mac.scaleu.click
Open in
urlscan Pro
138.68.190.182
Malicious Activity!
Public Scan
Effective URL: https://mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/?ip=138.199.38.132&lpkey=16c0532c53f462f814&thjp=ZXh0cmFyZHIuY29t&ucli...
Submission: On May 26 via manual from PH — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 25th 2022. Valid for: 3 months.
This is the only time mac.scaleu.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: GCash (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.210.198.57 54.210.198.57 | 14618 (AMAZON-AES) (AMAZON-AES) | |
3 | 103.53.43.45 103.53.43.45 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 45.9.149.181 45.9.149.181 | 49447 (NICEIT) (NICEIT) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 111.90.143.157 111.90.143.157 | 45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd) | |
1 3 | 188.166.68.96 188.166.68.96 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 2 | 195.201.221.45 195.201.221.45 | 24940 (HETZNER-AS) (HETZNER-AS) | |
3 | 138.68.190.182 138.68.190.182 | () () | |
1 | 2606:4700::68... 2606:4700::6811:190e | () () | |
17 | 10 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-210-198-57.compute-1.amazonaws.com
rebrand.ly |
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: md-in-38.webhostbox.net
jayahind.com |
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la
links.greengoplatform.com |
ASN14061 (DIGITALOCEAN-ASN, US)
cleversmallline.com | |
0.cleversmallline.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.45.221.201.195.clients.your-server.de
extrardr.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
scaleu.click
mac.scaleu.click |
219 KB |
3 |
cleversmallline.com
1 redirects
cleversmallline.com — Cisco Umbrella Rank: 850697 0.cleversmallline.com |
103 KB |
3 |
greengoplatform.com
links.greengoplatform.com — Cisco Umbrella Rank: 415399 |
4 KB |
3 |
jayahind.com
jayahind.com |
12 KB |
2 |
extrardr.com
1 redirects
extrardr.com |
589 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
28 KB |
1 |
gstatic.com
fonts.gstatic.com |
21 KB |
1 |
transportgoline.com
track.transportgoline.com — Cisco Umbrella Rank: 593902 |
825 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42 |
1 KB |
1 |
rebrand.ly
1 redirects
rebrand.ly — Cisco Umbrella Rank: 87847 |
319 B |
17 | 10 |
Domain | Requested by | |
---|---|---|
3 | mac.scaleu.click |
jayahind.com
mac.scaleu.click |
3 | links.greengoplatform.com |
track.transportgoline.com
jayahind.com |
3 | jayahind.com |
jayahind.com
|
2 | extrardr.com |
1 redirects
mac.scaleu.click
|
2 | 0.cleversmallline.com |
1 redirects
jayahind.com
|
1 | cdnjs.cloudflare.com |
mac.scaleu.click
|
1 | cleversmallline.com | |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | track.transportgoline.com |
jayahind.com
|
1 | fonts.googleapis.com |
jayahind.com
|
1 | rebrand.ly | 1 redirects |
17 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.jayahind.deltainfomedia.com R3 |
2022-04-27 - 2022-07-26 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-05-04 - 2022-07-27 |
3 months | crt.sh |
track.transportgoline.com R3 |
2022-05-20 - 2022-08-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-05-04 - 2022-07-27 |
3 months | crt.sh |
links.greengoplatform.com R3 |
2022-05-16 - 2022-08-14 |
3 months | crt.sh |
cleversmallline.com R3 |
2022-05-22 - 2022-08-20 |
3 months | crt.sh |
www.scaleu.click R3 |
2022-05-25 - 2022-08-23 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
extrardr.com R3 |
2022-05-20 - 2022-08-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/?ip=138.199.38.132&lpkey=16c0532c53f462f814&thjp=ZXh0cmFyZHIuY29t&uclick=sca0kty9&uclickhash=sca0kty9-sca0kty9-bzfn-0-fnxs-j2dv-x9xr-29fa2f
Frame ID: B5B8EED3A765075F86D19C51D9B7F39F
Requests: 21 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://rebrand.ly/G-cash-loyalty
HTTP 301
https://jayahind.com/here/www.gcash.com.ph/gcash-login-web/ Page URL
- https://links.greengoplatform.com/4zY36Y Page URL
- https://links.greengoplatform.com/p1YgNqGT Page URL
- https://cleversmallline.com/?p=me3dqnzrmm5gi3bpg4ydsnq&sub1=timpest7&sub2=clevest Page URL
- https://0.cleversmallline.com/?p=me3dqnzrmm5gi3bpg4ydsnq&sub1=timpest7&sub2=clevest Page URL
-
https://0.cleversmallline.com/?auf=gi2wgm3fgm5diojygyxtombzgyxtemzpge3dkmzvgm2tsmjt&s=1&sub1=timpest7&sub2...
HTTP 302
https://extrardr.com/click.php?key=sqo6m43xdugr203bh0e4&clickid=e66719a3-2578-4512-90df-bbabe5053... HTTP 302
https://mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/?ip=138.199.38.132&lpkey=16c0532c53f462f814&thjp=Z... Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rebrand.ly/G-cash-loyalty
HTTP 301
https://jayahind.com/here/www.gcash.com.ph/gcash-login-web/ Page URL
- https://links.greengoplatform.com/4zY36Y Page URL
- https://links.greengoplatform.com/p1YgNqGT Page URL
- https://cleversmallline.com/?p=me3dqnzrmm5gi3bpg4ydsnq&sub1=timpest7&sub2=clevest Page URL
- https://0.cleversmallline.com/?p=me3dqnzrmm5gi3bpg4ydsnq&sub1=timpest7&sub2=clevest Page URL
-
https://0.cleversmallline.com/?auf=gi2wgm3fgm5diojygyxtombzgyxtemzpge3dkmzvgm2tsmjt&s=1&sub1=timpest7&sub2=clevest&sub3=&sub4=&cpc=0&cpm=0
HTTP 302
https://extrardr.com/click.php?key=sqo6m43xdugr203bh0e4&clickid=e66719a3-2578-4512-90df-bbabe5053dad&cost=0.0021&feedid=feed14986&creative=0&site=9da716c9&age=0&hash=9da716c9&campaign=61595 HTTP 302
https://mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/?ip=138.199.38.132&lpkey=16c0532c53f462f814&thjp=ZXh0cmFyZHIuY29t&uclick=sca0kty9&uclickhash=sca0kty9-sca0kty9-bzfn-0-fnxs-j2dv-x9xr-29fa2f Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://rebrand.ly/G-cash-loyalty HTTP 301
- https://jayahind.com/here/www.gcash.com.ph/gcash-login-web/
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
jayahind.com/here/www.gcash.com.ph/gcash-login-web/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
jayahind.com/here/www.gcash.com.ph/gcash-login-web/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
store.js
track.transportgoline.com/ |
507 B 825 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gcash-1024x768.png
jayahind.com/here/www.gcash.com.ph/gcash-login-web/Gcash_files/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v22/ |
21 KB 21 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GVCKPs
links.greengoplatform.com/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
4zY36Y
links.greengoplatform.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4zY36Y
links.greengoplatform.com/ |
208 B 974 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p1YgNqGT
links.greengoplatform.com/ |
247 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
cleversmallline.com/ |
50 KB 51 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
24 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
0.cleversmallline.com/ |
52 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
85 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/s/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
box.png
mac.scaleu.click/01deaXxT4uNHhwGGdb4rk0yDA/s/ |
214 KB 214 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
click.php
extrardr.com/ |
0 143 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- links.greengoplatform.com
- URL
- https://links.greengoplatform.com/4zY36Y
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: GCash (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
links.greengoplatform.com/ | Name: _subid Value: tj4ift628ef38893ff6 |
|
links.greengoplatform.com/ | Name: a7498 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM4XCI6MTY1MzUzNTYyNCxcIjMyXCI6MTY1MzUzNTYyNH0sXCJjYW1wYWlnbnNcIjp7XCI5XCI6MTY1MzUzNTYyNCxcIjExXCI6MTY1MzUzNTYyNH0sXCJ0aW1lXCI6MTY1MzUzNTYyNH0ifQ.iaES7jMqBzd1kpc5Y4bKNz-lvG2bbT9Gvdvu97lE4Sc |
|
.cleversmallline.com/ | Name: uuid Value: 6c790063-e99e-4f3d-8573-88d147158399 |
|
.0.cleversmallline.com/ | Name: uuid Value: 6c790063-e99e-4f3d-8573-88d147158399 |
|
0.cleversmallline.com/ | Name: uuid Value: 6c790063-e99e-4f3d-8573-88d147158399 |
|
.0.cleversmallline.com/ | Name: ccid Value: %5B61595%5D |
|
extrardr.com/ | Name: uclick Value: sca0kty9 |
|
extrardr.com/ | Name: uclickhash Value: sca0kty9-sca0kty9-bzfn-0-fnxs-j2dv-x9xr-29fa2f |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0.cleversmallline.com
cdnjs.cloudflare.com
cleversmallline.com
extrardr.com
fonts.googleapis.com
fonts.gstatic.com
jayahind.com
links.greengoplatform.com
mac.scaleu.click
rebrand.ly
track.transportgoline.com
links.greengoplatform.com
103.53.43.45
111.90.143.157
138.68.190.182
188.166.68.96
195.201.221.45
2606:4700::6811:190e
2a00:1450:4001:800::200a
2a00:1450:4001:810::2003
45.9.149.181
54.210.198.57
08b90c3773200533aef80350eb7e34f9c4dca5b80bd053e894238f23afe9aeec
0b022da978f07df901703de2ba5b3303fbb496a81d05964e4bc079ae04275fdf
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2a3dc358c51b43aebfbe863252286e0f777ff8bff72d177d8ddde8823a1270f0
5d55045418798707155f1fd73ae7fcc6d377368004f8c526c22642db465268f4
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7
6cbf5ff9c2945171c3f93c38e9c67d4b98fb5354a3c95cf4910259780c1fb9b0
a72fd7760f623c9fd5fee0bd98df809a347471902fc479bcdae38681c1a071d1
b06a086772e41e5c71e268946669ad339dd475cd64aa09c2cdcf0c0ad9cb1b49
b44aae5610217ab48a4f0305e00a96f7049816def515457bdce429a189a69366
ca7a07233506b5529a951fd2c4580757f5606d874b8a2b0a153d14a418b201ef
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e75c5db3aa5dbcc4c0e59f613e85f9f1bc686d6bdd8911cc0f646fcde919cce8
f0efac46254672997dc646ed59793c305f9b8533beaf921ab334bca313f1eb51
f4567eafa343cae71d898c9d3b345406b5d0bb61b7b3477921560611fc452344
f89af9ffc77074abc4737828e94e6b863682ceb0dcfbd9d60fecd79571760351
fae5426bccacee7bd12dc18b8320cc4a6a801ba598247d9a2987739629a29c02