thisistheways.com
Open in
urlscan Pro
46.17.100.94
Malicious Activity!
Public Scan
Effective URL: https://thisistheways.com/deliveryclick/iphone/se/?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdSW25Ah5_Bvg9P9hddtoe_...
Submission: On July 06 via manual from FR
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 23rd 2020. Valid for: a year.
This is the only time thisistheways.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Tracking (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2a00:1450:400... 2a00:1450:4001:824::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 3.120.230.228 3.120.230.228 | 16509 (AMAZON-02) (AMAZON-02) | |
1 13 | 46.17.100.94 46.17.100.94 | 57043 (HOSTKEY-AS) (HOSTKEY-AS) | |
1 | 2606:4700::68... 2606:4700::6812:e134 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3033::681b:b27f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3035::ac43:d621 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
thisistheways.com
1 redirects
thisistheways.com |
393 KB |
3 |
gstatic.com
www.gstatic.com |
68 KB |
2 |
page.link
1 redirects
mouseclick.page.link |
11 KB |
1 |
mdsyzz.info
api.mdsyzz.info |
647 B |
1 |
mdsyzz.com
api.mdsyzz.com |
1 KB |
1 |
onesignal.com
cdn.onesignal.com |
3 KB |
1 |
rollingclicks.com
1 redirects
rollingclicks.com |
1 KB |
19 | 7 |
Domain | Requested by | |
---|---|---|
13 | thisistheways.com |
1 redirects
www.gstatic.com
thisistheways.com |
3 | www.gstatic.com |
mouseclick.page.link
www.gstatic.com |
2 | mouseclick.page.link | 1 redirects |
1 | api.mdsyzz.info |
api.mdsyzz.com
|
1 | api.mdsyzz.com |
thisistheways.com
|
1 | cdn.onesignal.com |
thisistheways.com
|
1 | rollingclicks.com | 1 redirects |
19 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
rollingclicks.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.page.link GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
thisistheways.com Sectigo RSA Domain Validation Secure Server CA |
2020-06-23 - 2021-06-23 |
a year | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-06 - 2020-10-09 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://thisistheways.com/deliveryclick/iphone/se/?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdSW25Ah5_Bvg9P9hddtoe_fI3WEXp1UvjmqyuwePnnaz9TT3nmhSq3fl1Yp5INQoAP7V4foSGApPicwrlr0jJxrIShuK25LTPNYd1F_3P5Qf61sLjWTX-AAch6MTV7v1DIMTrnRAwvEJ23sT7pcycxNxRNf1Psn8Ntr_SFP7WZ76z9txvZJD5zZcuQKkFgjWY6yWzzPh2HgZH8iDZbar9MwjMm2yoo3OMFa3X2h3LRY50V8X6T1hi8yp-IMivoeHBtyBF6HkfnGWggY3x7qOSYAzdQoj2FgLKncoKEjmonevtiSTdA5Z3_Gnj9EZ86f4D1bPKtwAH0YGgztnCyo&lptoken=15dd9317997b927582a9
Frame ID: 75F7C0FBFC15C133E4346C6608235611
Requests: 19 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://mouseclick.page.link/vpoA Page URL
-
https://mouseclick.page.link/vpoA?_imcp=1
HTTP 302
https://rollingclicks.com/17da83e7-2a19-4b2f-b276-093ae5c10663 HTTP 302
https://thisistheways.com/deliveryclick/iphone/se?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdSW... HTTP 301
https://thisistheways.com/deliveryclick/iphone/se/?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdS... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Personlig
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://mouseclick.page.link/vpoA Page URL
-
https://mouseclick.page.link/vpoA?_imcp=1
HTTP 302
https://rollingclicks.com/17da83e7-2a19-4b2f-b276-093ae5c10663 HTTP 302
https://thisistheways.com/deliveryclick/iphone/se?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdSW25Ah5_Bvg9P9hddtoe_fI3WEXp1UvjmqyuwePnnaz9TT3nmhSq3fl1Yp5INQoAP7V4foSGApPicwrlr0jJxrIShuK25LTPNYd1F_3P5Qf61sLjWTX-AAch6MTV7v1DIMTrnRAwvEJ23sT7pcycxNxRNf1Psn8Ntr_SFP7WZ76z9txvZJD5zZcuQKkFgjWY6yWzzPh2HgZH8iDZbar9MwjMm2yoo3OMFa3X2h3LRY50V8X6T1hi8yp-IMivoeHBtyBF6HkfnGWggY3x7qOSYAzdQoj2FgLKncoKEjmonevtiSTdA5Z3_Gnj9EZ86f4D1bPKtwAH0YGgztnCyo&lptoken=15dd9317997b927582a9 HTTP 301
https://thisistheways.com/deliveryclick/iphone/se/?cep=xuma2voLKoXFR2ORl93e3_1LFAztVGWRhKsWe8cppIiVEdSW25Ah5_Bvg9P9hddtoe_fI3WEXp1UvjmqyuwePnnaz9TT3nmhSq3fl1Yp5INQoAP7V4foSGApPicwrlr0jJxrIShuK25LTPNYd1F_3P5Qf61sLjWTX-AAch6MTV7v1DIMTrnRAwvEJ23sT7pcycxNxRNf1Psn8Ntr_SFP7WZ76z9txvZJD5zZcuQKkFgjWY6yWzzPh2HgZH8iDZbar9MwjMm2yoo3OMFa3X2h3LRY50V8X6T1hi8yp-IMivoeHBtyBF6HkfnGWggY3x7qOSYAzdQoj2FgLKncoKEjmonevtiSTdA5Z3_Gnj9EZ86f4D1bPKtwAH0YGgztnCyo&lptoken=15dd9317997b927582a9 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
vpoA
mouseclick.page.link/ |
35 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.XfD7jNY5-Q4.es5.O/am=BAI/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4lbH4SWvh9wv558HHMlY0FAXqu8Q/ |
141 KB 50 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=wmwg8b
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.XfD7jNY5-Q4.es5.O/ck=boq-devplatform.DurableDeepLinkUi.oCzOh53U-AQ.L.B1.O/am=BAI/d=1/exm=_b,_tp/excm=_b,_tp,view... |
34 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=KjEEgd
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.XfD7jNY5-Q4.es5.O/ck=boq-devplatform.DurableDeepLinkUi.oCzOh53U-AQ.L.B1.O/am=BAI/d=1/exm=_b,_tp,wmwg8b/excm=_b,_... |
17 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
thisistheways.com/deliveryclick/iphone/se/ Redirect Chain
|
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
auto-push.min.js
api.mdsyzz.com/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
thisistheways.com/deliveryclick/iphone/se/js/ |
86 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.content.css
thisistheways.com/deliveryclick/iphone/se/styles/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lander.css
thisistheways.com/deliveryclick/iphone/se/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
init.js
thisistheways.com/deliveryclick/iphone/se/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-box.png
thisistheways.com/deliveryclick/iphone/se/images/ |
877 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
check-circle-regular.png
thisistheways.com/deliveryclick/iphone/se/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iphone11.png
thisistheways.com/deliveryclick/iphone/se/images/ |
102 KB 102 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lang.js
thisistheways.com/deliveryclick/iphone/se/js/ |
51 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f21b755c-d63b-44dc-ae0d-d1657ae61fda
api.mdsyzz.info/rest/v1/p-apps/get-id/ |
129 B 647 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
thisistheways.com/deliveryclick/iphone/se/ |
11 KB 11 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActoCTT-Medium.woff
thisistheways.com/deliveryclick/iphone/se/fonts/ |
53 KB 54 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActoCTT-Book.woff
thisistheways.com/deliveryclick/iphone/se/fonts/ |
54 KB 54 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Tracking (Transportation)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| OneSignal function| InitializePush function| CheckImageAndReplace function| httpGetAsync function| getUrlVars function| getUrlParam function| $ function| jQuery object| elem0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | script-src 'report-sample' 'nonce-5gVkZKvlj7q7UBflP4Q1TA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self' script-src 'nonce-5gVkZKvlj7q7UBflP4Q1TA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.mdsyzz.com
api.mdsyzz.info
cdn.onesignal.com
mouseclick.page.link
rollingclicks.com
thisistheways.com
www.gstatic.com
2606:4700:3033::681b:b27f
2606:4700:3035::ac43:d621
2606:4700::6812:e134
2a00:1450:4001:81f::2003
2a00:1450:4001:824::200e
3.120.230.228
46.17.100.94
0726accab4d4a2b930293a532b2bf73150dab898889f7931b3c87395b12e1015
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
093dc0f94ec5a7cff0cd05d9e7c3eff816635944ea10efd189b3ef3e2439470e
14c8b16f37ff1381a9ae80e134b325cfdb609880c0597ea5cb46ebaa504571d1
2c4db7a1a8381593dd83c551398eab57ab255dfb5e825582e935f5665fcd3d18
32168500940af44fb2fe83d34a58b436f0d2055ccbe15b3c3681bdc9a1274e5b
5d7dfbd5b9319dcc3609bf74a999472125689f04b5df335bf708774ab4140b02
5eb3984059948e4229244da3b3cf1a964783cea6871e28a44cc17497895f1de8
698a4bede53a13d629a4561497579f0f71d2fce01a69a86b9cebbea6646af2d0
6f33ce26a4bdaece7c1c98289ad21dbe60b540046f588711d3d8f3d89eff5401
7f250f42a336b02e0cde727854257fbd172822d2d2259fa320d1a0eebff1d654
93c29da16e3bc81c272bd7aa9725b79c74d8caf34e28b8eba8604448056931bf
998c9a97ed0b4c48d0844c185074574b24b791462b96acfe32f2eee97250aa8c
b752d3f98d8c8208370b38aabce4a7fffe3b7a4841dc85af7331b9839a591792
cf49712ce84219f3c864c563c8d23bcaa603d6179f70cffbe788c7c7f6373a60
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaf7218d31a712840144e4e0c0f2a3a0382b8927408f5aa1e10921608d8bbd9a
faa3d9245b07953889489e550a32162d43be1fc8c714b76b87e777387a813663
fca6b549677b2fee26c77aa79f35fa2c16e3cb10d75256d93a8ed44bbe5ea0c0