Bh"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-fastcgi-cache: HIT

GET
H3

200

Primary Request login.php Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/
Redirect Chain

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp
http://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/
https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

7 KB
3 KB

83ms
82ms

Document
text/html

2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Requested by

Host: berlinestudio.com
URL: http://berlinestudio.com/storage_/services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ebe60f82025e74000f53b43918c4235d0cb76dca40e65354e54a253d6b701c7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

Referer: http://berlinestudio.com/storage_/services/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-apo-via: origin,host
cf-cache-status: DYNAMIC
cf-ray: 7c8a37ab2b1f0187-CDG
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 07:41:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: referer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lDtbQEuUJ68Qxxa7xjwPJxtBZi%2BP8tIQMYMmJm6NX8My344%2BPOz6B22L%2FcvwKDxbAEHDK2RsOwwRjKV%2BeRNkdhNDoiFwB2w7gO0yHtHkPiPift%2BAG9Cdf4gm9ChfgEYEFn5ihsHztF3UbzLwnTbi68MekiYoDvfe9KRiMHPnidY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: : nosniff
x-frame-options: : sameorigin
x-xss-protection: : 1

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-apo-via: origin,host
cf-cache-status: DYNAMIC
cf-ray: 7c8a37aa8aab0187-CDG
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 07:41:20 GMT
location: login.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: referer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RXElH%2BRTybIeKeqM0tijxxBWVF9rQnaj%2FWjbVixRujdo1T4oJ8dkA28ib8BgjS3nA%2FcaF%2FzftsRLzVnq0nI6mv%2Bm%2BehSXK0JoQv38R9mby0%2BnleapzEzGnUWf5PjbQoIBEnfGN9gaEpdndyGD4yFbZHkgEemPH7lcrA7wqWbvEw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: : nosniff
x-frame-options: : sameorigin
x-xss-protection: : 1

GET
H3 200 stylecss.css
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/ 289 KB
47 KB 122ms
121ms Stylesheet
text/css 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

592ecdf44cc618653bda5ba4ad8f87ede7d5e9f93d40f3883d52d2cb2bbbbe66

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:06 GMT
server: cloudflare
etag: W/"484af-5c708dd0f8180-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1MrhcPzVvb3%2BX211thJfUQMxBV2aB8xr%2FoCpkct1fjgSzr1VmGvSWUV%2Bd7nCmgU%2BAk52sXUCaJeKKrlqvBudI9DHmNtkJUije6e8AojBhLtNqVtLhZkZFBfHKaiIlx0HGnodUoDbDghRU%2FziUG20QqVHzEOHMl9My13kn1ZZYRw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababbf0187-CDG

GET
H3 200 angular.min.js Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/ 163 KB
59 KB 54ms
53ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/angular.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"28cdb-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyvziZh77tOIXX1UpiTx%2FTvgcu57a4cC%2Ffo2YReCvjQr79QGu9DsGZzgosRwLBUOB9R71aw83UlhVb6VYBd113zXgcsv5TMakhCB%2FixpChlCp59%2BNvNZRMP5vALsh7Ggi74Os6P5txiLoKqvnUcJIgRCPnF8fgHqTxgIyYovhqA%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababc10187-CDG

GET
H3 200 jquery.min.js Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/ 95 KB
35 KB 238ms
237ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/jquery.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"17b8b-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1WMbwfvqB2snjJ0%2BtiPkSsMah1OMPb5A3L%2BMxtZCAjoYxV%2B9PcsaPfOudonP%2Fd%2F%2FtPCTkndrHiMChnRFCfFsBKR8l5GSULZ5%2BOT7Lx3XFmqa6kVl3GdEcD6zGTiOgU3ZVGlIiBfmf1YsedzfhOO2IBSG2gUqYLCgavWeG1C1pQo%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababc20187-CDG

GET
H3 200 jquery.mask.js Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/ 18 KB
6 KB 34ms
33ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/jquery.mask.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"47fe-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LKf4zO6DNRn9akDftEYmycH6%2FYJm7apqZTuPbYdZ62OaWXw26EWzLzGfGJqBf1ZFu6j7d5XypELF2aTUnEwwnfQuZvbTvAZpIOg%2F3IhpSwBbDlrtkW9q2Vf%2F44pr5pz6PTzuG2U2n%2BWr4l98CN59wPiOFQYdcDPu8B6mm7%2FMKOs%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababc40187-CDG

GET
H3 200 jquery.validate.min.js Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/ 23 KB
8 KB 40ms
40ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/jquery.validate.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94d965af65067015be6bf62d7daeca80be9deddc851a6ed0c653318e62a7b4d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"5a02-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lu8%2FZM6KO0xLWkwUVhi1PiWDVxvsFUyaEdoEl5fAuKqrb%2Bae5mfHcdpVUiTNUK5JoDxEg1%2FUVd%2F3JvPUrK6e05s3h21WJ3tKNfAKscn5hp4LxKZObASAdCV1ch1xmLeZNo14tUqv9NtMCuj40rrkdXVLiKW0JDp0D9udF2XZ7cs%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababc50187-CDG

GET
H3 200 style.js Show response
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/ 2 KB
1 KB 36ms
35ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/js/style.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5267
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"8bf-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=olF1qWK0M%2FZ9zy4uW5knH%2ByjroC8wruz2TUYDlk50e0afW%2FNQoG1p1xjctwGmhPci7ehiQY1v46TRDcH2tcPt%2FqAiBn0zfEWHhXgfDjKe%2F%2F%2BoS%2FHLieIPqU2HaCp8eH59SdnxhWSLu2SCFbUywFSSiFtft2%2FBkPohakgmFg1f1Y%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 7c8a37ababc80187-CDG

GET
H3 200 imgs.svg
test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/ 4 KB
2 KB 27ms
27ms Image
image/svg+xml 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/imgs.svg

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 17 May 2023 07:41:20 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5265
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:06 GMT
server: cloudflare
etag: W/"106f-5c708dd0f8180"
x-frame-options: : sameorigin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sc8ApxGa1QgheEByiTZ5nc%2B%2Fdncru4h70Whu9k7Kvw8URl0Jpz76cw%2BWrzCWKLMV5c9xDoy2x5Tm1Lo4Xq3cipDI2EiD00PYKTliYChGTjZ2b%2F7ZlamdGNCWQ7iW56urkDS6Lzl99HiFZcf5Qci7y7wWNswegmK6w8UVlELJUW4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 7c8a37ad9d310187-CDG

GET
H/1.1 200
OK circular-black.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 72 KB
73 KB 77ms
22ms Font
font/woff2 151.101.193.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-black.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Wed, 17 May 2023 07:41:20 GMT
Age: 1884414
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 73892
X-Served-By: cache-chi-kigq8000086-CHI, cache-lcy-eglc8600036-LCY
Last-Modified: Mon, 21 Mar 2022 12:56:44 GMT
ETag: "56b510f616f840ffde8f3955349a6c5a"
x-goog-generation: 1647867404954983
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
x-goog-stored-content-length: 73892
Accept-Ranges: bytes
X-Cache-Hits: 93, 1

GET
H/1.1 200
OK circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 74 KB
74 KB 76ms
21ms Font
font/woff2 151.101.193.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-bold.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Wed, 17 May 2023 07:41:20 GMT
Age: 1881427
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 75488
X-Served-By: cache-chi-klot8100026-CHI, cache-lcy-eglc8600043-LCY
Last-Modified: Mon, 21 Mar 2022 12:56:44 GMT
ETag: "c094813cfe6be5d188f4e506b6ffca1b"
x-goog-generation: 1647867404953751
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
x-goog-stored-content-length: 75488
Accept-Ranges: bytes
X-Cache-Hits: 179, 1

GET
H/1.1 200
OK circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 68 KB
69 KB 100ms
23ms Font
font/woff2 151.101.193.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-book.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/provision/playbooks/playbooks/spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Wed, 17 May 2023 07:41:20 GMT
Age: 1272602
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 70092
X-Served-By: cache-chi-kigq8000052-CHI, cache-lcy-eglc8600020-LCY
Last-Modified: Mon, 21 Mar 2022 12:56:45 GMT
ETag: "c4f753e765823b94234e7f5ccd733f44"
x-goog-generation: 1647867405030797
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Report-To: {"group":"gfe-default_product_name","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/default_product_name"}]}
Cache-Control: max-age=86400
x-goog-stored-content-length: 70092
Accept-Ranges: bytes
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="gfe-default_product_name"
X-Cache-Hits: 18, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	Message: Failed to set referrer policy: The value 'referer' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'origin', 'origin-when-cross-origin', 'same-origin', 'strict-origin', 'strict-origin-when-cross-origin', or 'unsafe-url'. The referrer policy has been left unchanged.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

berlinestudio.com
sp-bootstrap.global.ssl.fastly.net
test.worldwidecleaningsupport.com
urlz.fr
107.180.0.232
151.101.193.194
2606:4700:3038::6815:ead6
2606:4700:3108::ac42:292e
1ebe60f82025e74000f53b43918c4235d0cb76dca40e65354e54a253d6b701c7
592ecdf44cc618653bda5ba4ad8f87ede7d5e9f93d40f3883d52d2cb2bbbbe66
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
94d965af65067015be6bf62d7daeca80be9deddc851a6ed0c653318e62a7b4d5
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2
f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

test.worldwidecleaningsupport.com Open in urlscan Pro 2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

378 kBTransfer

816 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

test.worldwidecleaningsupport.com Open in urlscan Pro
2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

378 kB
Transfer

816 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!