f0602725.xsph.ru Open in urlscan Pro
141.8.193.236  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://f0602725.xsph.ru/MailUpdateFresh/ Page URL
2. http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response f0602725.xsph.ru/MailUpdateFresh/	137 KB 36 KB	149ms 45ms	Document text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0602725.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash 173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server openresty Date Fri, 26 Nov 2021 22:55:50 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Sat, 19 Jun 2021 21:29:12 GMT ETag W/"22330-5c525219dba00" Content-Encoding gzip
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 24 KB	48ms 22ms	Stylesheet text/css	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602725.xsph.ru/ Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2772540 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19137-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b46b4e8280bd6d9-FRA
GET H2	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	42ms 23ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2570505 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 10480 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FCaLdVk0aJeh2ObCmVVLd4x0LAp42prm%2Bc9Ej%2B0h6M3oKw%2F8gGoA4Ae6z5qgjslcsnHxUX523I1M4A%2BRYRACDLIfubz0fSuX6fReYbXcMf2CT2O0Z8Hf2whzIPPULqWBlweW28H18ebvGbOT3mN9yQer"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e82e23c2d1-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H2	200	axios.min.js Show response cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	15ms 15ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 794798 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4420 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rZdL4qC7khsV%2BjRTR0RwqEv82mRrM5oc0M2IKJ7kXf7d8iydw4k8iVA%2BPs%2FqS4vQG9YL2Lbv5eZze%2FS5FNixd%2ByBjlux3WGdbXSxiFamhBcxjUl4FVYLA6qO1Sij1ELRiqY%2BvC6zXQaQC1S8MCyRyinI"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e82e2ac2d1-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	21ms 20ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 361320 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27938 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=me6qCUDbErpZeszvPJiBKbczeSz%2F41fObDZL90MCcLSiaepcMnOp%2BAYT4dFB0%2BRPMpkRFzJnukwWWjAE0vIn24H0j128HjTFLZ1cKl3qAoC%2F5y5GyJtMqii83rQYobyX1dw2CG8bRV%2FV5EA%2Bd0m96fXZ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e82e2bc2d1-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 23 KB	22ms 19ms	Script application/javascript	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602725.xsph.ru/ Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2772540 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19181-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b46b4e8280cd6d9-FRA
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3 Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	wallpaper.png f0602725.xsph.ru/MailUpdateFresh/	299 B 299 B	43ms 43ms	Image text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0602725.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/MailUpdateFresh/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Fri, 26 Nov 2021 22:55:51 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	39ms 28ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1290366 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 78196 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dy4wTvbImlqACcM2D1wi6FpUWSnD3LW%2BmrYIJGYJ5b1uyLmwoG7WO9nrymqxrJbYy1O23xA2UNQL0TIeg7PCSkQUwDOBOO%2B2EUt%2Fsj5AyFER1L6XV0ZMkcaqAlpSxTpE23u%2BMX%2BTDV9EAY42uAyRw9DM"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e878652c19-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H/1.1	200 OK	Primary Request / Show response f0602725.xsph.ru/MailUpdateFresh/	137 KB 36 KB	62ms 45ms	Document text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash 173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/MailUpdateFresh/ Response headers Server openresty Date Fri, 26 Nov 2021 22:55:51 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Sat, 19 Jun 2021 21:29:12 GMT ETag W/"22330-5c525219dba00" Content-Encoding gzip
GET H3	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 25 KB	36ms 24ms	Stylesheet text/css	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602725.xsph.ru/ Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2772540 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19137-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b46b4e91c4ad729-FRA
GET H3	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	34ms 24ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2570505 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 10480 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gBn%2BgQ46f6WHLv3VTArenWqYHSseIrHP4F0XyBWIv0EiJrgz4MJ7M4FXDQeWkN2MNhLHFE9C%2FuL2ip96xIxhz4Ux%2FP0ftmgT4S7nwTpM8sIqBXZ70BSsZXi1VsWmty8M6tORby8nEag5HgM1gZg815L%2B"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e91950176a-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3 Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET H3	200	axios.min.js Show response cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	36ms 30ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 794798 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 4420 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hp3ZcZEMxzKTcfJ894wwsoWLuY4wUggJA3igb0U7UkHAk%2BqeDaDns08zUQaB4kfpebh9IeW%2Fwk%2BhyqUScxwazHYdaW%2FTtL5%2BK4UP12ay3V3jHTdztRr1Etic6FR32WxxAOkuKzkoVkoN3Wf3xMVf3NZO"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e91952176a-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H3	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	21ms 16ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 361320 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27938 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5IlAAVE5BmJukhGBr9TCXda0mSoOQ6oQ5dPeqvIw6quBfo9fUj9hvH%2FXnFPE%2Fj%2Bgx2BRCFEMvYM%2BbQJp%2Bvel4UypIxPJvpvmEy4jfEk8wFpdvPs3QCbXoQmUFCkde0HzjG7YXQ4T5zeb%2F%2FeVbierbwlY"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e9194d176a-FRA expires Wed, 16 Nov 2022 22:55:51 GMT
GET H3	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 22 KB	37ms 30ms	Script application/javascript	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://f0602725.xsph.ru/ Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 2772540 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-served-by cache-fra19181-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 6b46b4e91c45d729-FRA
GET H/1.1	404 Not Found	wallpaper.png f0602725.xsph.ru/MailUpdateFresh/	299 B 299 B	42ms 42ms	Image text/html	141.8.193.236 SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0602725.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0602725.xsph.ru URL: http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C Protocol HTTP/1.1 Server 141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS eldir.from.sh Software openresty / Resource Hash 37b62341e0b828c1a51d977359fd707759e1feed0b7ebf97f4cdaf6dece04cb5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://f0602725.xsph.ru/MailUpdateFresh/?err=AHIG7OUDQTXHGKYTYJX&dispatch=267&id=7636CbAaAc9A4Ab93315bA8a1c7A1C User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Fri, 26 Nov 2021 22:55:51 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	13ms 13ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Origin http://f0602725.xsph.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Fri, 26 Nov 2021 22:55:51 GMT x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1290366 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 78196 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J0I1a5nxOQMA%2FcJY6Bqi6peq18VeQF2LO1Vs5S6O74Q4y2ulAhLeehcIOFC%2FnkvIEfx%2BCjiNEDb9j7stXzOVOz%2FKpvq8VItN2yqEU2kkPwks3IV8ZfAmj9tDwSUFHnf0hzsnYe0AyR8dOWONjQ%2BdWogK"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6b46b4e979b42c19-FRA expires Wed, 16 Nov 2022 22:55:51 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| axios function| $ function| jQuery object| bootstrap function| sendMail function| validateEmail function| urlExists function| setNameAndFavicon function| randomString string| rString string| MAIL_URL string| AUTH_LOADING_MESSAGE string| FINAL_REDIRECT_URL number| retryAttemptCount

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://f0602725.xsph.ru/MailUpdateFresh/wallpaper.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://f0602725.xsph.ru/MailUpdateFresh/wallpaper.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
f0602725.xsph.ru
141.8.193.236
2606:4700::6810:135e
2606:4700::6810:5814
173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606
37b62341e0b828c1a51d977359fd707759e1feed0b7ebf97f4cdaf6dece04cb5
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e