![](/screenshots/ab066068-7670-4721-b4a9-53df986b9088.png)
mgpal.com
Open in
urlscan Pro
199.79.62.225
Malicious Activity!
Public Scan
Effective URL: https://mgpal.com/public/valley/login.php?online_id=ca50e024d59c095e77c143a90login_id=195c9a7087bc1d893f20267e8fa8...
Submission: On March 06 via manual from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 25th 2023. Valid for: 3 months.
This is the only time mgpal.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Valley Strong Credit Union (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 34.102.88.176 34.102.88.176 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 27 | 199.79.62.225 199.79.62.225 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 104.18.21.53 104.18.21.53 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
26 | 2 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 176.88.102.34.bc.googleusercontent.com
vcu-secure.us |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: outbound.webhostbox.net
mgpal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
mgpal.com
2 redirects
mgpal.com |
218 KB |
1 |
valleystrong.com
mydatanet.valleystrong.com — Cisco Umbrella Rank: 456453 |
34 KB |
1 |
vcu-secure.us
1 redirects
vcu-secure.us |
252 B |
26 | 3 |
Domain | Requested by | |
---|---|---|
27 | mgpal.com |
2 redirects
mgpal.com
|
1 | mydatanet.valleystrong.com |
mgpal.com
|
1 | vcu-secure.us | 1 redirects |
26 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
mgpal.com R3 |
2023-01-25 - 2023-04-25 |
3 months | crt.sh |
mydatanet.valleystrong.com Entrust Certification Authority - L1M |
2022-07-01 - 2023-07-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://mgpal.com/public/valley/login.php?online_id=ca50e024d59c095e77c143a90login_id=195c9a7087bc1d893f20267e8fa85e2c195c9a7087bc1d893f20267e8fa85e2c&session=195c9a7087bc1d893f20267e8fa85e2c195c9a7087bc1d893f20267e8fa85e2c
Frame ID: FA13D21BC1845D81B717BC48047A938B
Requests: 26 HTTP requests in this frame
Screenshot
![](/screenshots/ab066068-7670-4721-b4a9-53df986b9088.png)
Page Title
Valley StrongPage URL History Show full URLs
-
https://vcu-secure.us/
HTTP 301
https://mgpal.com/public/valley HTTP 301
https://mgpal.com/public/valley/ HTTP 302
https://mgpal.com/public/valley/login.php?online_id=ca50e024d59c095e77c143a90login_id=195c9a70... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/ZURB Foundation.png)
Detected patterns
- <link[^>]+foundation[^>"]+css
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://vcu-secure.us/
HTTP 301
https://mgpal.com/public/valley HTTP 301
https://mgpal.com/public/valley/ HTTP 302
https://mgpal.com/public/valley/login.php?online_id=ca50e024d59c095e77c143a90login_id=195c9a7087bc1d893f20267e8fa85e2c195c9a7087bc1d893f20267e8fa85e2c&session=195c9a7087bc1d893f20267e8fa85e2c195c9a7087bc1d893f20267e8fa85e2c Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
mgpal.com/public/valley/ Redirect Chain
|
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
mgpal.com/public/valley/File/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-icons.css
mgpal.com/public/valley/File/ |
115 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yui-reset.min.css
mgpal.com/public/valley/File/ |
793 B 469 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.css
mgpal.com/public/valley/File/ |
31 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.daterangepicker.min.css
mgpal.com/public/valley/File/ |
3 KB 941 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ext-all.min.css
mgpal.com/public/valley/File/ |
123 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base.min.css
mgpal.com/public/valley/File/ |
197 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
grid.min.css
mgpal.com/public/valley/File/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sidebar.min.css
mgpal.com/public/valley/File/ |
3 KB 960 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris.shim.desktop.min.css
mgpal.com/public/valley/File/ |
673 B 403 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris.min.css
mgpal.com/public/valley/File/ |
95 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris-foundation.min.css
mgpal.com/public/valley/File/ |
50 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris-components.shim.desktop.min.css
mgpal.com/public/valley/File/ |
1 KB 621 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris-foundation.min(1).css
mgpal.com/public/valley/File/ |
50 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iris-components.min.css
mgpal.com/public/valley/File/ |
185 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
isotope.1.5.3.min.css
mgpal.com/public/valley/File/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Authentication-Isotope.min.css
mgpal.com/public/valley/File/ |
2 KB 694 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.desktop.min.css
mgpal.com/public/valley/File/ |
46 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fi.desktop.min.css
mgpal.com/public/valley/File/ |
50 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo
mydatanet.valleystrong.com/Image/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store-badge.svg
mgpal.com/public/valley/File/ |
11 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play-badge.svg
mgpal.com/public/valley/File/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
print.min.css
mgpal.com/public/valley/File/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Alkami.woff2
mgpal.com/public/valley/File/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Alkami.woff
mgpal.com/public/valley/File/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Valley Strong Credit Union (Financial)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mgpal.com/ | Name: PHPSESSID Value: 4f005e392f28ee48735d572a52587018 |
|
.valleystrong.com/ | Name: __cf_bm Value: u6c6_NRW_6a6PqyrgQyJLhmwJmEcOTzxE9wAL9lWSxw-1678131850-0-ATGzYMgzZ9+Al5BWxgkVly192tRjDFS1U5wrLWbWzS/NBYDSJlSwZZQ4+2zygcO8eCOlXUtWyjYso+J4f/n5fQk= |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mgpal.com
mydatanet.valleystrong.com
vcu-secure.us
104.18.21.53
199.79.62.225
34.102.88.176
037e5f8a4d2ef765d97f6c14e087cab4f8f27a1ac2a6a7584793b1a76a08fb8f
06cf32c38a14930eb6660873b0cafb2129f4892a37c1a44ebf22b0f9f702b159
19731e1ffa226edb598f9f66639c7796b18294d81e49d668fb6158f2e65ef3d8
2dcf765854f1fe869b1674016feb1638870c1066f156f8d7dfd47b53d0dc093f
3035510b5cd2f036acdbd394fd38f4fb8e2daea33adba3968f3b6beb380a28f3
4ce72ae45e1aafaa5cd4cc684c0000459c6d154c31450aad92bbd51a34107c93
590fcd2ea2a3de691c86ecf564fff1fcb0982271cf723ae4d6e2453c9e6f5434
59f12ecd0c381fee3367ffac176a581a966727684a5ce94390b4390b2fc06ca4
5bed9d2f4811025c2bde2c4747db5f3cacc9e4547ea594a0468b1e4f00965df9
67c4ae656447e66931cb26940ab685daa5961c2d89654361780f4018428333d6
6e13aa59eba2dc31affcf48c4e325d26210771329029da02ee4b70dfff2e85ef
6f749c31b9bd707340af24736c98a45ac6c5f4ceee3692c69ecf6f3523cb08a0
80d9f310d81e0da146a1d4be60b46f0f86eab4527578772fee9dd93997a3eaae
86c9954e1457d27db013c1f10a96ffaba845e5af7765c4ef9df4ac1549e47d67
8e9901c7a56cf78e86b90384c8a18329a0bc96c06f0ba87b239a0f4413b199eb
926a043116ef5ec60f62b05f8c13d415627991d8930a551410cf8d973a64ac6a
a277dd9a22a97f512f9024dbe82acb5468a168ec43bad3146b2cda9d93afd2fe
ab9c55dea4e2d8b7e988cb51b7f82d7dda04336a90e7b9400ac417198590077b
bcf82308a4a42f5785de42dda6584b42785e242cc336bd5d8e937b6e2d0d816e
c90d28f4249d0f86f75f3cc3fe43c647bf2e22bb56985fc7c76c39ea01991dd4
e4b9f0c0a5e74bbbde3c314a73fd18b1f5038cbda33e1e58e597dbee8f63d9e0
f6fca06e2aac270b488f73bcf0a10d249e2722a015135e60dbb49360c5335a72
f9cdc3eed2e549dc825b5354ebcad5f4e6ee57547604c0b54346390051be741c