www.mygym.co.za Open in urlscan Pro
197.234.132.100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mygym.co.za/admin/servizio/allert/login.html
Submission: On August 26 via automatic, source openphish (August 26th 2022, 1:02:10 am UTC) — Scanned from DE

Summary HTTP 14 Redirects Links 40 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 5 domains to perform 14 HTTP transactions. The main IP is 197.234.132.100, located in Johannesburg, South Africa and belongs to CipherWave, ZA. The main domain is www.mygym.co.za.
TLS certificate: Issued by R3 on July 4th 2022. Valid for: 3 months.

This is the only time www.mygym.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banca Mediolanum (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	197.234.132.100 197.234.132.100	37315 (CipherWave) (CipherWave)
1	2606:4700:20:... 2606:4700:20::ac43:4739	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	158.69.139.238 158.69.139.238	16276 (OVH) (OVH)
1	67.202.114.212 67.202.114.212	32748 (STEADFAST) (STEADFAST)
1	172.64.151.83 172.64.151.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	67.202.105.31 67.202.105.31	32748 (STEADFAST) (STEADFAST)
1	67.202.105.34 67.202.105.34	32748 (STEADFAST) (STEADFAST)
14	8

1 197.234.132.100 (Johannesburg, South Africa)

ASN37315 (CipherWave, ZA)
PTR: ns1.supertron.co.za

www.mygym.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:4739 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.69.139.238 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ip238.ip-158-69-139.net

t.dtscout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.114.212 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.151.83 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 67.202.105.31 (United States)

ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net

ic.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.34 (United States)

ASN32748 (STEADFAST, US)
PTR: ip34.67-202-105.static.steadfastdns.net

de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tynt.com cdn.tynt.com — Cisco Umbrella Rank: 9045 ic.tynt.com — Cisco Umbrella Rank: 4312 de.tynt.com — Cisco Umbrella Rank: 1475	9 KB
2	dtscout.com t.dtscout.com — Cisco Umbrella Rank: 15345	3 KB
1	amung.us whos.amung.us — Cisco Umbrella Rank: 15946	144 B
1	waust.at waust.at — Cisco Umbrella Rank: 43871	4 KB
1	mygym.co.za www.mygym.co.za	3 MB
14	5

	Domain	Requested by
7	ic.tynt.com
2	t.dtscout.com	waust.at t.dtscout.com
1	de.tynt.com	cdn.tynt.com
1	cdn.tynt.com	waust.at
1	whos.amung.us	waust.at
1	waust.at	www.mygym.co.za
1	www.mygym.co.za
14	7

This site contains links to these domains. Also see Links.

Domain
www.bancamediolanum.it
www.familybanker.it
www.fondazionemediolanum.it
www.mediolanumcorporateuniversity.it
www.mediolanumfiduciaria.it
www.mediolanuminvestmentbanking.it
www.bancomediolanum.es
www.banklenz.de
www.gamaxfunds.com
www.eurocqs.it
www.flowe.com
www.mediolanumprivatebanker.it
www.centodieci.it
www.mediolanumassicurazioni.it
www.mediolanumgestionefondi.it
www.mediolanuminternationalfunds.it
www.mediolanuminternationallife.it
www.mediolanumvita.it
www.bmedonline.it
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com

Subject Issuer	Validity	Valid
*.mygym.co.za R3	`2022-07-04` - `2022-10-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-07-04` - `2023-07-04`	a year	crt.sh
*.dtscout.com Sectigo RSA Domain Validation Secure Server CA	`2021-10-28` - `2022-11-27`	a year	crt.sh
*.amung.us Sectigo RSA Domain Validation Secure Server CA	`2022-05-18` - `2023-06-17`	a year	crt.sh
*.tynt.com Sectigo RSA Domain Validation Secure Server CA	`2021-09-23` - `2022-09-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.mygym.co.za/admin/servizio/allert/login.html
Frame ID: BB268D709FB1E0ECC4D8B240CE9EABBE
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banca Mediolanum S.p.A. | Accesso clienti

Page Statistics

14
Requests

100 %
HTTPS

14 %
IPv6

5
Domains

7
Subdomains

8
IPs

3
Countries

2751 kB
Transfer

4092 kB
Size

3
Cookies

40 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bancamediolanum.it/
Title: BANCA MEDIOLANUM

Search URL Search Domain Scan URL

URL: http://www.familybanker.it/
Title: FAMILY BANKER

Search URL Search Domain Scan URL

URL: http://www.fondazionemediolanum.it/
Title: FONDAZIONE MEDIOLANUM ONLUS

Search URL Search Domain Scan URL

URL: http://www.mediolanumcorporateuniversity.it/
Title: Mediolanum Corporate University

Search URL Search Domain Scan URL

URL: http://www.mediolanumfiduciaria.it/
Title: Mediolanum Fiduciaria

Search URL Search Domain Scan URL

URL: https://www.mediolanuminvestmentbanking.it/
Title: Mediolanum Investment Banking

Search URL Search Domain Scan URL

URL: https://www.bancomediolanum.es/
Title: Banco Mediolanum

Search URL Search Domain Scan URL

URL: https://www.banklenz.de/
Title: Bankhaus August Lenz

Search URL Search Domain Scan URL

URL: http://www.gamaxfunds.com/
Title: Gamax Management AG

Search URL Search Domain Scan URL

URL: http://www.eurocqs.it/
Title: EuroCQS S.p.A.

Search URL Search Domain Scan URL

URL: https://www.flowe.com/
Title: Flowe S.p.A. Società Benefit

Search URL Search Domain Scan URL

URL: http://www.mediolanumprivatebanker.it/
Title: Private Banking

Search URL Search Domain Scan URL

URL: http://www.centodieci.it/
Title: Centodieci

Search URL Search Domain Scan URL

URL: https://www.mediolanumassicurazioni.it/
Title: Mediolanum Assicurazioni

Search URL Search Domain Scan URL

URL: http://www.mediolanumgestionefondi.it/
Title: Mediolanum Gestione Fondi

Search URL Search Domain Scan URL

URL: http://www.mediolanuminternationalfunds.it/
Title: Mediolanum International Funds

Search URL Search Domain Scan URL

URL: https://www.mediolanuminternationallife.it/
Title: Mediolanum International Life

Search URL Search Domain Scan URL

URL: https://www.mediolanumvita.it/
Title: Mediolanum Vita

Search URL Search Domain Scan URL

URL: https://www.bmedonline.it/

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/investimenti-online/trading

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/nl/promozione-telepass

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/assicurazioni-on-line/selfycare/selfycare-travel

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/investimenti-online/fondi-comuni-di-investimento/evoluzione-dei-consumi

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/static-assets/documents/Vademecum_Furto_identita_2022_Ver1142022.pdf

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/sicurezza
Title: Scopri di più

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/corporate/commitments/emergenza-covid-19
Title: Scopri di più

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BancaMediolanum

Search URL Search Domain Scan URL

URL: https://twitter.com/BancaMediolanum

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/bancamediolanum

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/banca-mediolanum?trk=tyah

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/corporate-governance/dati-societari
Title: Dati societari

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/trasparenza
Title: Trasparenza

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/reclami-ricorsi-conciliazione
Title: Reclami, ricorsi e conciliazioni

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/promozioni-manifestazioni-a-premio
Title: Promozioni e manifestazioni a premio

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/corporate-governance/governance
Title: Governance

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/rapporti-dormienti
Title: Rapporti dormienti

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/aml-ctf
Title: AML & CTF

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/corporate/investors/informative
Title: Bilanci

Search URL Search Domain Scan URL

URL: https://www.bancamediolanum.it/contatti-sede-mediolanum
Title: Contattaci

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
14 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.html Show response www.mygym.co.za/admin/servizio/allert/	3 MB 3 MB	1300ms 190ms	Document text/html	197.234.132.100 CipherWave
General Check archive.org Download Go to Full URL https://www.mygym.co.za/admin/servizio/allert/login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 197.234.132.100 Johannesburg, South Africa, ASN37315 (CipherWave, ZA), Reverse DNS ns1.supertron.co.za Software Apache / Resource Hash `25a21c6e5c9c00c23d7c861d9ecc9ba0e2f60f325ec7d16c2603b7f08569f164` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 2696621 Content-Type text/html Date Fri, 26 Aug 2022 01:02:02 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 11 Aug 2022 13:31:42 GMT Server Apache
GET DATA	200 OK	truncated /	155 B 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `feaaf4e9e2f8cd65ece2416845dbd7513d07029557275eb440497f17a6edd520` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	14 KB 14 KB		Font font/otf
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9429cae40ac44408fc4596715dd0ddc23669b030216ec11cf8e883f314680780` Request headers Referer Origin https://www.mygym.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type font/otf
GET DATA	200 OK	truncated /	14 KB 14 KB		Font font/otf
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bf1ed18df313c77146e696fd64c00b3d530e7cd70212e4048b02497a95c58c5a` Request headers Referer Origin https://www.mygym.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type font/otf
GET DATA	200 OK	truncated /	33 KB 0		Image image/jpeg
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a3cebc4d7a4938330f7ae34c9ddb7318805a2c1f275bd460c6377be4b4efc2e` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d287be0e320369cd079d543be40255dd263750b71cf2b3d6d402fe8894262d5f` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	197 KB 0		Image image/jpeg
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f1f1f1ee2615340fcb4e5eb89fb7c105d88368765bd60f8c2b72a8d3a78c3b13` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	174 KB 0		Image image/jpeg
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a4880278a4d57c9a6733dfa1e7feb1466a338d71e529986d9e60378633c06a8f` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	194 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `463d70a888f45c93e40071479655c63f0917c52a214745708c92162e0ae8fe09` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	100 KB 0		Image image/jpeg
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bc1c71a15f4e28c5d8215f3ed3ea41d5d4c38c96fd3bdea7df70da4a4f21cabd` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	570 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a4410b646dbb8ed0bc8d7ff13af7fa56f07ea525aae9710ce187486469aed3aa` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	53 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31cfcd1ad88bf747abac2fda5f78587f0bfd4d59d6bb12f608c46f6ab84e5b76` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4521d2660af14ced6628837ff5ec772f2f7bc4467acfaee5d45529065bc322d4` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	74 KB 74 KB		Font font/woff2
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d3caf12591d194712facd10bca14f0a924edb59c24447a3fd994a48286db8843` Request headers Referer Origin https://www.mygym.co.za accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type font/woff2
GET H2	200	s.js Show response waust.at/	8 KB 4 KB	78ms 25ms	Script application/x-javascript	2606:4700:20::ac43:4739 CLOUDFLARENET
General Check archive.org Download Go to Full URL https://waust.at/s.js Requested by Host: www.mygym.co.za URL: https://www.mygym.co.za/admin/servizio/allert/login.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:4739 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:05 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 488 last-modified Mon, 08 Aug 2022 16:39:52 GMT server cloudflare etag W/"62f13c58-2142" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I5bSVuIvSSPZccyBcgG932Hglo2JhuzMZobXmqE3Lqt9vfsAhpATifxEx9NyuNJLE%2Bqwg0iSCso4%2FROmK48dckaCUaHVZEaxp4KFp9FhcBR60mMd6yzzZVZaAl%2FboK85tKB1yYrJ"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 7408a3d1b96e9bbe-FRA expires Sat, 27 Aug 2022 00:53:57 GMT
GET H/1.1	200 OK	/ Show response t.dtscout.com/i/	2 KB 3 KB	379ms 110ms	Script application/javascript	158.69.139.238 OVH
General Check archive.org Download Go to Full URL https://t.dtscout.com/i/?l=https%3A%2F%2Fwww.mygym.co.za%2Fadmin%2Fservizio%2Fallert%2Flogin.html&j= Requested by Host: waust.at URL: https://waust.at/s.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.238 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip238.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash `867e8c0f65910529d214a22ff58f5ad38158e1c104cc1706c94d5f4d3780944c` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 26 Aug 2022 01:02:05 GMT X-T 0.552 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache Connection close X-S mtl2 Expires Fri, 26 Aug 2022 01:02:04 GMT
GET H2	200	/ Show response whos.amung.us/pingjs/	28 B 144 B	377ms 123ms	Script text/javascript	67.202.114.212 STEADFAST
General Check archive.org Download Go to Full URL https://whos.amung.us/pingjs/?k=g6ktjj2a9n&t=Banca%20Mediolanum%20S.p.A.%20%7C%20Accesso%20clienti&c=s&x=https%3A%2F%2Fwww.mygym.co.za%2Fadmin%2Fservizio%2Fallert%2Flogin.html&y=&a=0&d=3.976&v=27&r=6329 Requested by Host: waust.at URL: https://waust.at/s.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.212 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash `86af299c6dc7248d522383a7234373dc215637f4cc8742ba983df05ad43597af` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:05 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET H2	200	tc.js Show response cdn.tynt.com/	17 KB 7 KB	390ms 26ms	Script application/javascript	172.64.151.83 CLOUDFLARENET
General Check archive.org Download Go to Full URL https://cdn.tynt.com/tc.js Requested by Host: waust.at URL: https://waust.at/s.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.64.151.83 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:05 GMT content-encoding gzip cf-cache-status HIT last-modified Thu, 21 Jul 2022 14:57:29 GMT server cloudflare age 209060 etag W/"62d96959-4599" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=259200 cf-ray 7408a3d69aad5bf9-FRA expires Mon, 29 Aug 2022 01:02:05 GMT
GET DATA	200 OK	truncated /	439 B 0		Image image/gif
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	/ Show response t.dtscout.com/pv/	51 B 319 B	320ms 105ms	Script application/javascript	158.69.139.238 OVH
General Check archive.org Download Go to Full URL https://t.dtscout.com/pv/?_a=v&_h=mygym.co.za&_ss=4m1vppxtib&_pv=1&_ls=0&_u1=1&_u3=1&_cc=de&_pl=d&_cbid=g7wl&_cb=_dtspv.c Requested by Host: t.dtscout.com URL: https://t.dtscout.com/i/?l=https%3A%2F%2Fwww.mygym.co.za%2Fadmin%2Fservizio%2Fallert%2Flogin.html&j= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 158.69.139.238 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip238.ip-158-69-139.net Software nginx/1.14.0 (Ubuntu) / Resource Hash `345e65953ac5554fa0979ff144b90ec2ea8f9177cce7d1044f39449a8a25c415` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 26 Aug 2022 01:02:05 GMT X-T 0.244 Server nginx/1.14.0 (Ubuntu) Transfer-Encoding chunked X-C 0 Content-Type application/javascript Cache-Control no-cache Connection close Expires Fri, 26 Aug 2022 01:02:04 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	925ms 122ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0&t=Banca%20Mediolanum%20S.p.A.%20%7C%20Accesso%20clienti Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:06 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	200	v2 Show response de.tynt.com/deb/	4 B 260 B	376ms 122ms	Script application/javascript	67.202.105.34 STEADFAST
General Check archive.org Download Go to Full URL https://de.tynt.com/deb/v2?id=w!g6ktjj2a9n&dn=TC&cc=1&r= Requested by Host: cdn.tynt.com URL: https://cdn.tynt.com/tc.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.34 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip34.67-202-105.static.steadfastdns.net Software / Resource Hash `d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:06 GMT cache-control max-age=86400 content-type application/javascript accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA" content-length 4 expires Sat, 27 Aug 2022 01:02:06 GMT
GET H2	204	p ic.tynt.com/b/	0 227 B	120ms 120ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0&t=Banca%20Mediolanum%20S.p.A.%20%7C%20Accesso%20clienti Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:06 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	120ms 120ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0&t=Banca%20Mediolanum%20S.p.A.%20%7C%20Accesso%20clienti Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:07 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	123ms 123ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:07 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	121ms 121ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:07 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	120ms 120ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:07 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
GET H2	204	p ic.tynt.com/b/	0 227 B	120ms 119ms	Image text/plain	67.202.105.31 STEADFAST
General Check archive.org Download Go to Show image Full URL https://ic.tynt.com/b/p?id=w!g6ktjj2a9n&lm=0&ts=1661475725933&dn=TC&iso=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 67.202.105.31 , United States, ASN32748 (STEADFAST, US), Reverse DNS ip31.67-202-105.static.steadfastdns.net Software nginx/1.16.1 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://www.mygym.co.za/admin/servizio/allert/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Fri, 26 Aug 2022 01:02:07 GMT cache-control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false" expires "Sat, 26 Jul 1997 05:00:00 GMT" server nginx/1.16.1 p3p CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banca Mediolanum (Financial)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dtscout.com/	1970-01-20 05:31:20	Name: m Value: 1
.dtscout.com/	1970-01-20 05:31:30	Name: oa Value: 1
.dtscout.com/	1970-01-20 07:55:15	Name: df Value: 1661475725

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tynt.com
de.tynt.com
ic.tynt.com
t.dtscout.com
waust.at
whos.amung.us
www.mygym.co.za
158.69.139.238
172.64.151.83
197.234.132.100
2606:4700:20::ac43:4739
67.202.105.31
67.202.105.34
67.202.114.212
25a21c6e5c9c00c23d7c861d9ecc9ba0e2f60f325ec7d16c2603b7f08569f164
31cfcd1ad88bf747abac2fda5f78587f0bfd4d59d6bb12f608c46f6ab84e5b76
345e65953ac5554fa0979ff144b90ec2ea8f9177cce7d1044f39449a8a25c415
3a3cebc4d7a4938330f7ae34c9ddb7318805a2c1f275bd460c6377be4b4efc2e
4521d2660af14ced6628837ff5ec772f2f7bc4467acfaee5d45529065bc322d4
463d70a888f45c93e40071479655c63f0917c52a214745708c92162e0ae8fe09
867e8c0f65910529d214a22ff58f5ad38158e1c104cc1706c94d5f4d3780944c
86af299c6dc7248d522383a7234373dc215637f4cc8742ba983df05ad43597af
937458495c30f567aeafe715f0164bfe061ab17aee4a34aabbf191f69a6d32ae
9429cae40ac44408fc4596715dd0ddc23669b030216ec11cf8e883f314680780
a4410b646dbb8ed0bc8d7ff13af7fa56f07ea525aae9710ce187486469aed3aa
a4880278a4d57c9a6733dfa1e7feb1466a338d71e529986d9e60378633c06a8f
bc1c71a15f4e28c5d8215f3ed3ea41d5d4c38c96fd3bdea7df70da4a4f21cabd
bf1ed18df313c77146e696fd64c00b3d530e7cd70212e4048b02497a95c58c5a
d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179
d287be0e320369cd079d543be40255dd263750b71cf2b3d6d402fe8894262d5f
d3caf12591d194712facd10bca14f0a924edb59c24447a3fd994a48286db8843
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eee6ef188662ab76c29c720cab899af19bad8153a9c86d548d90b3fa46886fc9
f1f1f1ee2615340fcb4e5eb89fb7c105d88368765bd60f8c2b72a8d3a78c3b13
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac
feaaf4e9e2f8cd65ece2416845dbd7513d07029557275eb440497f17a6edd520

www.mygym.co.za Open in urlscan Pro 197.234.132.100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

14 Requests

100 %HTTPS

14 %IPv6

5 Domains

7 Subdomains

8 IPs

3 Countries

2751 kBTransfer

4092 kBSize

3 Cookies

40 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

www.mygym.co.za Open in urlscan Pro
197.234.132.100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

14 %
IPv6

5
Domains

7
Subdomains

8
IPs

3
Countries

2751 kB
Transfer

4092 kB
Size

3
Cookies

14 HTTP transactions
14 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!