563327.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::236  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request file-client-document.html Show response 563327.selcdn.ru/RFGTEYY16277368821EXCEL899/	409 KB 409 KB	205ms 100ms	Document text/html	2a00:ab00:0:12::236 SELECTEL
General Check archive.org Show headers Download Go to Full URL https://563327.selcdn.ru/RFGTEYY16277368821EXCEL899/file-client-document.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a00:ab00:0:12::236 , Russian Federation, ASN49505 (SELECTEL, RU), Reverse DNS Software / Resource Hash e26f26f6a0403eaebed8a891e704c1c48c50bb8bafcdd09027fdf685426a842e Request headers :method GET :authority 563327.selcdn.ru :scheme https :path /RFGTEYY16277368821EXCEL899/file-client-document.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers accept-ranges bytes access-control-allow-origin * access-control-expose-headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges content-length 418366 content-type text/html etag "06edd44d3baca98ddf0b4058a1d9426c" last-modified Tue, 13 Jul 2021 12:07:03 GMT x-timestamp 1626178022.76182 x-trans-id 1691584bbbd8c615 date Tue, 13 Jul 2021 12:13:29 GMT age 65854
GET H2	200	css2 fonts.googleapis.com/	2 KB 645 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@300&display=swap Requested by Host: 563327.selcdn.ru URL: https://563327.selcdn.ru/RFGTEYY16277368821EXCEL899/file-client-document.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash daa21724a6f9d8b57a3a1784c9820f9192be6dbb0caae81405605db3b5fd13ba Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://563327.selcdn.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 14 Jul 2021 05:30:01 GMT server ESF date Wed, 14 Jul 2021 06:31:03 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 14 Jul 2021 06:31:03 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 30 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: 563327.selcdn.ru URL: https://563327.selcdn.ru/RFGTEYY16277368821EXCEL899/file-client-document.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://563327.selcdn.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 14 Jul 2021 06:18:30 GMT content-encoding gzip x-content-type-options nosniff age 753 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 14 Jul 2022 06:18:30 GMT
GET H2	401	script.abexcel.js sparkly-synonymous-mongoose.glitch.me/	0 0	432ms 159ms	Script text/html	34.192.63.42 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://sparkly-synonymous-mongoose.glitch.me/script.abexcel.js Requested by Host: 563327.selcdn.ru URL: https://563327.selcdn.ru/RFGTEYY16277368821EXCEL899/file-client-document.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.192.63.42 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-192-63-42.compute-1.amazonaws.com Software / Resource Hash Request headers Referer https://563327.selcdn.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	pako%2Fjquery.min.js Show response firebasestorage.googleapis.com/v0/b/generalp-47b78.appspot.com/o/	66 B 769 B	1125ms 1104ms	Script application/x-javascript	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://firebasestorage.googleapis.com/v0/b/generalp-47b78.appspot.com/o/pako%2Fjquery.min.js?alt=media&token=dc40168d-9314-4fdb-9066-c22153619246 Requested by Host: 563327.selcdn.ru URL: https://563327.selcdn.ru/RFGTEYY16277368821EXCEL899/file-client-document.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 7955b3d88dc774b29c83d679accc8315035a73761c02fc82f35ac652abe18364 Request headers Referer https://563327.selcdn.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 14 Jul 2021 06:31:04 GMT x-guploader-uploadid ADPycdu-XgOXr6_ZmleSH4XkLgxqdmoeUl_3PidUjJtuefb_5xYea50jfR0qDWuTQzY9ctsyjvtgKcDORlv_vPoJ-ryf5Wq5tw x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename*=utf-8''jquery.min.js alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 66 last-modified Thu, 24 Jun 2021 00:11:58 GMT server UploadServer etag "326b0f955bf0d6464bfa99891cfb59d3" x-goog-hash crc32c=tK1KGQ==, md5=MmsPlVvw1kZL+pmJHPtZ0w== x-goog-generation 1624493518658122 cache-control private, max-age=0 x-goog-stored-content-length 66 x-goog-meta-firebasestoragedownloadtokens dc40168d-9314-4fdb-9066-c22153619246 accept-ranges bytes content-type application/x-javascript expires Wed, 14 Jul 2021 06:31:04 GMT
GET DATA	200 OK	truncated /	66 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7d79b3d7f292a0d7c24234b2d3e0de12bfc3cee7b4d3b44cb70f86f5259e578d Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	237 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 60955a587aeb2e8a007b4c90b2c8971c8eec6b43be390fc8afcf74fb0ea13e00 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4.woff2 fonts.gstatic.com/s/roboto/v27/	15 KB 15 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://563327.selcdn.ru Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Jul 2021 01:45:21 GMT x-content-type-options nosniff age 103542 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15732 x-xss-protection 0 last-modified Mon, 05 Apr 2021 21:10:39 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 13 Jul 2022 01:45:21 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| url string| hash string| hasherror string| email string| error

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

563327.selcdn.ru
ajax.googleapis.com
firebasestorage.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
sparkly-synonymous-mongoose.glitch.me
2a00:1450:4001:803::200a
2a00:1450:4001:809::2003
2a00:1450:4001:828::200a
2a00:1450:4001:82a::200a
2a00:ab00:0:12::236
34.192.63.42
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
60955a587aeb2e8a007b4c90b2c8971c8eec6b43be390fc8afcf74fb0ea13e00
7955b3d88dc774b29c83d679accc8315035a73761c02fc82f35ac652abe18364
7d79b3d7f292a0d7c24234b2d3e0de12bfc3cee7b4d3b44cb70f86f5259e578d
daa21724a6f9d8b57a3a1784c9820f9192be6dbb0caae81405605db3b5fd13ba
e26f26f6a0403eaebed8a891e704c1c48c50bb8bafcdd09027fdf685426a842e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d