f0602368.xsph.ru Open in urlscan Pro
141.8.193.236  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://f0602368.xsph.ru/MailUpdateFresh/ Page URL
2. http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ f0602368.xsph.ru/MailUpdateFresh/	137 KB 36 KB	99ms 86ms	Document text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0602368.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server openresty Date Wed, 24 Nov 2021 04:19:22 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Sat, 19 Jun 2021 21:29:12 GMT ETag W/"22330-5c525219dba00" Content-Encoding gzip
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 25 KB	34ms 16ms	Stylesheet text/css	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602368.xsph.ru/ Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2532752 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19137-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b2fd6b75a355c7a-FRA
GET H2	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	41ms 24ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2330717 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 10480 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ze9Jlo8l4r1wydqj%2FAG5IeZau3OeeKvJzsnewvaPsHF7pJ22orXotCjfGIL2PZN%2B1z%2FTTl9wWP%2BjCxUOUkjA9CIspvzU4rKGEf8ZT%2BXF5bUtwFPFarIhd9LhZQeQDVKWW2NJBiDvpuq4D0viKciF8%2FIU"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b75ec31456-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H2	200	axios.min.js cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	28ms 16ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 555010 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4420 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1Uu8lf2cecW1MJIS7wei16b6b6tCOB3hPbw1pkGzsv%2Bqw06dapGHZ5%2BnQaH8L7EO8izFEKWn3dZboliiM0OJIrvyYhAYpJc7s7ABsuJABkP3R2ru7uFnkdJPJH5I1QH%2B2kkoshg0XknQo0wuCJXrurj"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b75ec41456-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H2	200	jquery.min.js cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	30ms 18ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 121532 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27938 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FVESpDhvCzPJKQKjcYZ723Q7dRIeBUl1f0t1xVpUusZTpC9SF0oNSuy6mjBTnjI6dyVXVruokXMEXzoIggQfRcXR8ygBmoSFDEC42j2K%2FKp8tvTmo1ZU9gsJuEpelbSUN%2F%2FL8wNilpoHuhnKccLM%2BESB"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b75ec61456-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H2	200	bootstrap.bundle.min.js cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 22 KB	35ms 22ms	Script application/javascript	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602368.xsph.ru/ Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2532752 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19181-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b2fd6b75a365c7a-FRA
GET H/1.1	404 Not Found	wallpaper.png f0602368.xsph.ru/MailUpdateFresh/	299 B 299 B	45ms 45ms	Image text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0602368.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/MailUpdateFresh/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 24 Nov 2021 04:19:23 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	25ms 15ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1050578 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 78196 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2fu0kiQ1N%2BCJEZmIniTE5U%2BvrhDgUsCePkGC4NWyJeFYYk75inD%2FIg8fUYN75z0Dl%2BkMhaZUivjqMY9Eu00yt2uO1ohKKJI4BpwwFRWZl6antWlGsfbcHG0hjFYSqoIljwPokjYqYiSNpgWuD4fySVSY"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b7aca2c2bd-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H/1.1	200 OK	Primary Request / Show response f0602368.xsph.ru/MailUpdateFresh/	137 KB 36 KB	91ms 85ms	Document text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash 173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/MailUpdateFresh/ Response headers Server openresty Date Wed, 24 Nov 2021 04:19:23 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Sat, 19 Jun 2021 21:29:12 GMT ETag W/"22330-5c525219dba00" Content-Encoding gzip
GET H3	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 25 KB	26ms 15ms	Stylesheet text/css	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602368.xsph.ru/ Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2532752 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19137-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b2fd6b8791d693d-FRA
GET H3	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	27ms 18ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2330717 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 10480 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MKkwy5p9kZxpuT7wkiDthBNs9dTZKtOh6pWaPU0iK2sM1YDjoPIHRKE7LWaWc1KB7yIyi0opmxgxzE5M5AC%2Br%2FKEj1cQO26oM1KV8PXGJQZ1TzlPwja8WdNnLdu7%2BVO8i1b3e%2BoMWcBsII3fdQM16j%2Ba"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b87c32c2f4-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H3	200	axios.min.js Show response cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	17ms 16ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 555010 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4420 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QJp5Yd8CIuXjuk781Lp1nUawpGDYkVP%2Fxy4VKCAHp%2Bvhdr1xEogDkwWHJjULqiyz30TjkKNXTK%2F7H6X6y2%2F7nxDV33QzbOFhgj5CMHNhCDqweRkvk7Ga3aA2PgZgyXVzCjcjDJzkmRZkji5j%2Fi1Fc6GN"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b89c3ec2f4-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H3	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	17ms 15ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 121532 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27938 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZkfEONgtnB4Dodjvi4pkUdmo5zcfwN8n9z%2FeG86NhKvYkiyp12gTcBr46nAj%2Fw8rTlBcKbEh63fZR6LZjFs%2BU0lgYK1Svl9aogg1QSLuhE2yKWXdd9cUSvkjnZhPTFkkS0lIfnrMdK9QZohUR6SMwFFH"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b89c41c2f4-FRA expires Mon, 14 Nov 2022 04:19:23 GMT
GET H3	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 22 KB	18ms 16ms	Script application/javascript	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602368.xsph.ru/ Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2532752 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19181-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b2fd6b8993a693d-FRA
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3 Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	wallpaper.png f0602368.xsph.ru/MailUpdateFresh/	299 B 299 B	54ms 53ms	Image text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0602368.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0602368.xsph.ru URL: http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash 2d76d7e19735a23a0642b84b777f21d5c18c0734df3a7a8a8870979bd8a8d1d5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602368.xsph.ru/MailUpdateFresh/?err=Y3SPO04VIZSGXR2S1DK&dispatch=B90&id=B9A7aB548B6A47cAA058263a319494 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Wed, 24 Nov 2021 04:19:23 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	21ms 20ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Origin http://f0602368.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 24 Nov 2021 04:19:23 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1050578 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 78196 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCCfKTECQiXmBGFHIaQcGnHi7Ox4E%2BFPoIShJVxX3BGKbdcVArP5B8t6CVfbHcDhswRbMPC7%2Fo9kGctOe1LhEf%2Bkm%2FeWRQZ88vGCJNuw3AMlWlfStS2hJbSYXLgge%2ByBLugCerQ7%2FESEqnZaWZd%2BjUXn"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b2fd6b8bd3bc2bd-FRA expires Mon, 14 Nov 2022 04:19:23 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| axios function| $ function| jQuery object| bootstrap function| sendMail function| validateEmail function| urlExists function| setNameAndFavicon function| randomString string| rString string| MAIL_URL string| AUTH_LOADING_MESSAGE string| FINAL_REDIRECT_URL number| retryAttemptCount

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://f0602368.xsph.ru/MailUpdateFresh/wallpaper.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://f0602368.xsph.ru/MailUpdateFresh/wallpaper.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
f0602368.xsph.ru
141.8.193.236
2606:4700::6810:135e
2606:4700::6810:5514
173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606
2d76d7e19735a23a0642b84b777f21d5c18c0734df3a7a8a8870979bd8a8d1d5
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e