www.safercared.com
Open in
urlscan Pro
166.88.215.57
Malicious Activity!
Public Scan
Submission: On February 22 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on December 24th 2019. Valid for: 3 months.
This is the only time www.safercared.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Belgian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
13 | 166.88.215.57 166.88.215.57 | 18779 (EGIHOSTING) (EGIHOSTING) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 163.171.128.16 163.171.128.16 | 54994 (QUANTILNE...) (QUANTILNETWORKS) | |
2 | 2a00:1450:400... 2a00:1450:4001:809::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
safercared.com
www.safercared.com |
154 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
2 |
51.la
js.users.51.la ia.51.la Failed |
6 KB |
1 |
googleapis.com
fonts.googleapis.com |
747 B |
0 |
8131889.com
Failed
www.8131889.com Failed |
|
21 | 5 |
Domain | Requested by | |
---|---|---|
13 | www.safercared.com |
www.safercared.com
|
2 | fonts.gstatic.com |
www.safercared.com
|
2 | js.users.51.la |
www.safercared.com
|
1 | fonts.googleapis.com |
www.safercared.com
|
0 | www.8131889.com Failed |
www.safercared.com
|
0 | ia.51.la Failed |
www.safercared.com
|
21 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
cn.wordpress.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
safercared.com Let's Encrypt Authority X3 |
2019-12-24 - 2020-03-23 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
*.users.51.la GlobalSign Domain Validation CA - SHA256 - G2 |
2018-01-15 - 2021-03-19 |
3 years | crt.sh |
*.google.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.safercared.com/
Frame ID: A0447654A60974F2AA114364BCF930D7
Requests: 21 HTTP requests in this frame
Screenshot
Detected technologies
WordPress (CMS) ExpandDetected patterns
- html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
PHP (Programming Languages) Expand
Detected patterns
- html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
MySQL (Databases) Expand
Detected patterns
- html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
- script /\/wp-(?:content|includes)\//i
- meta generator /^WordPress ?([\d.]+)?/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
- script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i
jQuery Migrate (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: WordPress.org
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.safercared.com/ |
32 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.la.min.js
www.safercared.com/ |
254 B 434 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new.bc.min.js
www.safercared.com/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.bxslider.css
www.safercared.com/wp-content/themes/ample/js/jquery.bxslider/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 747 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
www.safercared.com/wp-content/themes/ample/font-awesome/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.safercared.com/wp-content/themes/ample/ |
44 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
www.safercared.com/wp-includes/js/jquery/ |
95 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate.min.js
www.safercared.com/wp-includes/js/jquery/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme-custom.js
www.safercared.com/wp-content/themes/ample/js/ |
671 B 852 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation.js
www.safercared.com/wp-content/themes/ample/js/ |
2 KB 953 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-embed.min.js
www.safercared.com/wp-includes/js/ |
1 KB 956 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
20544765.js
js.users.51.la/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
19403435.js
js.users.51.la/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
go1
ia.51.la/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
go1
ia.51.la/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
new.bc.min.js
www.8131889.com/plus_biz/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-emoji-release.min.js
www.safercared.com/wp-includes/js/ |
11 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
www.safercared.com/wp-content/themes/ample/font-awesome/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v20/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v20/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ia.51.la
- URL
- https://ia.51.la/go1?id=20544765&rt=1582389251852&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1582389251852&tt=&kw=&cu=https%253A%252F%252Fwww.safercared.com%252F&pu=
- Domain
- ia.51.la
- URL
- https://ia.51.la/go1?id=19403435&rt=1582389251860&rl=1600*1200&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=2&ekc=&sid=1582389251860&tt=&kw=&cu=https%253A%252F%252Fwww.safercared.com%252F&pu=
- Domain
- www.8131889.com
- URL
- https://www.8131889.com/plus_biz/js/new.bc.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Belgian Government (Government)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| _wpemojiSettings undefined| $ function| jQuery object| wp object| jQuery1124020017682754647081 object| twemoji0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
ia.51.la
js.users.51.la
www.8131889.com
www.safercared.com
ia.51.la
www.8131889.com
163.171.128.16
166.88.215.57
2a00:1450:4001:809::2003
2a00:1450:4001:825::200a
07ea839d5bad06282ea0a92cc31d9f74e0b7901f7fbef343a82b8a2c7663b594
08073a0973eec30d47ee234f5e04b123a8f2b2a533556cce1335257b44d1bb03
29f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3d8e94fed6cc8ea56ee5ec6174efb68cb7197d2e729149cb43e85505bf175779
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
5f2e43b0385f0a4cbbdfc5225b9d3abebcfa0390fffdf424064ef61783e0822e
6300ba1c19b24d427fdec05b16c8b7c85f21155097c82ffdced06192a5f70d31
783902860506962bd125aa28ade0e1e8d9b05126b6ffba220f38576ae71c9eb9
9db5e317cfe3041628a3dfbe29f509a6e6966a37e02277ff99e2beb1d0f9fc59
9eca1cdcdb79d7483e57e85d23954dac525f0aa62752c44c4c2eba13a02595b6
aff3480b288efdb80ce2558b60af6e11a881a34739aa97369b4d4bcac93fd43c
b27e9d4d89fbc45d48936c8722e9edf6a47b3b67e3095fe377b90d490cf1f7d7
c4047043368afb4baf1aed25d358a5c2a333842a3b436b58491ab36aeee65b9d
c89217203f3e4290bc395949498a82b8cb148c1fe1581dfe154ddb19a3af3963
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e