www.khaoskollective.com Open in urlscan Pro
2606:4700:3032::ac43:dbf8  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request home.php Show response www.khaoskollective.com/wp-mail/	40 KB 19 KB	1216ms 1173ms	Document text/html	2606:4700:3032::ac43:dbf8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.khaoskollective.com/wp-mail/home.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::ac43:dbf8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce536fe4bbf3e673a2db865cfe689b960afd16b798b2b0527fc230c8ef7eaf0f Request headers :method GET :authority www.khaoskollective.com :scheme https :path /wp-mail/home.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 05 May 2021 20:55:51 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=de5b329f597c958f9f415e0cb4b27ba151620248150; expires=Fri, 04-Jun-21 20:55:50 GMT; path=/; domain=.khaoskollective.com; HttpOnly; SameSite=Lax vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 09dfe9d95900002c3e0c06b000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FL%2Fn4nc97nG9l2zk8neyw0gf9siTCFBcGcu5rfvhziutjCPbur%2FdyLFEFQEEvkYaNeKrobF3LtgdJdQ6%2BzkaJp8d0GFrw1V0KSrlajEhF%2BHT9brTFbx%2FqvlvCdFQqXnKaucOUA%3D%3D"}]} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 64acdf3bbeed2c3e-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	rocket-loader.min.js Show response ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 5 KB	35ms 18ms	Script application/javascript	2606:4700::6810:a823 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: www.khaoskollective.com URL: https://www.khaoskollective.com/wp-mail/home.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.khaoskollective.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 05 May 2021 20:55:51 GMT content-encoding gzip x-content-type-options nosniff nel {"max_age":604800,"report_to":"cf-nel"} vary Accept-Encoding cf-request-id 09dfe9de9a00004a67f11c3000000001 last-modified Fri, 30 Apr 2021 09:06:15 GMT server cloudflare x-frame-options DENY etag W/"608bc887-302c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dILClc12Z156tGcbg4pe01%2BfYaBmrLmTOxhoZA4NNTtAP%2FV8O4%2FyBuvhp3GcaexMNo9SPzrg4R7xGj4hT2wFOwMkDHsSWa%2FbjMddCEvFKSY7taovoaTZ7YhT15Exvhpz"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public cf-ray 64acdf4429d24a67-FRA expires Fri, 07 May 2021 20:55:51 GMT
GET DATA	200 OK	truncated /	20 KB 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 379765ab31aed2e0d3cdef473f0c2a3f0ee46391724fc7a8024e901c261cdcba Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type text/css
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| __cfQR boolean| __cfRLUnblockHandlers

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.khaoskollective.com/	1970-01-19 18:47:20	Name: __cfduid Value: de5b329f597c958f9f415e0cb4b27ba151620248150

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
www.khaoskollective.com
2606:4700:3032::ac43:dbf8
2606:4700::6810:a823
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
379765ab31aed2e0d3cdef473f0c2a3f0ee46391724fc7a8024e901c261cdcba
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ce536fe4bbf3e673a2db865cfe689b960afd16b798b2b0527fc230c8ef7eaf0f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b