![](/screenshots/8a906aed-f516-4f24-b963-c99627658eff.png)
avaxnod.wpengine.com
Open in
urlscan Pro
104.154.250.30
Malicious Activity!
Public Scan
Submission: On August 03 via manual from SA — Scanned from DE
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on August 3rd 2021. Valid for: a year.
This is the only time avaxnod.wpengine.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aramex (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 104.154.250.30 104.154.250.30 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
3 | 94.185.237.70 94.185.237.70 | 8190 (MDNX) (MDNX) | |
2 | 2a02:26f0:dc:... 2a02:26f0:dc::217:61eb | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2008 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:400e:800::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a02:26f0:dc:... 2a02:26f0:dc:18d::f09 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
22 | 9 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 30.250.154.104.bc.googleusercontent.com
avaxnod.wpengine.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
wpengine.com
avaxnod.wpengine.com |
25 KB |
3 |
gstatic.com
fonts.gstatic.com |
146 KB |
3 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67 |
2 KB |
3 |
cookiebot.com
consent.cookiebot.com — Cisco Umbrella Rank: 4454 consentcdn.cookiebot.com — Cisco Umbrella Rank: 5153 |
24 KB |
3 |
aramex.com
www.aramex.com — Cisco Umbrella Rank: 98471 |
144 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 94 |
76 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 615 |
83 KB |
22 | 7 |
Domain | Requested by | |
---|---|---|
8 | avaxnod.wpengine.com |
avaxnod.wpengine.com
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | fonts.googleapis.com |
www.aramex.com
client |
3 | www.aramex.com |
avaxnod.wpengine.com
|
2 | consent.cookiebot.com |
avaxnod.wpengine.com
consent.cookiebot.com |
1 | consentcdn.cookiebot.com |
consent.cookiebot.com
|
1 | www.googletagmanager.com |
avaxnod.wpengine.com
|
1 | code.jquery.com |
avaxnod.wpengine.com
|
22 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.facebook.com |
twitter.com |
www.instagram.com |
www.linkedin.com |
www.youtube.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wpengine.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-08-03 - 2022-09-03 |
a year | crt.sh |
*.aramex.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-02-02 - 2023-02-25 |
a year | crt.sh |
consent.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-04 - 2023-06-06 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-07-11 - 2022-10-03 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-07-18 - 2022-10-10 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-07-11 - 2022-10-03 |
3 months | crt.sh |
*.cookiebot.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-15 - 2023-06-17 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://avaxnod.wpengine.com/wp-admin/govo/armarb/aram/index.php?ara
Frame ID: BE2AEE69997BF1464777F2C591FC9539
Requests: 22 HTTP requests in this frame
Frame:
https://consentcdn.cookiebot.com/sdk/bc-v4.min.html
Frame ID: 362E3C48A617979B8C1F40744B34A5EE
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/8a906aed-f516-4f24-b963-c99627658eff.png)
Page Title
ادفع بأمانDetected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- \bangular.{0,32}\.js
Detected patterns
- consent\.cookiebot\.com
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- googletagmanager\.com/gtm\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
avaxnod.wpengine.com/wp-admin/govo/armarb/aram/ |
63 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebResource.axd
www.aramex.com/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uc.js
consent.cookiebot.com/ |
100 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
project-arabic.css
www.aramex.com/Sitefinity/WebsiteTemplates/aramex-ar/App_Themes/aramex-ar/global/ |
624 KB 138 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors.js
avaxnod.wpengine.com/Sitefinity/WebsiteTemplates/Global_them/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.js
code.jquery.com/ |
282 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aramex-logo-arabic10ab5588b3f2659d9310ff0000e7fe0c.svg
www.aramex.com/docs/default-source/site-assets/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular.min.js
avaxnod.wpengine.com/Assets/Scripts/amxApp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
angular-locale_ar.js
avaxnod.wpengine.com/Assets/Scripts/amxApp/i18n/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amxApp.min.js
avaxnod.wpengine.com/Assets/Scripts/amxApp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
credit.png
avaxnod.wpengine.com/wp-admin/govo/armarb/aram/assets/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-v2.js
avaxnod.wpengine.com/Sitefinity/WebsiteTemplates/Global_them/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
avaxnod.wpengine.com/Sitefinity/WebsiteTemplates/Global_them/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
225 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cc.js
consent.cookiebot.com/fcb5d3ae-6d51-48f7-8c16-49ce8103dc8a/ |
376 B 578 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
droidarabickufi.css
fonts.googleapis.com/earlyaccess/ |
1 KB 382 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notokufiarabic.css
fonts.googleapis.com/earlyaccess/ |
4 KB 907 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DroidKufi-Regular.woff2
fonts.gstatic.com/ea/droidarabickufi/v6/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
37 KB 37 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bc-v4.min.html
consentcdn.cookiebot.com/sdk/ Frame 362E |
627 B 692 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 725 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
CSRk4ydQnPyaDxEXLFF6LZVLKrodrOYFFg.woff2
fonts.gstatic.com/s/notokufiarabic/v15/ |
84 KB 84 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
DroidKufi-Bold.woff2
fonts.gstatic.com/ea/droidarabickufi/v6/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aramex (Transportation)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| promotionsOnScroll object| dataLayer object| CookieControl function| __uspapi function| addUspapiLocatorFrame function| __handleUspapiMessage function| propagateIABStub object| Cookiebot object| CookieConsent string| sf_appPath function| $ function| jQuery function| addLoadEvent object| google_tag_manager string| cookiedomainwarning1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
avaxnod.wpengine.com/ | Name: PHPSESSID Value: 64954ce8e74ee1442f201a1228d2b406 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
avaxnod.wpengine.com
code.jquery.com
consent.cookiebot.com
consentcdn.cookiebot.com
fonts.googleapis.com
fonts.gstatic.com
www.aramex.com
www.googletagmanager.com
104.154.250.30
2001:4de0:ac18::1:a:1a
2a00:1450:4001:808::2003
2a00:1450:4001:812::2008
2a00:1450:400e:800::200a
2a02:26f0:dc:18d::f09
2a02:26f0:dc::217:61eb
94.185.237.70
06eb9b648fd1429d0cef25265009259c35f053a76118194b4073c98e161812be
1575168b50153c19e20c2d17db173e4835994679fa5d9826ba3d4f3610041f83
1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
224bf154aa18d46c41a978b3dc5332013bf84adeb5309b81737fd9ddced146f8
31f02fb9a8ae77e5d8bb229bf73f473f783e8155042655926cafca211cd11c98
588e80629a22056a9ba06e731ca79b3983f887545161e4d1cb7d31bde4acf023
6804249c39aae7d80cd20c9d78213ce15c35d47b5c21821641c6182c16eed1b5
738e5435f2d18427d291a0d6289eee0ebbc87b596d6003919f255760ac293104
739f9163d22610c132fd50176539bc522fa31c9c638e824c62a3ee56f1f80df0
813c2766f40d0f09656144d36dcc80ab040cf82488f887746c74f0d78039ddd9
859e8bea77079d6165454b04dee5553dc06e9684dacf2ee780e6ed4caff80396
a7b09bb9c8e8e2fb189204e08ed94bd8096c118780b5e926847cf2748ca7c5c2
bc6ec54ccbab081796e97bb787f2d7010f19cc2a467bf2863eda7a75ae68410a
d382d74b13356e9a0e9c5ac3354867fd37d4b0d690ff16f83503673bd199fa0f
e663aa20eafb44d2a49a3e0bfa4446a0df60191c09bf445e98f381bd2d114495
ea591f0d4d85b2fc80db86a816a83f9d206faa51d4bad44025bff11057dff992
f65ec6393c1b98436ab3f01c1afa76d6e3860a3555da07acb07fb3e862b0ed95