![](/screenshots/a122bb43-eeb1-4123-993b-04da2093ac95.png)
tc.irehw.com
Open in
urlscan Pro
172.67.196.112
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On July 02 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by WE1 on July 1st 2024. Valid for: 3 months.
This is the only time tc.irehw.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank Mellat (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 21 | 172.67.196.112 172.67.196.112 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 176.56.157.159 176.56.157.159 | 43415 (SITSCO-AS) (SITSCO-AS) | |
22 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
irehw.com
1 redirects
tc.irehw.com |
179 KB |
2 |
shaparak.ir
bpm.shaparak.ir — Cisco Umbrella Rank: 371915 |
8 KB |
22 | 2 |
Domain | Requested by | |
---|---|---|
21 | tc.irehw.com |
1 redirects
tc.irehw.com
|
2 | bpm.shaparak.ir |
tc.irehw.com
|
22 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.behpardakht.com |
www.rayanertebat.ir |
Subject Issuer | Validity | Valid | |
---|---|---|---|
irehw.com WE1 |
2024-07-01 - 2024-09-29 |
3 months | crt.sh |
bpm.shaparak.ir Certum Extended Validation CA SHA2 |
2024-04-17 - 2025-04-17 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://tc.irehw.com/Mellat/?meli=09212007904
Frame ID: CB595FB827E49C4427372722E7256A0A
Requests: 20 HTTP requests in this frame
Frame:
https://tc.irehw.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d2a97f6b6ec9/main.js
Frame ID: 877F327EB965A51BE0F36B2D3240DC7B
Requests: 2 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: www.Behpardakht.com
Search URL Search Domain Scan URL
Title: https://tc.irehw.com
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://tc.irehw.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://tc.irehw.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d2a97f6b6ec9/main.js
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
tc.irehw.com/Mellat/ |
26 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
esprit_fa.min.css
tc.irehw.com/Mellat/css/ |
173 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
tc.irehw.com/Mellat/js/ |
137 KB 37 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messages_fa.min.js
tc.irehw.com/Mellat/msg/ |
6 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
payment.min.js
tc.irehw.com/Mellat/js/ |
29 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shaparak_logo.svg
tc.irehw.com/Mellat/img/ |
30 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
behpardakht_logo.svg
tc.irehw.com/Mellat/img/ |
19 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
captchaimg.jpg
bpm.shaparak.ir/pgwchannel/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ipg-defaltlogo.png
bpm.shaparak.ir/pgwchannel/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mellat_arc.svg
tc.irehw.com/Mellat/img/ |
349 B 573 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipg-card_list.svg
tc.irehw.com/Mellat/img/ |
2 KB 1013 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipg-keypad.svg
tc.irehw.com/Mellat/img/ |
1 KB 858 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipg-capcha-refresh.svg
tc.irehw.com/Mellat/img/ |
739 B 752 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipg_sms.svg
tc.irehw.com/Mellat/img/ |
2 KB 1017 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mellat_arc_footer.svg
tc.irehw.com/Mellat/img/ |
592 B 674 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IRANSansWeb_Medium.woff2
tc.irehw.com/Mellat/css/fonts/woff2/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IRANSansWeb.woff2
tc.irehw.com/Mellat/css/fonts/woff2/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
tc.irehw.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d2a97f6b6ec9/ Frame 877F Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IRANSansWeb_Medium.woff
tc.irehw.com/Mellat/css/fonts/woff/ |
35 KB 36 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
89cc48366d449d9b
tc.irehw.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 877F |
0 558 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IRANSansWeb.woff
tc.irehw.com/Mellat/css/fonts/woff/ |
38 KB 38 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipg-favicon.ico
tc.irehw.com/Mellat/img/ |
1 KB 946 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank Mellat (Financial)113 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 undefined| event object| fence object| sharedStorage function| $ function| jQuery object| i18n object| $jscomp number| globalRemainingSeconds undefined| terminalDiscountStatus number| otpRequestWaitMillis boolean| ctrlDown number| ctrlKey number| cmdKey object| panDtoList string| encRefId undefined| focusedField undefined| shuffledArray boolean| disableCountDown boolean| paymentSuccessfullyDone boolean| successResultSubmitted number| cursorPosition number| selectedPanIndex number| previousSelectedPanIndex undefined| previousPan undefined| keyPadInputId undefined| previousOTPRequestMillis undefined| otpRemainingSeconds object| availableBankLogos function| validatePaymentInputs function| removeInvalidClassFromPan function| addInvalidClassToPan function| validatePan function| doPayment function| go function| processSaleResponse function| refreshCaptcha function| showMessage function| hideMessage function| handleUnknownError function| validateAndDoPayment function| removeInvalidClassFromInput function| validateInput function| addInvalidClassToInput function| validateDate function| focusNextField function| focusField function| hideKeypadOnTab function| checkPattern function| setPanCursorPosition function| formatPanOnKeyDown function| shouldIgnore function| formatPanOnKeyUp function| getFormattedPan function| concatNumericChars function| extractNumbers function| preventInvalidKeys function| isNumericKeyDownOrUp function| getEventKeyCode function| cancelPay function| countDownRemainingTime function| stopCountDown function| fillField function| keypadTab function| keyPadBackspace function| setFocusedField function| shuffleKeypad function| showKeypadJustInMobile function| showKeypad function| hideKeypad function| hideOthersKeypad function| shuffle function| waitAndSendSuccessResult function| sendSuccessResult function| enableReturnButton function| hideKeypadOnOutsideClick function| hideCardSuggestionListOnOutSideClick function| showSubmitSpinner function| hideSubmitSpinner function| showBankLogoSpinner function| hideBankLogoSpinner function| checkPanDiscount function| handlePanChange function| prepare4DiscountServiceCall function| processDiscountResponse function| openDiscountDialog function| setPan function| hideDiscountDialog function| showDiscountDialog function| showDynamicPinDialog function| removeDynamicPinDialog function| setAmount function| setCardSuggestionListHeight function| filterAndShowCardSuggestionList function| toggleAllPans function| showCardSuggestionList function| setBankLogo function| hideCardSuggestionList function| selectPan function| maskExpireDate function| unmaskExpireDate function| isBankLogoAvailable function| resetSelectedPan function| getBankLogoSrc function| isNewPan function| validateAndRequestOTP function| requestOTP function| processOtpResponse function| disableOtpButton function| enableOtpButton function| disableCaptcha function| enableCaptcha function| countDownDynamicPinRemainingTime2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tc.irehw.com/ | Name: PHPSESSID Value: tli6920ulbd5658n4urolmjlrs |
|
.irehw.com/ | Name: cf_clearance Value: Ho2c6EO1z7zqE0rIovqmnc_iehEis7fdTuuSgCC.Frs-1719898633-1.0.1.1-ZOQpwBSt5mNufLq2DKOjhlKLNyB08dprtsCwU1kNV5DQEhgZJCBxFJEH4o3jXtRWWMXYSnTKYVnuO8tMADLdoA |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bpm.shaparak.ir
tc.irehw.com
172.67.196.112
176.56.157.159
011310002d771ac6a136964ee17f8c265a06bc385ab51dd1a21ec4b5a3d8ab5b
0abfb81853fa05bfe2425636cfdbca82e4daef820f4b5032d18be8667789e798
28b58f82be3ca0e853f9a550c764480999dfcaea122f3aa7fc0a38f8f8ded3c6
44ebdf42ece6b1725f03139581a7200db5255bf40a3b5c5476d056e4646f1722
4a45e958f70902b38c5ab14bb0d2fd1f39a12f6372c7533d2ee8a02275395cec
4bfacde9a2df92ee05e1527e53319874fcc31f24aa0d405ffba1b8030aa156e0
5e0e1726c314681e1fee564da05c92e5a9820db86ff56e939032f7e6c421a2f7
60cf90af74ac8f61d0ba36230658972e0453b7c8882eaed4a4f27b4fb15670e7
60cfa122fc2ef0d3a16def27419770746cbdec414998fd2b42e04cb2d28f2fb4
67e70e1d5d489482630b186aee63e56361bdc93ac01e8e3a09fcabce5782f7ef
73179cb89e7abf3013d8485fbaa3c33ec38cc65541f64517fe37b5fc90751f59
9018039852e512a33e993072db4d105329b3b619c94786766c9575b12cb9f51b
9019fb40193423b787b752dfc130ce05ad4c5863f1002302a315ec57a0f36cc9
989499a9ddba2a305b3990adfdafd39e448704fdf02f689ae485d1d94e920e38
a8f29f97bdd79c13a83136b0d0ae6f7daeaefbf5e36e88c9cb473092d6b7485d
b70b70d1b4499398e5f9653d8433bfe92cd205d9e60a5a1e8706ed04b7d6f7a1
d1e7151a7b6e0e0a0be950a03eebdd6307bdeb5696735e828421046b1010ba56
de30e025cc6461466c97e21f81d645850513c62f805fcddf5b4835dd20f93bc7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed21ff5533c5f042a81196487f5cbef4a0b2f6560ac22278e586c8ae86d944b0