stoog.xyz Open in urlscan Pro
198.12.252.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe
Effective URL:
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?servi...
Submission: On June 29 via api (June 29th 2020, 11:14:11 am UTC) from US

Summary HTTP 29 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 29 HTTP transactions. The main IP is 198.12.252.188, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is stoog.xyz.

This is the only time stoog.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 10	198.12.252.188 198.12.252.188	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
6	35.201.118.58 35.201.118.58	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE)
2 3	2606:4700::68... 2606:4700::6810:7caf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3031::6818:7a97	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
29	7

10 198.12.252.188 (Scottsdale, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-198-12-252-188.ip.secureserver.net

stoog.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.201.118.58 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 58.118.201.35.bc.googleusercontent.com

cdn.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7caf (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6818:7a97 (United States)

ASN13335 (CLOUDFLARENET, US)

jsonp.afeld.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	stoog.xyz 1 redirects stoog.xyz	45 KB
6	msauth.net logincdn.msauth.net	185 KB
6	jotfor.ms cdn.jotfor.ms	30 KB
3	unpkg.com 2 redirects unpkg.com	2 KB
2	googleapis.com ajax.googleapis.com	40 KB
1	afeld.me jsonp.afeld.me	11 KB
0	cors.io Failed cors.io Failed
0	outlook.com Failed outlook.com Failed
29	8

	Domain	Requested by
10	stoog.xyz	1 redirects stoog.xyz
6	logincdn.msauth.net	srcdoc
6	cdn.jotfor.ms	stoog.xyz
3	unpkg.com	2 redirects stoog.xyz
2	ajax.googleapis.com	stoog.xyz
1	jsonp.afeld.me	stoog.xyz
0	cors.io Failed	stoog.xyz
0	outlook.com Failed	stoog.xyz
29	8

This site contains no links.

Subject Issuer	Validity	Valid
jotform.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-22` - `2021-08-21`	2 years	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-06` - `2020-10-09`	6 months	crt.sh
prod-identitycdnsan.msauth.net Microsoft IT TLS CA 5	`2018-12-17` - `2020-12-17`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Frame ID: AAFBFAE3389C3C7CFF9D3A8BBDEB1007
Requests: 23 HTTP requests in this frame

Frame: https://outlook.com/
Frame ID: 907706D1B998FBBDF306AC8303C6C9BF
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe Page URL
http://stoog.xyz/tap/rcopy.php HTTP 302
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ... Page URL
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?logi... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

script /googleapis\.com\/.+webfont/i

Page Statistics

29
Requests

48 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

340 kB
Transfer

1089 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe Page URL
http://stoog.xyz/tap/rcopy.php HTTP 302
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D Page URL
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&. Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://stoog.xyz/tap/rcopy.php HTTP 302
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D

Request Chain 13

https://unpkg.com/@ungap/custom-elements-builtin HTTP 302
https://unpkg.com/@ungap/custom-elements-builtin@0.5.1 HTTP 302
https://unpkg.com/@ungap/custom-elements-builtin@0.5.1/min.js

29 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK lives.blm
stoog.xyz/tap/ 4 KB
5 KB 11346ms
11334ms Document
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Host: stoog.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:42 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

load.php
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/
Redirect Chain

http://stoog.xyz/tap/rcopy.php
http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D

5 KB
5 KB

174ms
169ms

Document
text/html

198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Host: stoog.xyz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
Origin: http://stoog.xyz
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe

Response headers

Date: Mon, 29 Jun 2020 11:13:54 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 29 Jun 2020 11:13:54 GMT
Server: Apache
Location: 22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/lives.blm?matta=jdoe%40outlook.com&name=JaneDoe
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

POST
H/1.1 200
OK Primary Request wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php Show response
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/ 32 KB
33 KB 168ms
168ms Document
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash: 9bb491172cb88fa810eeee1a2675177873ddedece07cb1dc9d45dcc9c25650a6

Request headers

Host: stoog.xyz
Connection: keep-alive
Content-Length: 36
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Origin: http://stoog.xyz
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
Origin: http://stoog.xyz
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/load.php?token=36amRvZUBvdXRsb29rLmNvbQ%3D%3D

Response headers

Date: Mon, 29 Jun 2020 11:13:54 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 formCss.css
cdn.jotfor.ms/static/ 65 KB
15 KB 152ms
119ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/static/formCss.css?3.3.16036
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 01f6029da64070c9410a3e4a379427c333582ba8bad192ef6a9760bab132b343

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:54 GMT
content-encoding: gzip
last-modified: Mon, 29 Jun 2020 09:01:14 GMT
server: nginx
etag: W/"5ef9adda-10252"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 nova.css
cdn.jotfor.ms/css/styles/ 18 KB
4 KB 154ms
122ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/styles/nova.css?3.3.16036
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 945f66eb33c4ae23d0edffd13d6d488ec54ae166e971dd3a426967a86f64ac9f

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:54 GMT
content-encoding: gzip
last-modified: Fri, 22 May 2020 14:59:40 GMT
server: nginx
etag: W/"5ec7e8dc-4638"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 566a91c2977cdfcd478b4567.css
cdn.jotfor.ms/themes/CSS/ 13 KB
3 KB 163ms
131ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/themes/CSS/566a91c2977cdfcd478b4567.css?
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 437a6ee83a47f647d9c72da6e9faee9123677013e05bacfbed0f76b8471d9f23

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:54 GMT
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 07:10:01 GMT
server: nginx
etag: W/"69a9d6c0f9a77f19db6d25e5183912c4"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
status: 200
cache-control: no-cache
x-form-cache: MISS-APP
alt-svc: clear
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.4.2/ 18 KB
7 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/webfont/1.4.2/webfont.js

Requested by

Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.

Protocol

HTTP/1.1

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52ed15904751d037ad3a0835c1df150485c6d1b815355bbad1ccad6fda5f4e9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 11 Jun 2020 20:41:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Server: sffe
Age: 1521125
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 6918
X-XSS-Protection: 0
Expires: Fri, 11 Jun 2021 20:41:49 GMT

GET
H2 200 printForm.css
cdn.jotfor.ms/css/ 456 B
565 B 119ms
119ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/printForm.css?3.3.16036
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b23b22d37aabecfaf4922f97f2b1fa93da87fd0a284624f7f8fa00bf40b37cb7

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:55 GMT
via: 1.1 google
last-modified: Thu, 16 May 2019 07:50:58 GMT
server: nginx
etag: "5cdd1662-1c8"
content-type: text/css
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
alt-svc: clear
content-length: 456
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.1/ 94 KB
33 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js

Requested by

Protocol

HTTP/1.1

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 10 Jun 2020 18:07:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Server: sffe
Age: 1616770
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 33434
X-XSS-Protection: 0
Expires: Thu, 10 Jun 2021 18:07:44 GMT

GET
H/1.1 404
Not Found flyoutmenu.css
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/ 0
0 136ms
131ms Stylesheet
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/flyoutmenu.css?1001088
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:54 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found flyoutmenu.js
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/ 0
0 245ms
229ms Script
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/flyoutmenu.js?1001088
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:55 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found global.css
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/css/ 0
0 138ms
133ms Stylesheet
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/css/global.css?1001088
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:54 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2

200

min.js Show response
unpkg.com/@ungap/custom-elements-builtin@0.5.1/
Redirect Chain

https://unpkg.com/@ungap/custom-elements-builtin
https://unpkg.com/@ungap/custom-elements-builtin@0.5.1
https://unpkg.com/@ungap/custom-elements-builtin@0.5.1/min.js

3 KB
1 KB

15ms
14ms

Script
application/javascript

2606:4700::6810:7caf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/@ungap/custom-elements-builtin@0.5.1/min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a95733f6fc462f46f06765a36bf83cc043e4af8b8cc1e26eaaeed6247c83cb99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4598327
status: 200
vary: Accept-Encoding
cf-request-id: 03a161ad080000d6b5c3a20200000001
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"b6d-AeFZtjpxREOqaOO/jTgzm5mpGIo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 2c5e9881f461bf785ed7f55d91d570d7
cache-control: public, max-age=31536000
cf-ray: 5aaf388e796fd6b5-FRA

Redirect headers

date: Mon, 29 Jun 2020 11:13:54 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4598328
status: 302
vary: Accept, Accept-Encoding
content-length: 66
cf-request-id: 03a161acf80000d6b5c3a1f200000001
access-control-allow-origin: *
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/plain; charset=utf-8
location: /@ungap/custom-elements-builtin@0.5.1/min.js
x-cloud-trace-context: e7dd3215d29d51d53690073687a10ad0
cache-control: public, max-age=31536000
cf-ray: 5aaf388e5927d6b5-FRA

GET
H/1.1 200
OK x-frame-bypass.js Show response
stoog.xyz/tap/engine/ 3 KB
3 KB 233ms
217ms Script
application/javascript 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/engine/x-frame-bypass.js
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash: 45395e2c0a7c04a5207154f41e9d0284ea08649d310a20001eaf1c274eebf4e5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Origin: http://stoog.xyz

Response headers

Date: Mon, 29 Jun 2020 11:13:55 GMT
Last-Modified: Fri, 08 May 2020 00:14:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2578

GET
H2 200 appointmentSlots.css
cdn.jotfor.ms/css/styles/ 19 KB
5 KB 117ms
116ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/styles/appointmentSlots.css?v=0.13
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5a1a32e8c7bb8e3cb1b65d0200e1ca70867205f4ff836bae85c8e7c72d8207dd

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:55 GMT
content-encoding: gzip
last-modified: Thu, 07 May 2020 11:22:50 GMT
server: nginx
etag: W/"5eb3ef8a-4de8"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 control_inline.css
cdn.jotfor.ms/css/styles/control_inline/ 15 KB
3 KB 119ms
119ms Stylesheet
text/css 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/css/styles/control_inline/control_inline.css?v=0.2
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e4059bfda9aba1280bb3617a073b004d443b54c0d454a770c07d24642d05ad71

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:55 GMT
content-encoding: gzip
last-modified: Fri, 26 Jun 2020 12:15:24 GMT
server: nginx
etag: W/"5ef5e6dc-3a40"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=315360000, public
alt-svc: clear
via: 1.1 google
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 404
Not Found flyoutmenu.css
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/ 0
0 130ms
129ms Stylesheet
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/js/flyoutmenu.css?1001088
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:55 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found global.css
stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/css/ 0
0 127ms
127ms Stylesheet
text/html 198.12.252.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/resources/css/global.css?1001088
Requested by: Host: stoog.xyz
URL: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Protocol: HTTP/1.1
Server: 198.12.252.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-198-12-252-188.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 29 Jun 2020 11:13:55 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET /
outlook.com/ Frame 9077 0
0

GET
DATA 200
OK truncated
/ 524 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 687adc0690972d7a13233f7778bd0afefb70a0e947ac509ab2530dcf15bed8a6

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/jpeg

GET /
cors.io/ 0
0

GET
H2 200 / Show response
jsonp.afeld.me/ 26 KB
11 KB 1710ms
1659ms Fetch
text/html 2606:4700:3031::6818:7a97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonp.afeld.me/?url=https://outlook.com/

Requested by

Host: stoog.xyz
URL: http://stoog.xyz/tap/engine/x-frame-bypass.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6818:7a97 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

372def6275ecc3f1eaa1e576ed8bfb144d0e5bcfbfbdc67c3a14f53aee2cea73

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
status: 200
ppserver: PPV: 30 H: BL02PFC3A5D6235 V: 0
vary: Accept-Encoding
cf-request-id: 03a161b03d00000eab17369200000001
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; preload
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 45686264-2944-4714-b80f-5ddb1dc73e80
x-xss-protection: 1; mode=block
cache-control: max-age=0, no-store
cf-ray: 5aaf38939ac80eab-FRA
expires: Mon, 29 Jun 2020 11:12:57 GMT

GET
H2 200 Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
logincdn.msauth.net/16.000/ Frame 9077 100 KB
19 KB 93ms
14ms Stylesheet
text/css 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8B5F) /
Resource Hash: d179c70c12064a59664bb3d190a795bc403cc080d75996d101388c4e0def5111

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: F0lM8qy9eFFAob7kW+meJw==
age: 5095973
x-cache: HIT
status: 200
content-length: 18851
x-ms-lease-status: unlocked
last-modified: Wed, 29 Apr 2020 05:59:31 GMT
server: ECAcc (ama/8B5F)
etag: 0x8D7EC027C236F84
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 3cc1b286-d01e-0006-7fad-1f3844000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLoginPaginatedStrings.en_SfTn_o5yPShrIvTOaHpsKA2.js Show response
logincdn.msauth.net/16.000/content/js/ Frame 9077 29 KB
8 KB 101ms
25ms Script
application/x-javascript 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_SfTn_o5yPShrIvTOaHpsKA2.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8D42) /
Resource Hash: 86270181d742facf81336c20c21474a62232741abea86fbf340bcc98acc67473

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Origin: http://stoog.xyz

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: 50h4Ikp4Po+tMbG8dkIc8g==
age: 2033378
x-cache: HIT
status: 200
content-length: 7701
x-ms-lease-status: unlocked
last-modified: Wed, 03 Jun 2020 05:38:23 GMT
server: ECAcc (lha/8D42)
etag: 0x8D8078054DC2458
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: fca9464e-e01e-001e-3788-3ba043000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 OldConvergedLogin_PCore_XnMpJER9TCIsc_7zSwNN8A2.js Show response
logincdn.msauth.net/16.000/content/js/ Frame 9077 592 KB
151 KB 26ms
25ms Script
application/x-javascript 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_XnMpJER9TCIsc_7zSwNN8A2.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8D4C) /
Resource Hash: 61002f10099b1c97d57c3cb725897d5e20d6a839f0d80afeae7dccd0e4b1bb4b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Origin: http://stoog.xyz

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: eeESN0fBewkSgJQdMfVA9g==
age: 2033378
x-cache: HIT
status: 200
content-length: 154489
x-ms-lease-status: unlocked
last-modified: Wed, 03 Jun 2020 05:44:41 GMT
server: ECAcc (lha/8D4C)
etag: 0x8D80781361033BC
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c8ecf196-601e-001d-7d88-3b5323000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 oldconvergedlogin_palt_XaVBd2pZC0M2b_3FFebCMw2.js Show response
logincdn.msauth.net/16.000/content/js/ Frame 9077 16 KB
5 KB 26ms
26ms Script
application/x-javascript 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://logincdn.msauth.net/16.000/content/js/oldconvergedlogin_palt_XaVBd2pZC0M2b_3FFebCMw2.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lha/8C9F) /
Resource Hash: a88d83a80464a3a39448caae708b56dd1bca8d4c7c3b1fb6af47b3ad045e8411

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
Origin: http://stoog.xyz

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: 7/KXj8Al7sJucTUzqH4BGA==
age: 1789435
x-cache: HIT
status: 200
content-length: 5046
x-ms-lease-status: unlocked
last-modified: Wed, 03 Jun 2020 05:44:41 GMT
server: ECAcc (lha/8C9F)
etag: 0x8D8078135F6DAC8
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 55332492-d01e-008a-0ac0-3d0c82000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/16.000.28647.18/content/images/backgrounds/ Frame 9077 2 KB
836 B 15ms
14ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/16.000.28647.18/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8B08) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
age: 412328
x-cache: HIT
status: 200
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 24 Jun 2020 03:15:47 GMT
server: ECAcc (ama/8B08)
etag: 0x8D817ECE3F86728
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c63f0f7c-101e-0007-1246-4ac649000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/16.000.28647.18/content/images/ Frame 9077 4 KB
2 KB 15ms
14ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/16.000.28647.18/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8ADE) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: http://stoog.xyz/tap/22e76f8092ea9a1516f799f1e4daa955/wjp6vqnj3zsfcz6nvc9e2mqwhbb0tt.php?login=jdoe&.verify?service=fav=1&mail&data:text/html;charset=utf-8;base64,PGh0bWw+DgPC9zdHlsZT4NCiAgPGlmcmFt=jdoe&loginID=jdoe&.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 29 Jun 2020 11:13:57 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 412389
x-cache: HIT
status: 200
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Wed, 24 Jun 2020 03:15:53 GMT
server: ECAcc (ama/8ADE)
etag: 0x8D817ECE7761F78
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 69c24426-e01e-007a-4446-4ac91c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: outlook.com
URL: https://outlook.com/

Domain: cors.io
URL: https://cors.io/?https://outlook.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://stoog.xyz/tap/engine/x-frame-bypass.js(Line 13) Message: X-Frame-Bypass loading: https://outlook.com/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jotfor.ms
cors.io
jsonp.afeld.me
logincdn.msauth.net
outlook.com
stoog.xyz
unpkg.com
cors.io
outlook.com
192.229.221.185
198.12.252.188
2606:4700:3031::6818:7a97
2606:4700::6810:7caf
2a00:1450:4001:816::200a
35.201.118.58
01f6029da64070c9410a3e4a379427c333582ba8bad192ef6a9760bab132b343
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
072fa779cf0ad5c10e6e58e190b683c3ed1926c6da302d23eb67e8208bb9ade1
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
372def6275ecc3f1eaa1e576ed8bfb144d0e5bcfbfbdc67c3a14f53aee2cea73
437a6ee83a47f647d9c72da6e9faee9123677013e05bacfbed0f76b8471d9f23
45395e2c0a7c04a5207154f41e9d0284ea08649d310a20001eaf1c274eebf4e5
52ed15904751d037ad3a0835c1df150485c6d1b815355bbad1ccad6fda5f4e9b
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
547fbb68bdd598424ab64cdc9c65c6c448dcf97cc656582b09a20f4541488d1b
5a1a32e8c7bb8e3cb1b65d0200e1ca70867205f4ff836bae85c8e7c72d8207dd
61002f10099b1c97d57c3cb725897d5e20d6a839f0d80afeae7dccd0e4b1bb4b
687adc0690972d7a13233f7778bd0afefb70a0e947ac509ab2530dcf15bed8a6
86270181d742facf81336c20c21474a62232741abea86fbf340bcc98acc67473
945f66eb33c4ae23d0edffd13d6d488ec54ae166e971dd3a426967a86f64ac9f
9bb491172cb88fa810eeee1a2675177873ddedece07cb1dc9d45dcc9c25650a6
a88d83a80464a3a39448caae708b56dd1bca8d4c7c3b1fb6af47b3ad045e8411
a95733f6fc462f46f06765a36bf83cc043e4af8b8cc1e26eaaeed6247c83cb99
b23b22d37aabecfaf4922f97f2b1fa93da87fd0a284624f7f8fa00bf40b37cb7
d179c70c12064a59664bb3d190a795bc403cc080d75996d101388c4e0def5111
e4059bfda9aba1280bb3617a073b004d443b54c0d454a770c07d24642d05ad71

stoog.xyz Open in urlscan Pro 198.12.252.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

48 %HTTPS

50 %IPv6

8 Domains

8 Subdomains

7 IPs

3 Countries

340 kBTransfer

1089 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

stoog.xyz Open in urlscan Pro
198.12.252.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

48 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

340 kB
Transfer

1089 kB
Size

0
Cookies

29 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!