![](/screenshots/ebd14e77-0489-446c-9ad1-1e00ecb5b847.png)
eflow-tolls-payments.com
Open in
urlscan Pro
176.10.111.48
Malicious Activity!
Public Scan
Effective URL: https://eflow-tolls-payments.com/ef
Submission: On April 28 via api from GB — Scanned from GB
Summary
TLS certificate: Issued by R3 on April 27th 2023. Valid for: 3 months.
This is the only time eflow-tolls-payments.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eFlow (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 176.10.111.48 176.10.111.48 | 51395 (AS-SOFTPLUS) (AS-SOFTPLUS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
5 | 3 |
ASN51395 (AS-SOFTPLUS, CH)
PTR: opg193.sweetantslocations.com
eflow-tolls-payments.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
eflow-tolls-payments.com
2 redirects
eflow-tolls-payments.com |
181 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 997 |
30 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
6 | eflow-tolls-payments.com |
2 redirects
eflow-tolls-payments.com
code.jquery.com |
1 | code.jquery.com |
eflow-tolls-payments.com
|
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
eflow-tolls-payments.com R3 |
2023-04-27 - 2023-07-26 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://eflow-tolls-payments.com/ef
Frame ID: 2B836FFC6A8AF41CFEC9E5F6C1D52985
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/ebd14e77-0489-446c-9ad1-1e00ecb5b847.png)
Page Title
eFlow Website - M50 TollPage URL History Show full URLs
-
http://eflow-tolls-payments.com/
HTTP 301
https://eflow-tolls-payments.com/ HTTP 302
https://eflow-tolls-payments.com/ef Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://eflow-tolls-payments.com/
HTTP 301
https://eflow-tolls-payments.com/ HTTP 302
https://eflow-tolls-payments.com/ef Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
ef
eflow-tolls-payments.com/ Redirect Chain
|
52 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css
eflow-tolls-payments.com/assets/ef/ |
285 KB 168 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
actions.js
eflow-tolls-payments.com/assets/js/ |
778 B 668 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
677 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1001 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
20 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 17 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
77 KB 77 KB |
Font
font/otf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
action
eflow-tolls-payments.com/apis/lr/ |
25 B 338 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eFlow (Transportation)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery string| lrbank string| lrinfo boolean| continueupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
eflow-tolls-payments.com/ | Name: PHPSESSID Value: ap500pb131h50j6jniqeqgk7ll |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
eflow-tolls-payments.com
176.10.111.48
2001:4de0:ac18::1:a:2a
190925d1d7f717153ae6dc4b845bdef8c8426a63b9bd3cee4cc4ab34944ee86f
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
41af86a294510c5097c1b1f7f0083f4e9aac6fe808f328cddc603be37bb629a1
6764eb4f2ce95a6c356ca6c8c3bf6dc2c9b0059eaea151c406e90c12adbdaa97
7188c7cb03031abb8036539256449e797e5d3b8f616c8db2a211a219160f7e7e
895fd968c4378f5fc15afea52ff95c26f768346f0cbd6c0d4f822cd2e53f874d
b2d222cf844044a138c5152c56665367d079bc7877bd09a9ba74bbcb677523cc
ba3625f944db2052ebb037f4789dff86d720eaa565ec2d62e891f811eb8370ad
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
cb0315a4d63849d057366f9a9d1148a8e461b4618eef5fb8efbfe15b198d8d94
dc082fa54c8d64c62352b91fc79455e15cfa162369436417db5d3cd2b2aa63c0
f99d02517856b86407d7667376c404102202f4867347b626918be3d1495700c8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e