urlscan.io logo urlscan.io
SecurityTrails logo

rthfsmeheff.ganduzaghyt.com Open in urlscan Pro
5.253.247.215  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://weda.member365.com/ecommunication/api/click/V1EaB7MEUaXFULf4jfJz1g/-7_OD-5-xiwzyPtHi15TsA?r=https%3A%2F%2Fmannatgoc...
Effective URL: https://rthfsmeheff.ganduzaghyt.com/ga
Submission: On May 09 via manual from SG — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 4 countries across 9 domains to perform 11 HTTP transactions. The main IP is 5.253.247.215, located in Frankfurt am Main, Germany and belongs to ITP-SOLUTIONS, DE. The main domain is rthfsmeheff.ganduzaghyt.com.
TLS certificate: Issued by R3 on May 6th 2024. Valid for: 3 months.
This is the only time rthfsmeheff.ganduzaghyt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 100.20.170.90 16509 (AMAZON-02)
1 209.124.66.28 55293 (A2HOSTING)
1 2 103.253.43.4 133398 (TELE-AS T...)
2 5.253.247.215 213250 (ITP-SOLUT...)
1 2 104.17.3.184 13335 (CLOUDFLAR...)
2 151.101.1.229 54113 (FASTLY)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 1 108.157.254.78 16509 (AMAZON-02)
1 13.33.88.43 16509 (AMAZON-02)
1 185.199.110.133 54113 (FASTLY)
1 104.17.2.184 13335 (CLOUDFLAR...)
11 9
1    100.20.170.90 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-20-170-90.us-west-2.compute.amazonaws.com
weda.member365.com
1    209.124.66.28 (United States)

ASN55293 (A2HOSTING, US)
PTR: nl1-tr1.supercp.com
mannatgoc.com
2    103.253.43.4 (Hong Kong)

ASN133398 (TELE-AS Tele Asia Limited, HK)
PTR: slot9.ge-re.com
avestored.roboadtech.com
2    5.253.247.215 (Frankfurt am Main, Germany)

ASN213250 (ITP-SOLUTIONS, DE)
PTR: 215.247.253.5.in-addr.arpa
rthfsmeheff.ganduzaghyt.com
2    104.17.3.184 (None, )

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
2    151.101.1.229 (San Francisco, United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    108.157.254.78 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-254-78.sin2.r.cloudfront.net
findicons.com
1    13.33.88.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-88-43.sin2.r.cloudfront.net
images.freeimages.com
1    185.199.110.133 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-110-133.github.com
gist.githubusercontent.com
1    104.17.2.184 (None, )

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
Apex Domain
Subdomains		 Transfer
4 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 4500
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
22 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
35 KB
2 ganduzaghyt.com
rthfsmeheff.ganduzaghyt.com
23 KB
2 roboadtech.com
avestored.roboadtech.com
770 B
1 githubusercontent.com
gist.githubusercontent.com — Cisco Umbrella Rank: 57824
15 KB
1 freeimages.com
images.freeimages.com — Cisco Umbrella Rank: 169385
768 B
1 findicons.com
findicons.com — Cisco Umbrella Rank: 643183
304 B
1 mannatgoc.com
mannatgoc.com
2 KB
1 member365.com
weda.member365.com
745 B
11 9
Domain Requested by
3 challenges.cloudflare.com 1 redirects rthfsmeheff.ganduzaghyt.com
challenges.cloudflare.com
2 cdn.jsdelivr.net rthfsmeheff.ganduzaghyt.com
2 rthfsmeheff.ganduzaghyt.com
2 avestored.roboadtech.com 1 redirects mannatgoc.com
1 gist.githubusercontent.com rthfsmeheff.ganduzaghyt.com
1 images.freeimages.com rthfsmeheff.ganduzaghyt.com
1 findicons.com 1 redirects
1 cdnjs.cloudflare.com rthfsmeheff.ganduzaghyt.com
1 mannatgoc.com
1 weda.member365.com 1 redirects
11 10

This site contains no links.

Subject Issuer Validity Valid
mail.mannatgoc.com
R3		 2024-04-20 -
2024-07-19		 3 months crt.sh
avestored.roboadtech.com
R3		 2024-05-06 -
2024-08-04		 3 months crt.sh
ganduzaghyt.com
R3		 2024-05-06 -
2024-08-04		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
*.github.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-03-15 -
2025-03-14		 a year crt.sh
challenges.cloudflare.com
Cloudflare Inc ECC CA-3		 2023-08-18 -
2024-08-17		 a year crt.sh

This page contains 2 frames:

Primary Page: https://rthfsmeheff.ganduzaghyt.com/ga
Frame ID: 8C0608AA4C44C65C16A490BAF23C4175
Requests: 10 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/w5zhe/0x4AAAAAAAZSl_DomMDqQm9V/auto/normal
Frame ID: 9F266D0092C14D0A77E810240BCB0517
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outløøk

Page URL History Show full URLs

  1. https://weda.member365.com/ecommunication/api/click/V1EaB7MEUaXFULf4jfJz1g/-7_OD-5-xiwzyPtHi15TsA?r=htt... HTTP 307
    https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== Page URL
  2. https://avestored.roboadtech.com/.cgi/app/YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== Page URL
  3. https://avestored.roboadtech.com/index.php?continue2 HTTP 302
    https://rthfsmeheff.ganduzaghyt.com/ga Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

9
Domains

10
Subdomains

9
IPs

4
Countries

97 kB
Transfer

231 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://weda.member365.com/ecommunication/api/click/V1EaB7MEUaXFULf4jfJz1g/-7_OD-5-xiwzyPtHi15TsA?r=https%3A%2F%2Fmannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== HTTP 307
    https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== Page URL
  2. https://avestored.roboadtech.com/.cgi/app/YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== Page URL
  3. https://avestored.roboadtech.com/index.php?continue2 HTTP 302
    https://rthfsmeheff.ganduzaghyt.com/ga Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://weda.member365.com/ecommunication/api/click/V1EaB7MEUaXFULf4jfJz1g/-7_OD-5-xiwzyPtHi15TsA?r=https%3A%2F%2Fmannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ== HTTP 307
  • https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
Request Chain 2
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js
Request Chain 6
  • https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png HTTP 301
  • https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
mannatgoc.com/.tmp/
Redirect Chain
  • https://weda.member365.com/ecommunication/api/click/V1EaB7MEUaXFULf4jfJz1g/-7_OD-5-xiwzyPtHi15TsA?r=https%3A%2F%2Fmannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
  • https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
209.124.66.28 , United States, ASN55293 (A2HOSTING, US),
Reverse DNS
nl1-tr1.supercp.com
Software
LiteSpeed / PHP/8.1.28
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
1361
content-type
text/html; charset=UTF-8
date
Thu, 09 May 2024 03:14:43 GMT
server
LiteSpeed
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-powered-by
PHP/8.1.28

Redirect headers

Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 09 May 2024 03:14:41 GMT
Location
https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
Server
Apache
YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
avestored.roboadtech.com/.cgi/app/ 		1 KB
674 B 		Document
General
Check archive.org
Download Go to
Full URL
https://avestored.roboadtech.com/.cgi/app/YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
Requested by
Host: mannatgoc.com
URL: https://mannatgoc.com/.tmp/___R23S___YWRpdHlhbmFyc2FyaWFAZGJzLmNvbQ==
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash
c9a141601e7f3ec61c7160b5cb977504eb406b784d09bad4b0954a5cf106a8b0

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
https://mannatgoc.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-length
576
content-type
text/html; charset=UTF-8
date
Thu, 09 May 2024 03:14:44 GMT
server
Apache
vary
Accept-Encoding
Primary Request ga
rthfsmeheff.ganduzaghyt.com/
Redirect Chain
  • https://avestored.roboadtech.com/index.php?continue2
  • https://rthfsmeheff.ganduzaghyt.com/ga
21 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.253.247.215 Frankfurt am Main, Germany, ASN213250 (ITP-SOLUTIONS, DE),
Reverse DNS
215.247.253.5.in-addr.arpa
Software
/
Resource Hash
9ffc6161cbaee504eaf3ccfb4f365d0bab6bba739f9cd2fce983b1c7d7d63c96
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; frame-src 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; style-src * data: blob: filesystem: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Content-Type
application/x-www-form-urlencoded
Origin
https://avestored.roboadtech.com
Referer
https://avestored.roboadtech.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Credentials
true
Cache-Control
no-cache="Set-Cookie"
Content-Security-Policy
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; frame-src 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; style-src * data: blob: filesystem: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Content-Type
text/html
Cross-Origin-Resource-Policy
cross-origin
Date
Thu, 09 May 2024 03:14:56 GMT
Transfer-Encoding
chunked

Redirect headers

content-encoding
gzip
content-length
561
content-type
text/html; charset=UTF-8
date
Thu, 09 May 2024 03:14:46 GMT
location
https://rthfsmeheff.ganduzaghyt.com/ga#adityanarsaria@dbs.com
server
Apache
vary
Accept-Encoding
api.js
challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
  • https://challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js
42 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Server
104.17.3.184 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49a5abedf03eb8ad9a66eca7c5ccb8e59a440e06958e1e7b71d078f494178dc5

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
https://rthfsmeheff.ganduzaghyt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Thu, 09 May 2024 03:14:56 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=604800, public
cross-origin-resource-policy
cross-origin
cf-ray
880e85b07aa46bbd-SIN
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Thu, 09 May 2024 03:14:56 GMT
server
cloudflare
vary
Accept-Encoding
location
/turnstile/v0/b/ce7818f50e39/api.js
access-control-allow-origin
*
cache-control
max-age=300, public
cross-origin-resource-policy
cross-origin
cf-ray
880e85b00a2d6bbd-SIN
alt-svc
h3=":443"; ma=86400
content-length
0
localforage.js
cdn.jsdelivr.net/gh/mozilla/localForage@master/dist/ 		92 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/mozilla/localForage@master/dist/localforage.js
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e9f100dee1745c2b62b08705672e474d3e7c5e871763b2d7ec951f1222ba5b96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rthfsmeheff.ganduzaghyt.com/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 09 May 2024 03:14:56 GMT
x-content-type-options
nosniff
content-encoding
br
age
17635
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
21508
x-served-by
cache-fra-etou8220159-FRA, cache-qpg120111-QPG
x-jsd-version-type
branch
etag
W/"16e36-67PBRT1jcuHzNe8PbwW184wBAY4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
opfs.min.js
cdn.jsdelivr.net/gh/Joe12387/op-fingerprinting-script@main/ 		41 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/Joe12387/op-fingerprinting-script@main/opfs.min.js
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8aca978ef4c7d58d146e93ec9f3502f829a2ac00274d5a229995e5ef0ec3c988
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rthfsmeheff.ganduzaghyt.com/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 09 May 2024 03:14:57 GMT
x-content-type-options
nosniff
content-encoding
br
age
0
x-jsd-version
main
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
13238
x-served-by
cache-fra-etou8220128-FRA, cache-qpg120111-QPG
x-jsd-version-type
branch
etag
W/"a2fa-fvIVjM9ZuDY51nvBztAuZsjps1s"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
ua-parser.min.js
cdnjs.cloudflare.com/ajax/libs/UAParser.js/1.0.37/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/UAParser.js/1.0.37/ua-parser.min.js
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7284cae968813b965f10bcbc74bfc833b54c3ccce37a99c674e00e4a6d71e7
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rthfsmeheff.ganduzaghyt.com/
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 09 May 2024 03:14:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
547357
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6948
last-modified
Sat, 28 Oct 2023 03:30:46 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"653c8066-1b24"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nH%2FXshZvq5RQwlfSriMToFYvW3FCcpV6XO2CNbe20BV8zutbu3%2F7MCDABcd5%2BtkxHH9oh6%2F7kla%2BCk9E6EQSD%2FHauJFVHUFeijB8XGaAFNJJmbyNrOlVTGEMmYsfJFtrDOiyngB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
880e85affb4281ba-SIN
expires
Tue, 29 Apr 2025 03:14:56 GMT
microsoft_new_logo_alt.png
images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/
Redirect Chain
  • https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png
  • https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
254 B
768 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Server
13.33.88.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-88-43.sin2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
https://rthfsmeheff.ganduzaghyt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date
Mon, 22 Apr 2024 15:32:42 GMT
via
1.1 f6a003d0ac39dd4960506f9ca113dde8.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
SIN2-P2
age
1424535
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
254
x-xss-protection
1; mode=block
referrer-policy
origin
last-modified
Tue, 20 Dec 2022 05:17:19 GMT
server
AmazonS3
etag
"57ab754695eb0a2c74201ecd6948c12f"
x-frame-options
DENY
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
8py1tSst0uc3cWgxubWpfurV_6qdeRszjppKUlTon_ciz9eq1TZavA==

Redirect headers

date
Sun, 14 Apr 2024 10:25:27 GMT
via
1.1 b41e2a1d821ef07780a0f51a6c832ec4.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
SIN2-P3
age
2134169
x-cache
Hit from cloudfront
location
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
content-length
0
x-amz-cf-id
nqlvEOPDpA_URIlWOGlHQJaazvKai6AY-B__G4rajyQiwvytUUxerQ==
fowiwoeijiervoerier.js
gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/ 		15 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/fowiwoeijiervoerier.js
Requested by
Host: rthfsmeheff.ganduzaghyt.com
URL: https://rthfsmeheff.ganduzaghyt.com/ga
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.110.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-110-133.github.com
Software
/
Resource Hash
47ba09f99b9e72c39c3aacfe2657ce4745e8b8881dbacc1c41f7a76352e39314
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rthfsmeheff.ganduzaghyt.com/
Origin
https://rthfsmeheff.ganduzaghyt.com
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-fastly-request-id
15acbb8c8f6dbdf9b402e7cd3c17e74ab6402b5c
content-security-policy
default-src 'none'; style-src 'unsafe-inline'; sandbox
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
date
Thu, 09 May 2024 03:14:57 GMT
via
1.1 varnish
x-cache-hits
0
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
14888
x-xss-protection
1; mode=block
x-served-by
cache-qpg1259-QPG
x-github-request-id
4CD0:8B908:BF146:F2B18:663C399A
x-timer
S1715224497.488928,VS0,VE310
etag
W/"e842e40349087bea6bfd3231ee95261af10b6e3aafb2a2b51c209cabaed7882d"
source-age
0
x-frame-options
deny
vary
Authorization,Accept-Encoding,Origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300
accept-ranges
bytes
expires
Thu, 09 May 2024 03:19:57 GMT
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/w5zhe/0x4AAAAAAAZSl_DomMDqQm9V/auto/ Frame 9F26 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/w5zhe/0x4AAAAAAAZSl_DomMDqQm9V/auto/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
https://rthfsmeheff.ganduzaghyt.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
880e85bb6cc5473f-SIN
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Thu, 09 May 2024 03:14:58 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
vary
accept-encoding
favicon.ico
rthfsmeheff.ganduzaghyt.com/ 		630 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://rthfsmeheff.ganduzaghyt.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.253.247.215 Frankfurt am Main, Germany, ASN213250 (ITP-SOLUTIONS, DE),
Reverse DNS
215.247.253.5.in-addr.arpa
Software
/
Resource Hash
c3f780e26aa6261c3b9a0ebe5aa80510197a11cc8412e24fd4688b05d478599f
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; frame-src 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; style-src * data: blob: filesystem: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rthfsmeheff.ganduzaghyt.com/ga
Accept-Language
zh-SG,zh;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Content-Security-Policy
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; frame-src 'self' * http://* https://* file://* about: javascript: data: blob: filesystem:; style-src * data: blob: filesystem: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Cache-Control
no-cache="Set-Cookie"
Access-Control-Allow-Credentials
true
Date
Thu, 09 May 2024 03:14:58 GMT
Cross-Origin-Resource-Policy
cross-origin
Content-Length
630
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| localforage object| turnstile function| fingerprint function| UAParser function| verifyCallback_CF function| validateElement function| onloadTurnstileCallback

2 Cookies

Domain/Path Name / Value
weda.member365.com/ Name: ci_session
Value: a%3A4%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22b4c083953e5742731d2646ec2d9f0979%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A11%3A%2210.0.13.196%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A111%3A%22Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F124.0.0.0+Safari%2F537.36%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1715224481%3B%7D30e8d80724d1e1f69c032856ddfcb509
.ganduzaghyt.com/ Name: qqhost
Value: Bb-v5YySZ5PODJ7p9UEKeSf6721sZk2pI2LKtW2HE0E

1 Console Messages

Source Level URL
Text
javascript error URL: https://gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/fowiwoeijiervoerier.js
Message:
Failed to load module script: Expected a JavaScript module script but the server responded with a MIME type of "text/plain". Strict MIME type checking is enforced for module scripts per HTML spec.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN