test.worldwidecleaningsupport.com Open in urlscan Pro
2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://newenglandsecuritysolutions.com/public/webacc/
Effective URL:
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
Submission: On October 02 via manual (October 2nd 2023, 1:47:24 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3108::ac42:292e, located in United States and belongs to CLOUDFLARENET, US. The main domain is test.worldwidecleaningsupport.com.
TLS certificate: Issued by GTS CA 1P5 on August 25th 2023. Valid for: 3 months.

This is the only time test.worldwidecleaningsupport.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	50.63.8.89 50.63.8.89	398101 (GO-DADDY-...) (GO-DADDY-COM-LLC)
3 11	2606:4700:310... 2606:4700:3108::ac42:292e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.1.194 151.101.1.194	54113 (FASTLY) (FASTLY)
12	3

1 50.63.8.89 (United States)

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 89.8.63.50.host.secureserver.net

newenglandsecuritysolutions.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:3108::ac42:292e (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

test.worldwidecleaningsupport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.1.194 (United States)

ASN54113 (FASTLY, US)

sp-bootstrap.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	worldwidecleaningsupport.com 3 redirects test.worldwidecleaningsupport.com	162 KB
3	fastly.net sp-bootstrap.global.ssl.fastly.net	216 KB
1	newenglandsecuritysolutions.com newenglandsecuritysolutions.com	692 B
12	3

	Domain	Requested by
11	test.worldwidecleaningsupport.com	3 redirects newenglandsecuritysolutions.com test.worldwidecleaningsupport.com
3	sp-bootstrap.global.ssl.fastly.net	test.worldwidecleaningsupport.com
1	newenglandsecuritysolutions.com
12	3

This site contains no links.

Subject Issuer	Validity	Valid
worldwidecleaningsupport.com GTS CA 1P5	`2023-08-25` - `2023-11-23`	3 months	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-02-05` - `2024-03-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
Frame ID: 6D650A2D3085E5BF3CA668A432B9875D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - Spotify

Page URL History Show full URLs

http://newenglandsecuritysolutions.com/public/webacc/ Page URL
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/ HTTP 302
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp HTTP 301
http://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/ HTTP 307
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/ HTTP 302
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

92 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

378 kB
Transfer

816 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://newenglandsecuritysolutions.com/public/webacc/ Page URL
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/ HTTP 302
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp HTTP 301
http://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/ HTTP 307
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/ HTTP 302
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
newenglandsecuritysolutions.com/public/webacc/ 424 B
692 B 330ms
155ms Document
text/html 50.63.8.89
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://newenglandsecuritysolutions.com/public/webacc/
Protocol: HTTP/1.1
Server: 50.63.8.89 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 89.8.63.50.host.secureserver.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Encoding: gzip
Content-Length: 447
Content-Type: text/html; charset=UTF-8
Date: Mon, 02 Oct 2023 13:47:18 GMT
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin

GET
H3

200

Primary Request login.php Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/
Redirect Chain

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp
http://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/
https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

7 KB
3 KB

89ms
89ms

Document
text/html

2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Requested by

Host: newenglandsecuritysolutions.com
URL: http://newenglandsecuritysolutions.com/public/webacc/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ebe60f82025e74000f53b43918c4235d0cb76dca40e65354e54a253d6b701c7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

Referer: http://newenglandsecuritysolutions.com/public/webacc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-apo-via: origin,host
cf-cache-status: DYNAMIC
cf-ray: 80fd6587ba4fbb37-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 02 Oct 2023 13:47:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: referer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PEAl%2FmfQCJz2IELN5vaWnHE8YfQ01HtwBfWDirDsXI30o1sUG%2FnP57beaM6fiTp5%2BKHKnWM1JJSZnd3L2xtp9AKyZ%2FZ3Cra16z%2FpeIAj%2FnMno%2BkIOSrGMTJVMVVuNJ6av1FaaCwY4Uk838BK5OurBJ3yqUYNcq5AwlkZxA%2BIbkk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: : nosniff
x-frame-options: : sameorigin
x-xss-protection: : 1

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-apo-via: origin,host
cf-cache-status: DYNAMIC
cf-ray: 80fd658749f2bb37-FRA
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 02 Oct 2023 13:47:19 GMT
location: login.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: referer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SOnvj67eQjiFOuFTikCIiI1JHrnOk7Iy76s4lCk8eBs69LS%2FYXG0F9a0Eo9dRzUP6Wud%2Fw1Cz0DPfOvXo2HXf%2FrFYtQ2%2B1GkXVVFjxyCds6NKsQAzrHBZbami9hsbhBmavPZ1BxpqD09ScL1SN4pB%2F8s8HcCeFf0OgBiDWn0IEw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: : nosniff
x-frame-options: : sameorigin
x-xss-protection: : 1

GET
H3 200 stylecss.css
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/ 289 KB
47 KB 134ms
133ms Stylesheet
text/css 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

592ecdf44cc618653bda5ba4ad8f87ede7d5e9f93d40f3883d52d2cb2bbbbe66

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:06 GMT
server: cloudflare
etag: W/"484af-5c708dd0f8180-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NxEkfMBnMGmdDbUtbDisDnYeQZVOZ8vJ5dHFE2Pblh4tE1kYrxEqnc9Tt%2Bg%2FHn4FpGjuyso%2FTe0acHLaoacgiw1O02zcFC3UmldOMcGSNiLJ27r0e27g%2BaSTp51qAB%2F%2BoJ73f9V3CQu0B64zu9qwzyLZRXuhWmomG2k%2FZjDRqGY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885ad5bb37-FRA

GET
H3 200 angular.min.js Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/ 163 KB
59 KB 127ms
126ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/angular.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"28cdb-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FStH6T6OLGGxyu%2BGzQzra3D2%2BK%2BMkzMJGlKObjdGVRKhILRq0t8VuZvu5Jec8k34Clj8CRrCBjOceTr7bSSdE7tWLq%2FJiemCCLZAQHA8DF77TW0fek75nXTPqmbZlFqGweXoUOGfHkjwuJqUGU8OwhfdDyWEp7y%2BiB45C9H6EIM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885ad7bb37-FRA

GET
H3 200 jquery.min.js Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/ 95 KB
35 KB 160ms
159ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/jquery.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"17b8b-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M6Z4wKqBIo3UTuqqdTQbbXOGDQwPvjX%2BxE1B2hoUL2GHjvksbz84Z%2BgSeJLxsG7J3hR3RJC3rvHSxiXTjmOcmJr5HwUC2QIaVjGmStu5QVbgRpWeu%2B8MkwUYTwFwcwaLGM7KuqOgrB%2Brc8rXz45gyXlFwy5QsHKGlZFfdg2aPZg%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885adabb37-FRA

GET
H3 200 jquery.mask.js Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/ 18 KB
6 KB 73ms
72ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/jquery.mask.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"47fe-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2BkgAlnWUyY8EucL4FlaYLvBRgJsKEGGRwPHNcSCj5U%2BdMkHBcFWmcjsHdopj2iDjCXx%2FB4auEdbUgpxAD2JlFrCLqqG7Ii08%2B67Cw%2BXAN438%2BJ6PxoLOcVtJkDdeDZsjBvOxQcg%2Fx4ETV4t303iWulDOW35a7RVHTLJ31SdFnE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885adbbb37-FRA

GET
H3 200 jquery.validate.min.js Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/ 23 KB
8 KB 76ms
75ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/jquery.validate.min.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94d965af65067015be6bf62d7daeca80be9deddc851a6ed0c653318e62a7b4d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"5a02-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K80ZXywWkQqZrcQ7jG%2Bx8B609yyzvtaQkiw6xkoFV5qcn0n2grSaqJXtoE1yFi0Wv6MryChG%2Bgmt2wZ%2FMNhG2hUuH5wDBE3r0tDFPcRuuyMIyWsRtOFI1cMTopjv%2FHbIhiHQqILE%2FpbE3CVBunvhynR5ds3e%2Bg%2BchvtOOfY2%2FSM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885adcbb37-FRA

GET
H3 200 style.js Show response
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/ 2 KB
1 KB 125ms
124ms Script
application/javascript 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/js/style.js

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:08 GMT
server: cloudflare
etag: W/"8bf-5c708dd2e0600-gzip"
vary: Accept-Encoding
x-frame-options: : sameorigin
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z3Gcp%2FHeIIeCBlTmCDA6M63qjbvZhV1vHWiBIjkdKwPRn4oTfJpUsvMvtWOsFgref1BRDIzHA9XIaQK%2B6ckNBUUSfhgfKaIdHzwyoyGaNkpSHWd38kpOhazJS1rRY5o5pqfh7ZtvUO8IBbnfamYAjTYC7m1i4eKL9LWE7ipS4Ok%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 80fd65885adebb37-FRA

GET
H3 200 imgs.svg
test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/ 4 KB
2 KB 72ms
68ms Image
image/svg+xml 2606:4700:3108::ac42:292e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/imgs.svg

Requested by

Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:292e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	: nosniff
X-Frame-Options	: sameorigin
X-Xss-Protection	: 1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Mon, 02 Oct 2023 13:47:19 GMT
content-security-policy: upgrade-insecure-requests
x-content-type-options: : nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: REVALIDATED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: : 1
referrer-policy: referer
last-modified: Tue, 13 Jul 2021 22:36:06 GMT
server: cloudflare
etag: W/"106f-5c708dd0f8180"
x-frame-options: : sameorigin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JbbL%2Bp5OXhzFvkHsSxUGuEwQKwGKsveOqus9KBrn2JolRQqMzHBpaawYD1XNFWKo44F9%2B1jspmxA%2BTEsEIQJLIvR1NKB4XU2ov02crUnq1Ey498M5z8nY7ukuf2dKRNOjXuB9GO1xxC27xB3e81Qum%2Br8nikXWe8nNEHOoFH2lQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 80fd65898c08bb37-FRA

GET
H/1.1 200
OK circular-black.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 72 KB
73 KB 60ms
8ms Font
font/woff2 151.101.1.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-black.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 13:47:19 GMT
Age: 1036933
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 73892
X-Served-By: cache-chi-kigq8000086-CHI, cache-fra-etou8220027-FRA
Last-Modified: Mon, 21 Mar 2022 12:56:44 GMT
ETag: "56b510f616f840ffde8f3955349a6c5a"
x-goog-generation: 1647867404954983
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
x-goog-stored-content-length: 73892
x-amz-checksum-crc32c: gPhk7g==
Accept-Ranges: bytes
X-Cache-Hits: 66, 1

GET
H/1.1 200
OK circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 74 KB
74 KB 62ms
11ms Font
font/woff2 151.101.1.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-bold.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 13:47:19 GMT
Age: 1211884
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 75488
X-Served-By: cache-chi-klot8100026-CHI, cache-fra-eddf8230084-FRA
Last-Modified: Mon, 21 Mar 2022 12:56:44 GMT
ETag: "c094813cfe6be5d188f4e506b6ffca1b"
x-goog-generation: 1647867404953751
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
x-goog-stored-content-length: 75488
x-amz-checksum-crc32c: c0lRgg==
Accept-Ranges: bytes
X-Cache-Hits: 102, 1

GET
H/1.1 200
OK circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 68 KB
69 KB 57ms
9ms Font
font/woff2 151.101.1.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-book.woff2
Requested by: Host: test.worldwidecleaningsupport.com
URL: https://test.worldwidecleaningsupport.com/wp-cli/wp-cli/icl/no-spotify/webapp/style/stylecss.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Referer: https://test.worldwidecleaningsupport.com/
Origin: https://test.worldwidecleaningsupport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Mon, 02 Oct 2023 13:47:19 GMT
Age: 1716112
x-amz-meta-goog-reserved-file-mtime: 1550690582
X-Cache: HIT, HIT
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
Connection: keep-alive
Content-Length: 70092
X-Served-By: cache-chi-klot8100147-CHI, cache-fra-eddf8230076-FRA
Last-Modified: Mon, 21 Mar 2022 12:56:45 GMT
ETag: "c4f753e765823b94234e7f5ccd733f44"
x-goog-generation: 1647867405030797
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
x-goog-stored-content-length: 70092
x-amz-checksum-crc32c: 1fg5Dg==
Accept-Ranges: bytes
X-Cache-Hits: 169, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	error	Message: Failed to set referrer policy: The value 'referer' is not one of 'no-referrer', 'no-referrer-when-downgrade', 'origin', 'origin-when-cross-origin', 'same-origin', 'strict-origin', 'strict-origin-when-cross-origin', or 'unsafe-url'. The referrer policy has been left unchanged.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

newenglandsecuritysolutions.com
sp-bootstrap.global.ssl.fastly.net
test.worldwidecleaningsupport.com
151.101.1.194
2606:4700:3108::ac42:292e
50.63.8.89
1ebe60f82025e74000f53b43918c4235d0cb76dca40e65354e54a253d6b701c7
592ecdf44cc618653bda5ba4ad8f87ede7d5e9f93d40f3883d52d2cb2bbbbe66
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
94d965af65067015be6bf62d7daeca80be9deddc851a6ed0c653318e62a7b4d5
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2
f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

test.worldwidecleaningsupport.com Open in urlscan Pro 2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

378 kBTransfer

816 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

test.worldwidecleaningsupport.com Open in urlscan Pro
2606:4700:3108::ac42:292e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

378 kB
Transfer

816 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!