664726.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::238  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request page1.html Show response 664726.selcdn.ru/101Office-X-doc676vuiggoiuo/	32 KB 32 KB	186ms 88ms	Document text/html	2a00:ab00:0:12::238 SELECTEL
General Check archive.org Show headers Download Go to Full URL https://664726.selcdn.ru/101Office-X-doc676vuiggoiuo/page1.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a00:ab00:0:12::238 , Russian Federation, ASN49505 (SELECTEL, RU), Reverse DNS Software / Resource Hash a7a840ab0b36518779f1a1674536d5ef7c8a7e3f7b801800c871a4cf7026d594 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-origin * access-control-expose-headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges content-length 32420 content-type text/html etag "de0c968f65d2c249f964f9254dcc55f6" last-modified Tue, 15 Mar 2022 19:04:11 GMT x-timestamp 1647371050.42150 x-trans-id 16dca33e018b29a9 date Wed, 16 Mar 2022 02:16:23 GMT age 39833
GET		26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png www.pngitem.com/pimgs/m/	0 0
GET H2	200	jquery-3.5.0.js Show response code.jquery.com/	281 KB 83 KB	31ms 12ms	Script application/javascript	2001:4de0:ac18::1:a:1a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.0.js Requested by Host: 664726.selcdn.ru URL: https://664726.selcdn.ru/101Office-X-doc676vuiggoiuo/page1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash aff01a147aeccc9b70a5efad1f2362fd709f3316296ec460d94aa7d31decdb37 Request headers Accept-Language de-DE,de;q=0.9 Referer https://664726.selcdn.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 16 Mar 2022 13:20:16 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-463a1" vary Accept-Encoding x-hw 1647436816.dop233.fr8.t,1647436816.cds157.fr8.hn,1647436816.cds136.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 84374
GET H2	200	jquery-3.6.0.min.js Show response 664726.selcdn.ru/101Office-X-doc676vuiggoiuo/	88 KB 88 KB	47ms 47ms	Script text/javascript	2a00:ab00:0:12::238 SELECTEL
General Check archive.org Show headers Download Go to Full URL https://664726.selcdn.ru/101Office-X-doc676vuiggoiuo/jquery-3.6.0.min.js Requested by Host: 664726.selcdn.ru URL: https://664726.selcdn.ru/101Office-X-doc676vuiggoiuo/page1.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a00:ab00:0:12::238 , Russian Federation, ASN49505 (SELECTEL, RU), Reverse DNS Software / Resource Hash 5bab74e2f90fa4443fa115806be950763b35b39cde1759bc65d8c579f8fe1730 Request headers Accept-Language de-DE,de;q=0.9 Referer https://664726.selcdn.ru/101Office-X-doc676vuiggoiuo/page1.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 16 Mar 2022 02:16:24 GMT last-modified Tue, 15 Mar 2022 19:04:20 GMT age 39833 etag "0fa49d4c5a0a61c90df100141882394f" content-type text/javascript access-control-allow-origin * access-control-expose-headers Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges content-length 89603 accept-ranges bytes x-trans-id 16dca3403832fdb9 x-timestamp 1647371059.92898
GET DATA	200 OK	truncated /	16 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	558 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	520 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.pngitem.com

URL

https://www.pngitem.com/pimgs/m/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery object| url string| hash string| hasherror string| email string| error number| count undefined| my_email undefined| ind undefined| my_slice undefined| mainPage undefined| sv undefined| image undefined| msg object| alertt function| showEl function| hideEl

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

664726.selcdn.ru
code.jquery.com
www.pngitem.com
www.pngitem.com
2001:4de0:ac18::1:a:1a
2a00:ab00:0:12::238
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5
2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b
5bab74e2f90fa4443fa115806be950763b35b39cde1759bc65d8c579f8fe1730
a7a840ab0b36518779f1a1674536d5ef7c8a7e3f7b801800c871a4cf7026d594
aff01a147aeccc9b70a5efad1f2362fd709f3316296ec460d94aa7d31decdb37