splodtestyou.bid Open in urlscan Pro
37.9.56.7  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index2.htm Show response splodtestyou.bid/docc/19660b3f8a696104bdf780845c829c0b/	206 KB 206 KB	72ms 22ms	Document text/html	37.9.56.7 UKSERVERS-AS UK D...
General Check archive.org Show headers Download Go to Full URL https://splodtestyou.bid/docc/19660b3f8a696104bdf780845c829c0b/index2.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 37.9.56.7 , United Kingdom, ASN42831 (UKSERVERS-AS UK Dedicated Servers, Hosting and Co-Location, GB), Reverse DNS hosted-by.enoctus.com Software Apache / Resource Hash 48b2204223fd99f48c6efc0776bbaed5b679fdddb3820772f543f12056084b0d Request headers Pragma no-cache Accept-Encoding gzip, deflate Host splodtestyou.bid Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Mon, 27 Nov 2017 13:04:12 GMT Last-Modified Mon, 27 Nov 2017 07:58:13 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 211203
GET H2	200	ath5djs.js Show response use.typekit.net/	17 KB 7 KB	22ms 7ms	Script text/javascript	92.123.94.15 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/ath5djs.js Requested by Host: splodtestyou.bid URL: https://splodtestyou.bid/docc/19660b3f8a696104bdf780845c829c0b/index2.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.123.94.15 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a92-123-94-15.deploy.akamaitechnologies.com Software nginx / Resource Hash aff6ac450a8e86f7bd779e8ff090dd3b270afc3dcde456561ffa6b1fd13c19e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers :path /ath5djs.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 accept */* cache-control no-cache :authority use.typekit.net referer https://splodtestyou.bid/docc/19660b3f8a696104bdf780845c829c0b/index2.htm :scheme https :method GET Referer https://splodtestyou.bid/docc/19660b3f8a696104bdf780845c829c0b/index2.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip server nginx status 200 200 OK date Mon, 27 Nov 2017 13:04:13 GMT vary Accept-Encoding content-type text/javascript;charset=utf-8 access-control-allow-origin * cache-control public, max-age=600, stale-while-revalidate=604800 timing-allow-origin * content-length 7033
GET DATA	200 OK	truncated /	36 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d4d7467a56ebdf0abdff0bf413f070c236abe05f480147571a329438e28b799d Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Typekit string| special_day_char function| css_browser_selector function| Visitor function| AppMeasurement function| s_gi function| s_pgicq number| CSSBS number| CSSBS_webkit number| CSSBS_chrome number| CSSBS_mac number| CSSBS_js number| CSSBS_portrait object| html5 object| Modernizr function| yepnope number| s_objectID number| s_giq object| adobeid_only_domains

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://use.typekit.net/ath5djs.js(Line 33) Message: Typekit: the domain "splodtestyou.bid" isn't in the list of published domains for kit "ath5djs".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

splodtestyou.bid
use.typekit.net
37.9.56.7
92.123.94.15
48b2204223fd99f48c6efc0776bbaed5b679fdddb3820772f543f12056084b0d
aff6ac450a8e86f7bd779e8ff090dd3b270afc3dcde456561ffa6b1fd13c19e2
d4d7467a56ebdf0abdff0bf413f070c236abe05f480147571a329438e28b799d