kasdba.org Open in urlscan Pro
192.185.16.105  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://kasdba.org/axcel/excelzz/index.php?email=a@a.c Page URL
2. http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.php Show response kasdba.org/axcel/excelzz/	133 B 404 B	671ms 357ms	Document text/html	192.185.16.105 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://kasdba.org/axcel/excelzz/index.php?email=a@a.c Protocol HTTP/1.1 Server 192.185.16.105 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS yorkcougars.com Software Apache / Resource Hash 3aa0bac8e6fb3d668b71bf208ede7f6fe09387add093d4b16743b733b55ff9cc Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Upgrade, Keep-Alive Content-Encoding gzip Content-Length 143 Content-Type text/html; charset=UTF-8 Date Mon, 18 Jul 2022 14:13:27 GMT Keep-Alive timeout=5, max=75 Server Apache Upgrade h2,h2c Vary Accept-Encoding
GET H/1.1	200 OK	Primary Request bizmail.php Show response kasdba.org/axcel/excelzz/	1 KB 847 B	351ms 350ms	Document text/html	192.185.16.105 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol HTTP/1.1 Server 192.185.16.105 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS yorkcougars.com Software Apache / Resource Hash 75e546fc5147a6c886c023967870217178c94bdb52f451f8cfb7ad8ea44c1c66 Request headers Referer http://kasdba.org/axcel/excelzz/index.php?email=a@a.c Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 612 Content-Type text/html; charset=UTF-8 Date Mon, 18 Jul 2022 14:13:27 GMT Keep-Alive timeout=5, max=74 Server Apache Vary Accept-Encoding
GET H/1.1	200 OK	styles.css kasdba.org/axcel/excelzz/css/	3 KB 1 KB	165ms 165ms	Stylesheet text/css	192.185.16.105 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://kasdba.org/axcel/excelzz/css/styles.css Requested by Host: kasdba.org URL: http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol HTTP/1.1 Server 192.185.16.105 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS yorkcougars.com Software Apache / Resource Hash 66f05abca65a210dccfffc1c7e444c7e01bfb6f12f9d8bf7a281efb739dea9d7 Request headers accept-language de-DE,de;q=0.9 Referer http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Mon, 18 Jul 2022 14:13:28 GMT Content-Encoding gzip Last-Modified Sun, 31 Mar 2019 23:34:16 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=73 Content-Length 1011
GET H/1.1	200 OK	ex.png kasdba.org/axcel/excelzz/img/	8 KB 8 KB	159ms 159ms	Image image/png	192.185.16.105 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://kasdba.org/axcel/excelzz/img/ex.png Requested by Host: kasdba.org URL: http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol HTTP/1.1 Server 192.185.16.105 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS yorkcougars.com Software Apache / Resource Hash 5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4 Request headers accept-language de-DE,de;q=0.9 Referer http://kasdba.org/axcel/excelzz/bizmail.php?email=YUBhLmM=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Mon, 18 Jul 2022 14:13:28 GMT Last-Modified Sun, 31 Mar 2019 23:34:16 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/png Keep-Alive timeout=5, max=75 Content-Length 8180
GET H2	200	css fonts.googleapis.com/	2 KB 1011 B	128ms 48ms	Stylesheet text/css	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=PT+Sans:400,700 Requested by Host: kasdba.org URL: http://kasdba.org/axcel/excelzz/css/styles.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash e2464f998b38ae5f4a6f68dd19faea6939ccb6db5388ce17a0621c3fe186f859 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer http://kasdba.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 18 Jul 2022 12:36:55 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Mon, 18 Jul 2022 14:13:28 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 18 Jul 2022 14:13:28 GMT
GET H/1.1	200 OK	pdf.png kasdba.org/axcel/excelzz/img/	73 KB 73 KB	157ms 157ms	Image image/png	192.185.16.105 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://kasdba.org/axcel/excelzz/img/pdf.png Requested by Host: kasdba.org URL: http://kasdba.org/axcel/excelzz/css/styles.css Protocol HTTP/1.1 Server 192.185.16.105 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS yorkcougars.com Software Apache / Resource Hash bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf Request headers accept-language de-DE,de;q=0.9 Referer http://kasdba.org/axcel/excelzz/css/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Mon, 18 Jul 2022 14:13:28 GMT Last-Modified Sun, 31 Mar 2019 23:34:16 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=72 Content-Length 74994
GET H/1.1	403 Forbidden	check.svg s3-us-west-2.amazonaws.com/s.cdpn.io/3/	0 0	692ms 181ms	Image application/xml	52.218.184.184 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/check.svg Requested by Host: kasdba.org URL: http://kasdba.org/axcel/excelzz/css/styles.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.218.184.184 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer http://kasdba.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H2	200	jizfRExUiTo99u79B_mh0O6tLQ.woff2 fonts.gstatic.com/s/ptsans/v17/	46 KB 46 KB	169ms 87ms	Font font/woff2	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ptsans/v17/jizfRExUiTo99u79B_mh0O6tLQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://kasdba.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 13 Jul 2022 19:28:45 GMT x-content-type-options nosniff age 413083 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 47048 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:55:54 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 13 Jul 2023 19:28:45 GMT
GET H2	200	jizaRExUiTo99u79D0KExQ.woff2 fonts.gstatic.com/s/ptsans/v17/	44 KB 45 KB	118ms 36ms	Font font/woff2	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://kasdba.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 13 Jul 2022 19:26:35 GMT x-content-type-options nosniff age 413213 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45300 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:11:08 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 13 Jul 2023 19:26:35 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/3/check.svg Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
kasdba.org
s3-us-west-2.amazonaws.com
192.185.16.105
2a00:1450:4001:809::2003
2a00:1450:4001:82b::200a
52.218.184.184
141f0c53e457585d4ac7426eb3d757666d250ee6fbf0e9c0878128e4c627f0b1
3aa0bac8e6fb3d668b71bf208ede7f6fe09387add093d4b16743b733b55ff9cc
5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4
66f05abca65a210dccfffc1c7e444c7e01bfb6f12f9d8bf7a281efb739dea9d7
75e546fc5147a6c886c023967870217178c94bdb52f451f8cfb7ad8ea44c1c66
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d
e2464f998b38ae5f4a6f68dd19faea6939ccb6db5388ce17a0621c3fe186f859
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855