a0540402.xsph.ru Open in urlscan Pro
141.8.192.169  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response a0540402.xsph.ru/ftp/office-new-RD85%202/	14 KB 4 KB	444ms 54ms	Document text/html	141.8.192.169 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol HTTP/1.1 Server 141.8.192.169 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS norn.from.sh Software openresty / Resource Hash 564d14ecad267ec7484fcb942ea9c5423edf0d8b20b2ea4eb254838c8f0d8fb6 Request headers Host a0540402.xsph.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent phishfarmer Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent phishfarmer Response headers Server openresty Date Wed, 12 May 2021 00:57:05 GMT Content-Type text/html Last-Modified Wed, 11 Nov 2020 21:37:34 GMT Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding ETag W/"5fac599e-3897" Expires Wed, 19 May 2021 00:57:05 GMT Cache-Control max-age=604800 Content-Encoding gzip
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:48:17 GMT content-encoding gzip x-content-type-options nosniff age 528 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 12 May 2022 00:48:17 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	29ms 10ms	Script application/javascript	2001:4de0:ac18::1:a:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding gzip last-modified Thu, 22 Sep 2016 22:32:34 GMT server nginx etag W/"57e45c02-152b5" vary Accept-Encoding x-hw 1620781025.dop208.fr8.t,1620781025.cds257.fr8.hn,1620781025.cds012.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H2	200	jquery-3.3.1.js Show response code.jquery.com/	265 KB 79 KB	28ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx etag W/"5a637bd4-42587" vary Accept-Encoding x-hw 1620781025.dop246.fr8.t,1620781025.cds257.fr8.hn,1620781025.cds165.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 80268
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 19 KB	55ms 37ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status MISS cdn-edgestorageid 601, 617, 617 access-control-allow-origin * cdn-cachedat 2021-05-11 20:29:50 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09ffacdf710000dfbf053d5000000001 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 48bcd885170c29740fea1badea1666ad cf-ray 64dfb0df193fdfbf-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	css fonts.googleapis.com/	226 B 315 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3e9d23bf800a6fabe5203075e76483c968a571472d102caf5a7b02aeb4276c77 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding gzip x-content-type-options nosniff server ESF x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400 cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Wed, 12 May 2021 00:57:05 GMT
GET H2	200	585b051251.js Show response kit.fontawesome.com/	11 KB 4 KB	56ms 38ms	Script text/javascript	2606:4700::6812:1734 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit.fontawesome.com/585b051251.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d840153f02ad6d91d652354e35b590721916d16c33956631eef0e7d3b5613ee Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding gzip vary origin, accept-encoding, access-control-request-headers, access-control-request-method cf-cache-status MISS strict-transport-security max-age=31536000; preload cf-request-id 09ffacdf720000c2d1830e2000000001 x-request-id Fn4rwU-KFLEWz2ToM-jh server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control max-age=60, public, must-revalidate cf-ray 64dfb0df1b20c2d1-FRA access-control-allow-headers accept, accept-langauge, content-language, content-type, fa-kit-token
GET H/1.1	200 OK	microsoft_logo.svg a0540402.xsph.ru/ftp/office-new-RD85%202/images/	4 KB 2 KB	42ms 39ms	Image image/svg+xml	141.8.192.169 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://a0540402.xsph.ru/ftp/office-new-RD85%202/images/microsoft_logo.svg Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol HTTP/1.1 Server 141.8.192.169 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS norn.from.sh Software openresty / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Pragma no-cache Accept-Encoding gzip, deflate Host a0540402.xsph.ru Accept-Language en-US User-Agent phishfarmer Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Connection keep-alive Cache-Control no-cache Referer http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html User-Agent phishfarmer Response headers Date Wed, 12 May 2021 00:57:05 GMT Content-Encoding gzip Last-Modified Thu, 23 Jan 2020 10:46:04 GMT Server openresty ETag W/"5e29796c-e43" Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Wed, 19 May 2021 00:57:05 GMT
GET H/1.1	200 OK	1280x284.jpg cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/19a146b5-9d30-4300-9aba-717411746436/	20 KB 21 KB	490ms 455ms	Image binary/octet-stream	2600:9000:2127:600:6:4afb:9140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/19a146b5-9d30-4300-9aba-717411746436/1280x284.jpg Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol HTTP/1.1 Server 2600:9000:2127:600:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 17cd37d788c6ee69b9b9a907de715a1cda04a9c5e64c2fa6fc065c1e375a08e8 Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers x-amz-server-side-encryption AES256 Date Wed, 12 May 2021 00:57:06 GMT Via 1.1 1f7383179aa19c47a962c46236696426.cloudfront.net (CloudFront) Last-Modified Wed, 11 Nov 2020 19:35:57 GMT Server AmazonS3 X-Amz-Cf-Pop PRG50-C1 ETag "91d416ca42a4b75a2e039e1800666598" X-Cache Miss from cloudfront x-amz-version-id .P9PpEQPQkHHYbtaKfEnGcHNgBJ9_IKH x-amz-replication-status COMPLETED Connection keep-alive Accept-Ranges bytes Content-Type binary/octet-stream Content-Length 20423 X-Amz-Cf-Id 3DbJcvMTepj4moY5VuEJZWmeIhNUNHFw6MEx3Vj9U8gVkokBiv_-pg==
GET H/1.1	200 OK	loading.gif a0540402.xsph.ru/ftp/office-new-RD85%202/images/	16 KB 16 KB	81ms 39ms	Image image/gif	141.8.192.169 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://a0540402.xsph.ru/ftp/office-new-RD85%202/images/loading.gif Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol HTTP/1.1 Server 141.8.192.169 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS norn.from.sh Software openresty / Resource Hash 90355719997bdae64237fba1548abd6a2eb0f4545baa1dd4488e3080af827db5 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host a0540402.xsph.ru Accept-Language en-US User-Agent phishfarmer Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Connection keep-alive Cache-Control no-cache Referer http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html User-Agent phishfarmer Response headers Date Wed, 12 May 2021 00:57:05 GMT Last-Modified Sat, 27 Jun 2020 22:50:56 GMT Server openresty ETag "5ef7cd50-3faf" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 16303 Expires Wed, 19 May 2021 00:57:05 GMT
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 23 KB	9ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-10fdd" vary Accept-Encoding x-hw 1620781025.dop246.fr8.t,1620781025.cds257.fr8.hn,1620781025.cds257.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	28ms 13ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 4334110 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6157 cf-request-id 09ffacdfb70000074a7932c000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=titbQmwDxsvfBuHEwBUNZAu23FoqXZ2taBtAWGThRqCV0%2BhTd0O8u%2Fy0EayYEMO%2Bf0oMJmLWLI9z5DRxkLS62xasON4Xfsu5ZUXzcCgqwz3DHPYxnknnQeMio5nCIrxeTA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 64dfb0df8a47074a-FRA expires Mon, 02 May 2022 00:57:05 GMT
GET H3-29	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 13 KB	28ms 17ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://a0540402.xsph.ru Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status MISS cdn-edgestorageid 601, 617, 617 access-control-allow-origin * cdn-cachedat 2021-05-11 19:35:21 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09ffacdfb400004aa908340000000001 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 0467ee25a1bbabe4687decb559c34a29 cf-ray 64dfb0df8c324aa9-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.3/css/	59 KB 13 KB	74ms 54ms	Fetch text/css	2606:4700:e0::ac40:6411 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.3/css/free.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:6411 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c2819ca1f7ad1af7ba53c4edfdfd395c547bcb16d29892a234d7860c689ed929 Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT via 1.1 4f71df838a8c9e7869c43cb74c6385e6.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG3-C2 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09ffacdfbd00004e4321a16000000001 last-modified Wed, 17 Mar 2021 02:23:57 GMT server cloudflare etag W/"390b4210e10c744c3c597500bcf0b31a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=quzXNz3O%2F4MZy82Wse4b9VVKzIpl71NOrGcCNc8QEfwDOpkzh2yrsME8G3UchpJlDcpZzaBp%2BprV01tlut%2FXccjN4TqtIEHAnyQbRmxlTKvRqhE9ZsTaW7YKSh4R1ynUbA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 64dfb0df9da84e43-FRA access-control-allow-headers fa-kit-token x-amz-cf-id 4eQD3prSCDPqFNitC2mx852u35NRk8ZsJiWfm3g317vU2TQ0qs8npA==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.3/css/	26 KB 5 KB	71ms 51ms	Fetch text/css	2606:4700:e0::ac40:6411 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.3/css/free-v4-shims.min.css?token=585b051251 Requested by Host: kit.fontawesome.com URL: https://kit.fontawesome.com/585b051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e0::ac40:6411 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 362daeaf1f7e05fee9a609e549f148aacbe518c166fbd96ead69057e295742af Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers date Wed, 12 May 2021 00:57:05 GMT via 1.1 af0a4579a75789980eb9374096ea1817.cloudfront.net (CloudFront) vary Accept-Encoding cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-amz-cf-pop CDG3-C2 x-cache Hit from cloudfront access-control-allow-methods GET content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 09ffacdfbd00004e43a5278000000001 last-modified Wed, 17 Mar 2021 02:23:57 GMT server cloudflare etag W/"8a99ce81ec2f89fbca03f2c8cf1a3679" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4dmFdQadmIRkGgl9Q%2Fk9G9ny0y2EXStr7SxmFlBTNW249k%2Br3fA%2BeKtc46fwt7e0eqHA7JJAFWvOGtn9nTOvh4egVrHY4b40lLB9mQf2hMrH27cnqc%2B%2ByBXj749H5Y5RTw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 64dfb0df9daa4e43-FRA access-control-allow-headers fa-kit-token x-amz-cf-id PuZd2L-BCskvvJFIcaYiL_PyO_7fjrBhI8Flsqe8FUJIy8tbNian_g==
GET H/1.1	200 OK	1920x1080.jpg cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/	17 KB 18 KB	457ms 424ms	Image binary/octet-stream	2600:9000:2127:600:6:4afb:9140:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/1920x1080.jpg Requested by Host: a0540402.xsph.ru URL: http://a0540402.xsph.ru/ftp/office-new-RD85%202/index.html Protocol HTTP/1.1 Server 2600:9000:2127:600:6:4afb:9140:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers Referer http://a0540402.xsph.ru/ User-Agent phishfarmer Response headers x-amz-server-side-encryption AES256 Date Wed, 12 May 2021 00:57:06 GMT Via 1.1 b9288402a0a891e0bbaca832ecabae61.cloudfront.net (CloudFront) Last-Modified Wed, 11 Nov 2020 19:33:28 GMT Server AmazonS3 X-Amz-Cf-Pop PRG50-C1 ETag "7916a894ebde7d29c2cc29b267f1299f" X-Cache Miss from cloudfront x-amz-version-id eHVz7ZLgeDWw84BSoa4oLZl1Bdh9eOS8 x-amz-replication-status COMPLETED Connection keep-alive Accept-Ranges bytes Content-Type binary/octet-stream Content-Length 17453 X-Amz-Cf-Id odHN_b_QqXnA0_RhDPxQMJxRNUmTAtbma7auOnpmT1ZglHAAUbfHLA==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a0540402.xsph.ru
ajax.googleapis.com
cdn.mcauto-images-production.sendgrid.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
141.8.192.169
2001:4de0:ac18::1:a:2b
2600:9000:2127:600:6:4afb:9140:93a1
2606:4700::6810:125e
2606:4700::6812:1734
2606:4700::6812:bcf
2606:4700:e0::ac40:6411
2a00:1450:4001:811::200a
2a00:1450:4001:82f::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
17cd37d788c6ee69b9b9a907de715a1cda04a9c5e64c2fa6fc065c1e375a08e8
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
362daeaf1f7e05fee9a609e549f148aacbe518c166fbd96ead69057e295742af
3e9d23bf800a6fabe5203075e76483c968a571472d102caf5a7b02aeb4276c77
564d14ecad267ec7484fcb942ea9c5423edf0d8b20b2ea4eb254838c8f0d8fb6
7d840153f02ad6d91d652354e35b590721916d16c33956631eef0e7d3b5613ee
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
90355719997bdae64237fba1548abd6a2eb0f4545baa1dd4488e3080af827db5
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c2819ca1f7ad1af7ba53c4edfdfd395c547bcb16d29892a234d7860c689ed929
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b