![](/screenshots/ab2d053f-f383-4605-9a13-651b63f7e2c6.png)
medictesting.info
Open in
urlscan Pro
2606:4700:3031::ac43:c0e3
Malicious Activity!
Public Scan
Effective URL: https://medictesting.info/43-645W120324/?u=83C645&e=barbara%40bikeman.com.au&s3=&s4=NULL
Submission: On March 13 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on March 12th 2024. Valid for: 3 months.
This is the only time medictesting.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 2606:4700:303... 2606:4700:3034::6815:1a23 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 2606:4700:303... 2606:4700:3031::ac43:c0e3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700::68... 2606:4700::6812:13b7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:820::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:303... 2606:4700:3035::6815:1464 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81f::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4860:480... 2001:4860:4802:34::181 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c08::9c | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4860:480... 2001:4860:4802:38::15 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:20:... 2606:4700:20::ac43:46e9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
30 | 11 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
medictesting.info
medictesting.info |
339 KB |
5 |
wonderpush.com
cdn.by.wonderpush.com — Cisco Umbrella Rank: 44876 measurements-api.wonderpush.com — Cisco Umbrella Rank: 34332 |
95 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228 |
71 KB |
2 |
tasteiteasy.info
2 redirects
oppo-trk.tasteiteasy.info |
1 KB |
1 |
geojs.io
get.geojs.io — Cisco Umbrella Rank: 15712 |
857 B |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 84 |
255 B |
1 |
google.com
analytics.google.com — Cisco Umbrella Rank: 148 |
246 B |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
3 KB |
1 |
natureviewer.in
natureviewer.in |
461 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40 |
94 KB |
30 | 11 |
Domain | Requested by | |
---|---|---|
16 | medictesting.info |
medictesting.info
|
4 | cdn.by.wonderpush.com |
medictesting.info
cdn.by.wonderpush.com |
2 | cdnjs.cloudflare.com |
medictesting.info
cdnjs.cloudflare.com |
2 | oppo-trk.tasteiteasy.info | 2 redirects |
1 | get.geojs.io |
cdn.by.wonderpush.com
|
1 | measurements-api.wonderpush.com |
cdn.by.wonderpush.com
|
1 | stats.g.doubleclick.net |
www.googletagmanager.com
|
1 | analytics.google.com |
www.googletagmanager.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
medictesting.info
|
1 | natureviewer.in |
medictesting.info
|
1 | www.googletagmanager.com |
medictesting.info
|
30 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.muchostr4ffic.com |
www.peaktr4ffic.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
medictesting.info E1 |
2024-03-12 - 2024-06-10 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
wonderpush.com GTS CA 1P5 |
2024-01-30 - 2024-04-26 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
natureviewer.in E1 |
2024-02-15 - 2024-05-15 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
measurements-api.wonderpush.com GTS CA 1D4 |
2024-01-26 - 2024-04-25 |
3 months | crt.sh |
geojs.io E1 |
2024-03-11 - 2024-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://medictesting.info/43-645W120324/?u=83C645&e=barbara%40bikeman.com.au&s3=&s4=NULL
Frame ID: CC2CB366C0D8C52EE30798B589A99EE1
Requests: 30 HTTP requests in this frame
Screenshot
![](/screenshots/ab2d053f-f383-4605-9a13-651b63f7e2c6.png)
Page Title
Home PagePage URL History Show full URLs
-
http://oppo-trk.tasteiteasy.info/ga/click/2-243460240-20852-36832-72054-44096-3faa0dedbe-9372319528
HTTP 301
https://oppo-trk.tasteiteasy.info/ga/click/2-243460240-20852-36832-72054-44096-3faa0dedbe-9372319528 HTTP 302
https://medictesting.info/43-645W120324/?u=83C645&e=barbara%40bikeman.com.au&s3=&s4=NULL Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- googleapis\.com/.+webfont
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: I select this
Search URL Search Domain Scan URL
Title: I select this
Search URL Search Domain Scan URL
Title: I select this
Search URL Search Domain Scan URL
Title: I select this
Search URL Search Domain Scan URL
Title: I select this
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://oppo-trk.tasteiteasy.info/ga/click/2-243460240-20852-36832-72054-44096-3faa0dedbe-9372319528
HTTP 301
https://oppo-trk.tasteiteasy.info/ga/click/2-243460240-20852-36832-72054-44096-3faa0dedbe-9372319528 HTTP 302
https://medictesting.info/43-645W120324/?u=83C645&e=barbara%40bikeman.com.au&s3=&s4=NULL Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
medictesting.info/43-645W120324/ Redirect Chain
|
26 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
medictesting.info/43-645W120324/all/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custome.css
medictesting.info/43-645W120324/all/ |
38 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
medictesting.info/43-645W120324/all/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
medictesting.info/43-645W120324/all/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wonderpush-loader.min.js
cdn.by.wonderpush.com/sdk/1.1/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
282 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clicks
natureviewer.in/ |
0 461 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flag_au.png
medictesting.info/43-645W120324/all/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
white-logo.png
medictesting.info/43-645W120324/all/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
search44.png
medictesting.info/43-645W120324/all/ |
539 B 1016 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crt.png
medictesting.info/43-645W120324/all/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
last.png
medictesting.info/43-645W120324/all/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gft.png
medictesting.info/43-645W120324/all/ |
83 KB 83 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
15.png
medictesting.info/43-645W120324/all/ |
73 KB 73 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mac.png
medictesting.info/43-645W120324/all/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tv.jpg
medictesting.info/43-645W120324/all/ |
10 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sme.jpg
medictesting.info/43-645W120324/all/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ssl.png
medictesting.info/43-645W120324/all/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
57 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/fonts/ |
65 KB 66 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 246 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 255 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wonderpush.min.js
cdn.by.wonderpush.com/sdk/1.1.33.36/ |
375 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
41d403593c0b49d57f632b281192a2cc78b1d2de15f2c5576bbb2af96cbee7e0
cdn.by.wonderpush.com/config/webkeys/ |
2 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
geojs.js
cdn.by.wonderpush.com/plugins/geojs/1.0.2/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
measurements-api.wonderpush.com/v1/ |
94 B 272 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo.json
get.geojs.io/v1/ip/ |
347 B 857 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| WonderPush function| partstep function| toSimpleJson function| gtag object| dataLayer object| d number| minutes number| hours string| ampm object| months object| days object| o object| two object| three object| four object| five object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunkwonderpush_javascript_sdk2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.medictesting.info/ | Name: _ga Value: GA1.1.2048041162.1710368090 |
|
.medictesting.info/ | Name: _ga_MB2WV0SZV7 Value: GS1.1.1710368090.1.0.1710368090.60.0.0 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
cdn.by.wonderpush.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
get.geojs.io
measurements-api.wonderpush.com
medictesting.info
natureviewer.in
oppo-trk.tasteiteasy.info
stats.g.doubleclick.net
www.googletagmanager.com
2001:4860:4802:34::181
2001:4860:4802:38::15
2606:4700:20::ac43:46e9
2606:4700:3031::ac43:c0e3
2606:4700:3034::6815:1a23
2606:4700:3035::6815:1464
2606:4700::6811:190e
2606:4700::6812:13b7
2607:f8b0:4004:c08::9c
2607:f8b0:4006:80d::200a
2607:f8b0:4006:81f::2003
2607:f8b0:4006:820::2008
125511034694b109a469cdffe2b992665703721c309429ed8084dd213228bb8a
1684ea8cac825ad753d5912299e27dbf6159d3d53c0a5b99f0474e87e43969fa
1ba77247588da7b85eb0d23e70fb7dfc650c5ac7da3acc7d2b8ea7feffadfbc2
26fffc5cf012a0ef256094992edd6d096340713a58787384c2e5f9b0eb120f41
38d8676775f3ed6c7ab77160a89a732052a1b25c1d8cbba603b416bda8b6adf7
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
439f44a085a6aeeeb6d738e826984a4b73422a1262ce400abf0251086972add7
51a624ce2bdf358626f91702ca80fb28d74c8e375b7008938119053705854246
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
9381e88d9fe7d43d1d7875c1b020e5af989f386f10f58546f6b64652013ba75e
9d5ea5d107c0bbc9f66749edc316e53961b9c9fbb81e24dd8740097a09169b18
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
b877ef66eabd2dd21768d59e2ac26f9c4f48e0ed602e27cbd4d53c0701c7d515
bd6ebd25bfb153a89375d7d45060fe455cd607d84c5d3a3a89607bc21bc0207c
c8321264118e32a03bb4779705e55af8ae9d1a65b003e01d8defd9a3d365ea39
cc349aabbcca9085d0d3e50cbec662a79caa071e62a4ad256e389515e7b9f0bf
cea45207903c185af82a3330115a2f294427b7151b144e808d9ba6fc367efd5d
cee7f8ff0dd1083f8e01183326b39b5860a1663c8e5c9774885ac6bcee3d45a0
d4b6f1e89823eb3953d76d22b254f456ed58e053a34346c11ef013b1e6573fc4
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f03a4702d1272a7221490f7b746dd6ca4cc18b980e544e7f732d246a4a48ccb2
f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fa9030ecb014c0a29c2ec971fe36e044a80b6e74f5aeccf0839edb62a9578aea
fd2dda7485a9fef032f36694a1168141fbd485f1704eabca64e4a02d3ae14c9a
fdaf16413acc884fc5e16c8e13b535e63d91e74f4a88a90a84b838c034fb9a41
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995