xn--80ai0ang1db.xn--90ais Open in urlscan Pro Puny
тандыры.бел IDN
85.209.148.98  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request AdvancedWordonline.html Show response xn--80ai0ang1db.xn--90ais/	644 KB 377 KB	289ms 130ms	Document text/html	85.209.148.98 SUPPORTCHAIN-AS
General Check archive.org Show headers Download Go to Full URL http://xn--80ai0ang1db.xn--90ais/AdvancedWordonline.html Protocol HTTP/1.1 Server 85.209.148.98 Minsk, Belarus, ASN60591 (SUPPORTCHAIN-AS, BY), Reverse DNS 85.209.148.98.static.hostfly.by Software nginx / Resource Hash be5a8ab872324517c5a2d6c59ba3b8dfecb9b5901026c7a0895993d1959282c3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 accept-language is-IS,is;q=0.9 Response headers Cache-Control max-age=315360000 Connection keep-alive Content-Encoding gzip Content-Type text/html Date Wed, 04 Oct 2023 15:25:34 GMT ETag W/"646b91de-a10a4" Expires Thu, 31 Dec 2037 23:55:55 GMT Keep-Alive timeout=60 Last-Modified Mon, 22 May 2023 16:01:34 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	semantic.min.css cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.4.1/	614 KB 78 KB	398ms 103ms	Stylesheet text/css	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.4.1/semantic.min.css Requested by Host: xn--80ai0ang1db.xn--90ais URL: http://xn--80ai0ang1db.xn--90ais/AdvancedWordonline.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f666e439f561a3764f5df33b5bcb15d929ddac60ee87bc2ec8b8edb167932354 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language is-IS,is;q=0.9 Referer http://xn--80ai0ang1db.xn--90ais/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Wed, 04 Oct 2023 15:25:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1227088 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 79623 last-modified Mon, 04 May 2020 16:16:13 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fcd-99720" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AzOeNUHS1TqRwNmtSzhM0Vo1M%2FPo6GusxzkCxh%2Bw3wUuo2%2Bina1Y2EKm6IccGHjSwVtwQrgbVE5KiP6a499LD7K8pYntcB5oRR6HkRaF9Hn63IUk%2FxdR0O0qd0o3t4tHBgl7XLEL"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 810e70362cdd5cc7-KEF expires Mon, 23 Sep 2024 15:25:35 GMT
GET H2	200	css fonts.googleapis.com/	3 KB 995 B	356ms 105ms	Stylesheet text/css	142.250.185.170 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.4.1/semantic.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.170 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s51-in-f10.1e100.net Software ESF / Resource Hash 699e8cb3d0af7f12172315152a58cf8154526ddc2ee3d29ed8861218e9cf91a2 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language is-IS,is;q=0.9 Referer https://cdnjs.cloudflare.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 04 Oct 2023 15:25:35 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/ro cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 04 Oct 2023 13:43:57 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 04 Oct 2023 15:25:35 GMT
GET H2	200	Microsoft_Word-300x200.png itg.wfu.edu/wp-content/uploads/	5 KB 6 KB	569ms 170ms	Image image/png	192.81.210.70 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://itg.wfu.edu/wp-content/uploads/Microsoft_Word-300x200.png Requested by Host: xn--80ai0ang1db.xn--90ais URL: http://xn--80ai0ang1db.xn--90ais/AdvancedWordonline.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.81.210.70 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS wakeforest.reclaimhosting.com Software Apache / Resource Hash f9c530ca9fb0a8ca63c1bbe3b8f131b6f9aadeb3eeb0df53cdc4eb1c61acbb75 Request headers accept-language is-IS,is;q=0.9 Referer http://xn--80ai0ang1db.xn--90ais/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Wed, 04 Oct 2023 15:25:35 GMT last-modified Thu, 27 Aug 2020 17:03:35 GMT server Apache vary User-Agent content-type image/png cache-control max-age=31536000 accept-ranges bytes content-length 5492 expires Thu, 03 Oct 2024 15:25:35 GMT
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language is-IS,is;q=0.9 Referer http://xn--80ai0ang1db.xn--90ais/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	axios.min.js Show response cdn.jsdelivr.net/npm/axios/dist/	32 KB 13 KB	599ms 102ms	Script application/javascript	104.16.87.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js Requested by Host: xn--80ai0ang1db.xn--90ais URL: http://xn--80ai0ang1db.xn--90ais/AdvancedWordonline.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.87.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fd688b0ff9f17567ad22bf34a05ed17ee78750b9965418309c821eb3f55cc38f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language is-IS,is;q=0.9 Referer http://xn--80ai0ang1db.xn--90ais/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers date Wed, 04 Oct 2023 15:25:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 33574 x-jsd-version 1.5.1 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-etou8220107-FRA, cache-yyz4575-YYZ x-jsd-version-type version server cloudflare etag W/"7e51-T4rJbSBNkdaBUKcCugO26+F2VqU" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I2W%2BHxAoxrqBPe56X57f3rBllsBXkgVIqQgi4zY6ndz%2B8Cyagus%2BY8jM7vT5tGPKQgiiR5Hv57HMhUOujraxE897pEMF3Q8q5HFdrRqnFcjPlAp30ZdpeJ00E1zsdjyNBoA%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cf-ray 810e703abd755cbd-KEF
GET DATA	200 OK	truncated /	364 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 318e36178af3cbc9c9fceb6fce191d42483ec70c528b1c600e2c38c72a111637 Request headers accept-language is-IS,is;q=0.9 Referer http://xn--80ai0ang1db.xn--90ais/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| axios function| showLoadingOverlay function| hideLoadingOverlay function| showPasswordOverlay function| closexoverlay

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
fonts.googleapis.com
itg.wfu.edu
xn--80ai0ang1db.xn--90ais
104.16.87.20
104.17.24.14
142.250.185.170
192.81.210.70
85.209.148.98
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
318e36178af3cbc9c9fceb6fce191d42483ec70c528b1c600e2c38c72a111637
699e8cb3d0af7f12172315152a58cf8154526ddc2ee3d29ed8861218e9cf91a2
be5a8ab872324517c5a2d6c59ba3b8dfecb9b5901026c7a0895993d1959282c3
f666e439f561a3764f5df33b5bcb15d929ddac60ee87bc2ec8b8edb167932354
f9c530ca9fb0a8ca63c1bbe3b8f131b6f9aadeb3eeb0df53cdc4eb1c61acbb75
fd688b0ff9f17567ad22bf34a05ed17ee78750b9965418309c821eb3f55cc38f