![](/screenshots/b3272077-8561-4382-b370-960766b94ef0.png)
careerguardians.info
Open in
urlscan Pro
2606:4700:3032::ac43:d8f7
Malicious Activity!
Public Scan
Effective URL: https://careerguardians.info/44-640T110324/?u=112C640
Submission: On March 12 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on March 7th 2024. Valid for: 3 months.
This is the only time careerguardians.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Royal Mail (Government)Domain & IP information
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
careerguardians.info
1 redirects
careerguardians.info |
140 KB |
5 |
wonderpush.com
cdn.by.wonderpush.com — Cisco Umbrella Rank: 44876 measurements-api.wonderpush.com — Cisco Umbrella Rank: 34332 |
95 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
3 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2945 |
83 KB |
2 |
gz7q.info
2 redirects
appis-trk.gz7q.info |
1 KB |
1 |
geojs.io
get.geojs.io — Cisco Umbrella Rank: 15712 |
858 B |
1 |
gstatic.com
fonts.gstatic.com |
8 KB |
1 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 84 |
257 B |
1 |
google.com
analytics.google.com — Cisco Umbrella Rank: 148 |
257 B |
1 |
natureviewer.in
natureviewer.in |
469 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40 |
94 KB |
31 | 11 |
Domain | Requested by | |
---|---|---|
17 | careerguardians.info |
1 redirects
careerguardians.info
|
4 | cdn.by.wonderpush.com |
careerguardians.info
cdn.by.wonderpush.com |
2 | fonts.googleapis.com |
careerguardians.info
|
2 | stackpath.bootstrapcdn.com |
careerguardians.info
stackpath.bootstrapcdn.com |
2 | appis-trk.gz7q.info | 2 redirects |
1 | get.geojs.io |
cdn.by.wonderpush.com
|
1 | measurements-api.wonderpush.com |
cdn.by.wonderpush.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | stats.g.doubleclick.net |
www.googletagmanager.com
|
1 | analytics.google.com |
www.googletagmanager.com
|
1 | natureviewer.in |
careerguardians.info
|
1 | www.googletagmanager.com |
careerguardians.info
|
31 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.attractivebee.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
careerguardians.info GTS CA 1P5 |
2024-03-07 - 2024-06-05 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-01-28 - 2024-04-27 |
3 months | crt.sh |
wonderpush.com GTS CA 1P5 |
2024-01-30 - 2024-04-26 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
natureviewer.in E1 |
2024-02-15 - 2024-05-15 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
measurements-api.wonderpush.com GTS CA 1D4 |
2024-01-26 - 2024-04-25 |
3 months | crt.sh |
geojs.io E1 |
2024-03-11 - 2024-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://careerguardians.info/44-640T110324/?u=112C640
Frame ID: 6B592D796D2C27F3D915223939B90D46
Requests: 31 HTTP requests in this frame
Screenshot
![](/screenshots/b3272077-8561-4382-b370-960766b94ef0.png)
Page Title
Cheap Courier Massive DiscountPage URL History Show full URLs
-
http://appis-trk.gz7q.info/ga/click/2-226951746-20489-44874-88773-52024-6381096a5e-262a4798e0
HTTP 301
https://appis-trk.gz7q.info/ga/click/2-226951746-20489-44874-88773-52024-6381096a5e-262a4798e0 HTTP 302
http://careerguardians.info/44-640T110324/?u=112C640 HTTP 301
https://careerguardians.info/44-640T110324/?u=112C640 Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
animate.css (Web Frameworks) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Confirm the details
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://appis-trk.gz7q.info/ga/click/2-226951746-20489-44874-88773-52024-6381096a5e-262a4798e0
HTTP 301
https://appis-trk.gz7q.info/ga/click/2-226951746-20489-44874-88773-52024-6381096a5e-262a4798e0 HTTP 302
http://careerguardians.info/44-640T110324/?u=112C640 HTTP 301
https://careerguardians.info/44-640T110324/?u=112C640 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
careerguardians.info/44-640T110324/ Redirect Chain
|
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.css
careerguardians.info/44-640T110324/css/ |
76 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
boost.css
careerguardians.info/44-640T110324/css/ |
119 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
customm.css
careerguardians.info/44-640T110324/css/ |
52 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wonderpush-loader.min.js
cdn.by.wonderpush.com/sdk/1.1/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
282 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clicks
natureviewer.in/ |
0 469 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
careerguardians.info/44-640T110324/img/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top.png
careerguardians.info/44-640T110324/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
scan.png
careerguardians.info/44-640T110324/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
home.svg
careerguardians.info/44-640T110324/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bu.svg
careerguardians.info/44-640T110324/img/ |
7 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loader.gif
careerguardians.info/44-640T110324/img/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d3.png
careerguardians.info/44-640T110324/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
no.png
careerguardians.info/44-640T110324/img/ |
366 B 843 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bnr.png
careerguardians.info/44-640T110324/img/ |
17 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
check.png
careerguardians.info/44-640T110324/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
careerguardians.info/44-640T110324/js/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
careerguardians.info/44-640T110324/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
55 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 257 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 257 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wonderpush.min.js
cdn.by.wonderpush.com/sdk/1.1.33.36/ |
375 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
41d403593c0b49d57f632b281192a2cc78b1d2de15f2c5576bbb2af96cbee7e0
cdn.by.wonderpush.com/config/webkeys/ |
2 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
geojs.js
cdn.by.wonderpush.com/plugins/geojs/1.0.2/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
measurements-api.wonderpush.com/v1/ |
93 B 274 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo.json
get.geojs.io/v1/ip/ |
346 B 858 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Royal Mail (Government)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| partstep object| WonderPush function| gtag object| dataLayer function| $ function| jQuery function| moveProgressBar object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal object| webpackChunkwonderpush_javascript_sdk2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.careerguardians.info/ | Name: _ga Value: GA1.1.989262972.1710279588 |
|
.careerguardians.info/ | Name: _ga_MB2WV0SZV7 Value: GS1.1.1710279588.1.0.1710279588.60.0.0 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
appis-trk.gz7q.info
careerguardians.info
cdn.by.wonderpush.com
fonts.googleapis.com
fonts.gstatic.com
get.geojs.io
measurements-api.wonderpush.com
natureviewer.in
stackpath.bootstrapcdn.com
stats.g.doubleclick.net
www.googletagmanager.com
2001:4860:4802:36::15
2606:4700:20::681a:164
2606:4700:3030::ac43:96b9
2606:4700:3032::ac43:d8f7
2606:4700:3035::6815:1464
2606:4700:3036::6815:286a
2606:4700:3037::6815:3deb
2606:4700::6812:13b7
2606:4700::6812:acf
2607:f8b0:4004:c06::9c
2607:f8b0:4006:80b::200e
2607:f8b0:4006:80d::200a
2607:f8b0:4006:823::2008
2607:f8b0:4006:824::2003
1ba77247588da7b85eb0d23e70fb7dfc650c5ac7da3acc7d2b8ea7feffadfbc2
28d8f73b2ec43f3799a4d88ea8e469707c4ce61e9450804d51aa16ef80f9778e
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
344b29deab56ac203aa9d4c258a097020f4b207da082f1267e2b9a4280903c34
36460e494e4c628443afded40b2743b5ede9a4a76fb4f7b9ef2345cc7e59fd64
439f44a085a6aeeeb6d738e826984a4b73422a1262ce400abf0251086972add7
5e4ff474e8c025eedf4d8b3061e669045355d6b767f7abe7784f7ff3e708158d
6540ee33b893e41926571f82c35c6d858fa26570175ed61478c29ae41468d991
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
76f0fffa6ce89328e9679178ad9cf871e241cd9b94828e7732e9c58a60d8025c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
95529aa59fb9e7ccfd452f07c93a1cc835a80425ffc2c85f40059d6cbbcf5f65
b141710e84cbad79c5529bdae9639a0255b6814d9b8734e254fefff98f35b47b
b17609553b24140fc01409b78fa834fe878de6410fe9e8996b0a5f6a984ddd6d
b1a3d3a9759d43217ed2268b883379d049c166215c2f0d70fd34d9a6094d7277
b877ef66eabd2dd21768d59e2ac26f9c4f48e0ed602e27cbd4d53c0701c7d515
bc4308e8072645d75d241c33878d376c06c0cc7f8eda30c9770cec165d0f45de
c125ae021d35ef5abb39370ee6c8075933e82b01c10e65dd52da8b206909ec37
c297929a72964c7cfe17e2dfd5d17c15c2c03243b6cec7f67a3929030fbf8c3d
cee9128614f135d2160fe6784c286def68d09c9a2c4c8ee60c02bde45ccd837b
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
d4b6f1e89823eb3953d76d22b254f456ed58e053a34346c11ef013b1e6573fc4
d52f314a8c5697f8cf897cf70f22bc6e1f9d44ecd9df944095af64f3b400d9b6
d8f9f88b11ab86da378e853c8223f904e5c3cc68acf06f9acc7bc1b96a657186
e17abe122849cc45a1c7a036e85803d11d42d3a790c6c2af9581901647da8efa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89c81987c5cbc157097eaa6657d6a594abf030cc89bb63f0d2154d8383e9fab
fa3ea285aef756cb7e0c03530f9233f1e8adbe135030674a84dd5f167cdc3018