f0558599.xsph.ru Open in urlscan Pro
2a0a:2b42:0:427::  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://f0558599.xsph.ru/MailUpdateFresh/ Page URL
2. http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response f0558599.xsph.ru/MailUpdateFresh/	274 KB 44 KB	107ms 38ms	Document text/html	2a0a:2b42:0:427:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0558599.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 2a0a:2b42:0:427:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash 18b3c58323c0c14ee61175dbef8a43cac96550c4de14bb13d2585c3e5e474c7b Request headers Host f0558599.xsph.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server openresty Date Mon, 19 Jul 2021 06:48:25 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Fri, 02 Jul 2021 22:58:20 GMT ETag W/"446a6-5c62be4519b00" Content-Encoding gzip
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 24 KB	37ms 14ms	Stylesheet text/css	2a04:4e42:3::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 363364 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin content-length 23906 etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" x-served-by cache-fra19173-FRA x-jsd-version-type version date Mon, 19 Jul 2021 06:48:25 GMT vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	28ms 13ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3407572 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 10480 cf-request-id 0a94038c8f0000175e002a6000000001 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ofzfKFFLyfNS50ANGTAVDe21WxVXnMI%2FYeXXRHqXk9FfdmpyAibLatDVBqv4F1rZAmtPhbmpUUxAhO%2Fna01Z6ytYRMY%2FKYsnOjEzS6oe%2BSEt4kqfEnQf6nq%2BCEZR%2BFsit7OuTpyLarMmTM7JTQtBg%2FuZ"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 67120106bdf3073e-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H3-29	200	axios.min.js Show response cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	30ms 19ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2517406 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 4420 cf-request-id 0ac912662f00004e9264009000000001 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9qdjzEHfMm0Z0D6LqwEV0vTQ2wCpeLe%2BFHA%2FKVtgAT%2FgnHC3FgD%2F02POjHzaTwuuYni8KVo%2FoYRMrrg8fpOWy49%2BHlcfU0sQgd6gH3K0VtIsQGOELvTS%2FGCmZzgVEHuZHCljMD2ouQVQIreIngaajh6Z"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 67120106ea6c4e0d-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H3-29	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	30ms 20ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 4620524 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 27938 cf-request-id 0a4bb75f26000098087f9c6000000001 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BHlzQmHsrfXSXqGIqk3VojqM5bWg%2BEXHL1EOSg9IyhXevuCizy2fJ3VaLHnbxWFhsWFVVcc1DA81aZr75ND3NJTwRLK1qu5%2FXRp8ZMTrtCCnvTIeYPnqNDv218kY7ZAvd3toeSLPAglIlzN1Tgn3AdMx"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 67120106ea6b4e0d-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 21 KB	7ms 6ms	Script application/javascript	2a04:4e42:3::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 2065474 x-cache HIT cross-origin-resource-policy cross-origin content-length 21785 etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" x-served-by cache-fra19173-FRA date Mon, 19 Jul 2021 06:48:25 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3 Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	wallpaper.png f0558599.xsph.ru/MailUpdateFresh/	299 B 299 B	48ms 39ms	Image text/html	2a0a:2b42:0:427:: SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0558599.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 2a0a:2b42:0:427:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash 8f79c3e72bc6bc79c77e856880e191c00dcdf71127d4322322a0553cb76da791 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host f0558599.xsph.ru Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://f0558599.xsph.ru/MailUpdateFresh/ Connection keep-alive Cache-Control no-cache Referer http://f0558599.xsph.ru/MailUpdateFresh/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 19 Jul 2021 06:48:25 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3-29	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	27ms 17ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 9411125 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 78196 cf-request-id 092e2c968a00004e5574042000000001 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GGfaBR29k1vOlmvI8X9qB%2BpwCzpebyjuI4%2FYd04hofpPeWAnJ1wv2P%2Fc2WWYRe23H1BMdHVR92E09YlUOxyTMtBQBgsD1g25ZIEguCX9pwxc8iZI9bWGOr53NkjG52sIDtVOke7tw8ustBAmtEVQQqKE"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 67120106fb534ab6-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H/1.1	200 OK	Primary Request / Show response f0558599.xsph.ru/MailUpdateFresh/	274 KB 44 KB	105ms 104ms	Document text/html	2a0a:2b42:0:427:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/ Protocol HTTP/1.1 Server 2a0a:2b42:0:427:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash 18b3c58323c0c14ee61175dbef8a43cac96550c4de14bb13d2585c3e5e474c7b Request headers Host f0558599.xsph.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://f0558599.xsph.ru/MailUpdateFresh/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://f0558599.xsph.ru/MailUpdateFresh/ Response headers Server openresty Date Mon, 19 Jul 2021 06:48:25 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Last-Modified Fri, 02 Jul 2021 22:58:20 GMT ETag W/"446a6-5c62be4519b00" Content-Encoding gzip
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/	157 KB 23 KB	6ms 5ms	Stylesheet text/css	2a04:4e42:3::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 363364 x-jsd-version 4.5.3 x-cache HIT cross-origin-resource-policy cross-origin content-length 23906 etag W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms" x-served-by cache-fra19173-FRA x-jsd-version-type version date Mon, 19 Jul 2021 06:48:25 GMT vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H3-29	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/	58 KB 11 KB	20ms 20ms	Stylesheet text/css	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3407572 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 10480 cf-request-id 0a94038c8f0000175e002a6000000001 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-e7d0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dVNk4YICloPCqMdBbmyd1ekRaJvWJ2KtwkwMemJUl4u9hecVMlgN1fJQ3N6GQJJUEpsgyGJVb3Efy2YogjanJT5j3Jw9Qd5OBFSO0mL%2F0BwG24P4WDOXh8VaUGyXZGONqpAExoWN9pZqWGfz4h71JTFQ"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 671201081cbb4e0d-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3 Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H3-29	200	axios.min.js Show response cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/	14 KB 5 KB	13ms 12ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2517406 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 4420 cf-request-id 0ac912662f00004e9264009000000001 timing-allow-origin * last-modified Tue, 22 Dec 2020 05:22:54 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5fe182ae-3813" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3LG522WOMV0%2BFjdIoVLQxZHGbNQjLgj04cuElYeSwZ13tzmOAHd6jineDdOlywQcVmumrlVAzjudJxR2n58f%2F2iO1XiG4X9sDitGijOkAWeX%2BPImXasb3P6DiExshxH2MJt0GHm0yYFwgG6fdCjVwIJZ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 671201082cd94e0d-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H3-29	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	13ms 13ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 4620524 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 27938 cf-request-id 0a4bb75f26000098087f9c6000000001 timing-allow-origin * last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mL6e2yS1k71pyapdJJrq2jKRcTk7n15%2FmamazfbDgSZnIABkzuT0BymGnoPZMPycSFPxA8XqBFdS%2BfIqJGAD5crzhwHMsaQW5LD3YQnWnVPAHGS7U1SviM%2BtulRAMrI0OF8qegR2KVUZ6nhZgXZoWyLU"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 671201082cdb4e0d-FRA expires Sat, 09 Jul 2022 06:48:25 GMT
GET H2	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/	82 KB 21 KB	7ms 7ms	Script application/javascript	2a04:4e42:3::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer http://f0558599.xsph.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 2065474 x-cache HIT cross-origin-resource-policy cross-origin content-length 21785 etag W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk" x-served-by cache-fra19173-FRA date Mon, 19 Jul 2021 06:48:25 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H/1.1	404 Not Found	wallpaper.png f0558599.xsph.ru/MailUpdateFresh/	299 B 299 B	34ms 33ms	Image text/html	2a0a:2b42:0:427:: SPRINTHOST
General Check archive.org Show headers Download Go to Show image Full URL http://f0558599.xsph.ru/MailUpdateFresh/wallpaper.png Requested by Host: f0558599.xsph.ru URL: http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Protocol HTTP/1.1 Server 2a0a:2b42:0:427:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash 8f79c3e72bc6bc79c77e856880e191c00dcdf71127d4322322a0553cb76da791 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host f0558599.xsph.ru Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A Connection keep-alive Cache-Control no-cache Referer http://f0558599.xsph.ru/MailUpdateFresh/?err=T0VUNIBRSZRKRTIVWTX&dispatch=0Ac&id=bA44C00B09411664ABC9BBC7A9520A User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 19 Jul 2021 06:48:25 GMT Server openresty Connection keep-alive Content-Length 299 Content-Type text/html; charset=iso-8859-1
GET H3-29	200	fa-solid-900.woff2 cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/	76 KB 77 KB	12ms 11ms	Font application/octet-stream	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/webfonts/fa-solid-900.woff2 Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Origin http://f0558599.xsph.ru Referer https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 19 Jul 2021 06:48:25 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 9411125 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 78196 cf-request-id 092e2c968a00004e5574042000000001 timing-allow-origin * last-modified Tue, 16 Mar 2021 19:29:58 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60510736-13174" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0R5VyToPvI8MMxW292fFNOKxuvF1Q0cP7LoTEuIICrABFJHdQ37nIk7BrOQTNtZybWMqIRCe7fNx9zprmu4kvw4eSBxjeaCya%2F%2FJpng5ZNeUCSYd14CMBXHqS4ftkZkK3N1MGcOXOTvGEL1Y2YWj6Nx"}],"group":"cf-nel","max_age":604800} content-type application/octet-stream; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 671201085e3d4ab6-FRA expires Sat, 09 Jul 2022 06:48:25 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| axios function| $ function| jQuery object| bootstrap function| sendMail function| validateEmail function| urlExists function| setNameAndFavicon function| randomString string| rString string| MAIL_URL string| AUTH_LOADING_MESSAGE string| FINAL_REDIRECT_URL number| retryAttemptCount

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
f0558599.xsph.ru
2606:4700::6810:135e
2a04:4e42:3::485
2a0a:2b42:0:427::
18b3c58323c0c14ee61175dbef8a43cac96550c4de14bb13d2585c3e5e474c7b
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2699316cb83af2502422d101e81564b0492785cab2fdfbdc256f90e1c4ad5606
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
8f79c3e72bc6bc79c77e856880e191c00dcdf71127d4322322a0553cb76da791
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f8364a8976086cbd233ce2efa50c818331d49f1577729a562be2a57c8bfdfec3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e