milindtech.com Open in urlscan Pro
2606:4700:3033::681c:2a0  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://service-impot-centrefr-7b0239.ingress-daribow.easywp.com/wp-admin/servi/fr/set/root/redirect.html Page URL
2. https://milindtech.com/rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	redirect.html Show response service-impot-centrefr-7b0239.ingress-daribow.easywp.com/wp-admin/servi/fr/set/root/	183 B 502 B	616ms 198ms	Document text/html	63.250.43.14 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://service-impot-centrefr-7b0239.ingress-daribow.easywp.com/wp-admin/servi/fr/set/root/redirect.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.14 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-daribow.easywp.com Software nginx / Resource Hash edeab2a731a92bf7e8899dc04fee2326ba6147889299a44630cb831efa544cdf Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority service-impot-centrefr-7b0239.ingress-daribow.easywp.com :scheme https :path /wp-admin/servi/fr/set/root/redirect.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Tue, 05 Jan 2021 11:04:58 GMT content-type text/html content-length 183 last-modified Sun, 03 Jan 2021 13:39:20 GMT etag "5ff1c908-b7" x-frame-options SAMEORIGIN x-content-type-options nosniff x-xss-protection 1; mode=block cache-control public referrer-policy strict-origin-when-cross-origin accept-ranges bytes age 0 x-cache MISS strict-transport-security max-age=15768000
GET H2	200	Primary Request / Show response milindtech.com/rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/	4 KB 2 KB	54ms 18ms	Document text/html	2606:4700:3033::681c:2a0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://milindtech.com/rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:2a0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e74cc54f072ecf472cc52cf2dd33e3312daea854844d166aa6ca928f1bd51d5b Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers :method GET :authority milindtech.com :scheme https :path /rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://service-impot-centrefr-7b0239.ingress-daribow.easywp.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://service-impot-centrefr-7b0239.ingress-daribow.easywp.com/ Response headers date Tue, 05 Jan 2021 11:04:58 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d15202cf2937b482c95322fabb37e78221609844698; expires=Thu, 04-Feb-21 11:04:58 GMT; path=/; domain=.milindtech.com; HttpOnly; SameSite=Lax x-frame-options SAMEORIGIN cf-request-id 0773d1c6d100004ab5479b1000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Tme2by2Mr6aRwuhu7%2BQOGDrEAv11gjGVSoikXe5wOkxcM2pUiRB%2FP%2BxXEJc9WPfWOgxFJEeiMtdBHuDd9vdVOKLYH2HxiHwrBs5J3UpV%2FuSKrjAKUCk9KR3UDA%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 60ccb8b7bff44ab5-FRA content-encoding br
GET H2	200	cf.errors.css milindtech.com/cdn-cgi/styles/	23 KB 4 KB	19ms 18ms	Stylesheet text/css	2606:4700:3033::681c:2a0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://milindtech.com/cdn-cgi/styles/cf.errors.css Requested by Host: milindtech.com URL: https://milindtech.com/rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:2a0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://milindtech.com/rootz/www.mobilefree.fr/contact/fr/facture/frk/login/id=l83209/espaceclient/freemobile.moncomptef/login/moncompte/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 05 Jan 2021 11:04:58 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 17 Dec 2020 18:38:23 GMT server cloudflare etag W/"5fdba59f-5c88" x-frame-options DENY content-type text/css cache-control max-age=7200, public cf-ray 60ccb8b808de4ab5-FRA vary Accept-Encoding expires Tue, 05 Jan 2021 13:04:58 GMT
GET H2	200	icon-exclamation.png milindtech.com/cdn-cgi/images/	452 B 541 B	8ms 7ms	Image image/png	2606:4700:3033::681c:2a0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://milindtech.com/cdn-cgi/images/icon-exclamation.png?1376755637 Requested by Host: milindtech.com URL: https://milindtech.com/cdn-cgi/styles/cf.errors.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:2a0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://milindtech.com/cdn-cgi/styles/cf.errors.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 05 Jan 2021 11:04:58 GMT x-content-type-options nosniff last-modified Thu, 17 Dec 2020 18:38:23 GMT server cloudflare etag "5fdba59f-1c4" x-frame-options DENY content-type image/png cache-control max-age=7200, public accept-ranges bytes cf-ray 60ccb8b839494ab5-FRA vary Accept-Encoding content-length 452 expires Tue, 05 Jan 2021 13:04:58 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _cf_translation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.milindtech.com/	1970-01-19 15:53:56	Name: __cfduid Value: d15202cf2937b482c95322fabb37e78221609844698

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

milindtech.com
service-impot-centrefr-7b0239.ingress-daribow.easywp.com
2606:4700:3033::681c:2a0
63.250.43.14
16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c
e74cc54f072ecf472cc52cf2dd33e3312daea854844d166aa6ca928f1bd51d5b
edeab2a731a92bf7e8899dc04fee2326ba6147889299a44630cb831efa544cdf
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016