thefusejoplin.com Open in urlscan Pro
198.54.120.146 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://thefusejoplin.com/Support/us-woldwide/ar-en/
Submission: On February 02 via manual (February 2nd 2023, 5:18:03 am UTC) from AE — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 198.54.120.146, located in United States and belongs to NAMECHEAP-NET, US. The main domain is thefusejoplin.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 11th 2022. Valid for: a year.

This is the only time thefusejoplin.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Emirates Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
18	198.54.120.146 198.54.120.146	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	185.126.226.146 185.126.226.146	9009 (M247) (M247)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
20	3

18 198.54.120.146 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium54-5.web-hosting.com

thefusejoplin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.126.226.146 (Amsterdam, Netherlands)

ASN9009 (M247, RO)

db.onlinewebfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	thefusejoplin.com thefusejoplin.com	784 KB
1	gstatic.com fonts.gstatic.com	30 KB
1	onlinewebfonts.com db.onlinewebfonts.com — Cisco Umbrella Rank: 47543	80 KB
20	3

	Domain	Requested by
18	thefusejoplin.com	thefusejoplin.com
1	fonts.gstatic.com	thefusejoplin.com
1	db.onlinewebfonts.com	thefusejoplin.com
20	3

This site contains no links.

Subject Issuer	Validity	Valid
thefusejoplin.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-11` - `2023-07-11`	a year	crt.sh
onlinewebfonts.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-07` - `2023-12-07`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Frame ID: 2E54A2589634C4B64EF47BF01E1CDA07
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Emirates Post | بريد الإمارات

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

895 kB
Transfer

1265 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
thefusejoplin.com/Support/us-woldwide/ar-en/ 10 KB
2 KB 544ms
155ms Document
text/html 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 3035b2607bc1603f15bf631fa052d0fde663e86c6e07cdc49bf74b9c4fca1482

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 02 Feb 2023 05:17:56 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 base.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/ 16 KB
3 KB 456ms
454ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 4d512653560de29b3246cb489c84d40420444974107a8d047f9149d71094ec01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Sat, 28 Nov 2020 19:37:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 2897
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 vendor.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/ 50 KB
6 KB 156ms
155ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/vendor.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: e6c80bfb027ccc23b673283f0e7109e5b9cb9597d810380527b46f66e8e034fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:24 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 5955
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 main.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/ 76 KB
11 KB 305ms
304ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/main.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: a8935188f8afc7b9f6f5a3b4e25f008e89c9c893457cbc542fea8fb83e055837

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Sat, 28 Nov 2020 22:33:08 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 11366
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 modernizr.js Show response
thefusejoplin.com/Support/us-woldwide/ar-en/js/ 8 KB
3 KB 153ms
152ms Script
application/javascript 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/js/modernizr.js
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 461a476f9db3123182ff2e0556a05c0bd7cd28b0d38976d94593df7e4275120a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 3173
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 pace.min.js Show response
thefusejoplin.com/Support/us-woldwide/ar-en/js/ 12 KB
4 KB 304ms
303ms Script
application/javascript 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/js/pace.min.js
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 579a10a2485055e988338be054f866cbe713c8510442130cbda0ce11ced6c49f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 4077
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 logo.png
thefusejoplin.com/Support/us-woldwide/ar-en/image/ 17 KB
17 KB 299ms
298ms Image
image/png 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/image/logo.png
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Sat, 28 Nov 2020 05:36:42 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 17088
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 jquery-3.2.1.min.js Show response
thefusejoplin.com/Support/us-woldwide/ar-en/js/ 85 KB
29 KB 153ms
152ms Script
application/javascript 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/js/jquery-3.2.1.min.js
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:20 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 29485
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 plugins.js Show response
thefusejoplin.com/Support/us-woldwide/ar-en/js/ 184 KB
56 KB 302ms
302ms Script
application/javascript 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/js/plugins.js
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: fe2bcf2057fb37fd62bbd86c5653ca411915895684cd6a799e5a1aaf2536c318

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 56805
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 main.js Show response
thefusejoplin.com/Support/us-woldwide/ar-en/js/ 14 KB
3 KB 298ms
298ms Script
application/javascript 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/js/main.js
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 9bd926b1d5e3931f02cdbd8e70af3485683d19588c56d3404aad31c571020c7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 3335
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 font-awesome.min.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/font-awesome/css/ 30 KB
7 KB 454ms
453ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/font-awesome/css/font-awesome.min.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 1fd4c882b277b1733f27be78e59f2318df771113cfc3981f4c4ad1b287238880

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:26 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 6665
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 micons.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/micons/ 11 KB
2 KB 454ms
454ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/micons/micons.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: fbff254833abe80bd36853a1fba0b6ec33eae05c83fdd615cc2b48fe2b898678

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:30 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 1897
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 fonts.css
thefusejoplin.com/Support/us-woldwide/ar-en/css/ 4 KB
602 B 456ms
455ms Stylesheet
text/css 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 877315ebe632fd0513eb469fc3caad3704ba8247b14777e7bd6c2a63925ca9ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:56 GMT
content-encoding: br
last-modified: Fri, 23 Oct 2020 19:18:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 382
expires: Thu, 09 Feb 2023 05:17:56 GMT

GET
H2 200 13a7a4a64f0a4b39a872e732c91d2375.woff2
db.onlinewebfonts.com/t/ 80 KB
80 KB 119ms
36ms Font
application/x-font-woff 185.126.226.146
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://db.onlinewebfonts.com/t/13a7a4a64f0a4b39a872e732c91d2375.woff2
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.126.226.146 Amsterdam, Netherlands, ASN9009 (M247, RO),
Reverse DNS
Software: nginx / PHP/5.4.45
Resource Hash: aeb0f35eb529425a322bbfc9e667d548570ebc5b989c5618cc5277784e2ca085

Request headers

Referer: https://thefusejoplin.com/
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:16:28 GMT
server: nginx
x-powered-by: PHP/5.4.45
access-control-allow-methods: GET,POST,OPTIONS
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: public,max-age=86400,must-revalidate
access-control-allow-headers: X-Requested-With

GET
H2 200 tsstApxBaigK_hnnQ1iFo0C3.woff2
fonts.gstatic.com/s/almarai/v4/ 30 KB
30 KB 31ms
8ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/almarai/v4/tsstApxBaigK_hnnQ1iFo0C3.woff2

Requested by

Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6caf5474c8664f57ff0d21a4b0afb47291f7f8a5a3dfd7e3949e1055ae34158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thefusejoplin.com/
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 27 Jan 2023 01:19:11 GMT
x-content-type-options: nosniff
age: 532726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30680
x-xss-protection: 0
last-modified: Thu, 24 Sep 2020 23:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Jan 2024 01:19:11 GMT

GET
H2 200 montserrat-medium-webfont.woff2
thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/ 19 KB
19 KB 282ms
281ms Font
font/woff2 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/montserrat-medium-webfont.woff2
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: b8d131282009e7d41bd8dbdd22c943892bc01b4598314ddff7a2f5d9ccc3db29

Request headers

Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Fri, 23 Oct 2020 19:18:12 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 18988
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 montserrat-regular-webfont.woff2
thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/ 18 KB
19 KB 436ms
435ms Font
font/woff2 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/montserrat-regular-webfont.woff2
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 2396129a0fa59369b86bb6a508f77b53ff346a7fb28a7396c96601bcf06b5d8d

Request headers

Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Fri, 23 Oct 2020 19:18:06 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 18824
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 lora-regular-webfont.woff2
thefusejoplin.com/Support/us-woldwide/ar-en/fonts/lora/ 33 KB
34 KB 432ms
432ms Font
font/woff2 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/fonts/lora/lora-regular-webfont.woff2
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 2d79fb8380c7e66d3dfecfef4e484b1d2ab40c8279705e505c7c4826afec8734

Request headers

Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Fri, 23 Oct 2020 19:18:16 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 34276
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 montserrat-light-webfont.woff2
thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/ 18 KB
18 KB 436ms
436ms Font
font/woff2 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/fonts/montserrat/montserrat-light-webfont.woff2
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: a358c864806a7a93ef2d795bbfaf5eae965c752d4c1751b1d5308f7f43f31df8

Request headers

Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/css/fonts.css
Origin: https://thefusejoplin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Fri, 23 Oct 2020 19:18:14 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 18680
expires: Thu, 09 Feb 2023 05:17:57 GMT

GET
H2 200 bg.jpg
thefusejoplin.com/Support/us-woldwide/ar-en/images/ 550 KB
550 KB 154ms
154ms Image
image/jpeg 198.54.120.146
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/images/bg.jpg
Requested by: Host: thefusejoplin.com
URL: https://thefusejoplin.com/Support/us-woldwide/ar-en/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 198.54.120.146 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium54-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: ba5c21598ed765c1b3679e8336e226b5b93aad5846d5239d6371011d64255caa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://thefusejoplin.com/Support/us-woldwide/ar-en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 05:17:57 GMT
last-modified: Sat, 28 Nov 2020 07:24:50 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 562971
expires: Thu, 09 Feb 2023 05:17:57 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates Post (Transportation)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

db.onlinewebfonts.com
fonts.gstatic.com
thefusejoplin.com
185.126.226.146
198.54.120.146
2a00:1450:4001:82f::2003
1fd4c882b277b1733f27be78e59f2318df771113cfc3981f4c4ad1b287238880
2396129a0fa59369b86bb6a508f77b53ff346a7fb28a7396c96601bcf06b5d8d
2d79fb8380c7e66d3dfecfef4e484b1d2ab40c8279705e505c7c4826afec8734
2e6c37dce49aa29359da9f8213274dd675646341fb974561dcd467ad50d65beb
3035b2607bc1603f15bf631fa052d0fde663e86c6e07cdc49bf74b9c4fca1482
461a476f9db3123182ff2e0556a05c0bd7cd28b0d38976d94593df7e4275120a
4d512653560de29b3246cb489c84d40420444974107a8d047f9149d71094ec01
579a10a2485055e988338be054f866cbe713c8510442130cbda0ce11ced6c49f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
877315ebe632fd0513eb469fc3caad3704ba8247b14777e7bd6c2a63925ca9ae
9bd926b1d5e3931f02cdbd8e70af3485683d19588c56d3404aad31c571020c7d
a358c864806a7a93ef2d795bbfaf5eae965c752d4c1751b1d5308f7f43f31df8
a8935188f8afc7b9f6f5a3b4e25f008e89c9c893457cbc542fea8fb83e055837
aeb0f35eb529425a322bbfc9e667d548570ebc5b989c5618cc5277784e2ca085
b8d131282009e7d41bd8dbdd22c943892bc01b4598314ddff7a2f5d9ccc3db29
ba5c21598ed765c1b3679e8336e226b5b93aad5846d5239d6371011d64255caa
e6c80bfb027ccc23b673283f0e7109e5b9cb9597d810380527b46f66e8e034fd
e6caf5474c8664f57ff0d21a4b0afb47291f7f8a5a3dfd7e3949e1055ae34158
fbff254833abe80bd36853a1fba0b6ec33eae05c83fdd615cc2b48fe2b898678
fe2bcf2057fb37fd62bbd86c5653ca411915895684cd6a799e5a1aaf2536c318

thefusejoplin.com Open in urlscan Pro 198.54.120.146 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

895 kBTransfer

1265 kBSize

0 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

23 JavaScript Global Variables

0 Cookies

Indicators

thefusejoplin.com Open in urlscan Pro
198.54.120.146 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

895 kB
Transfer

1265 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!