latoyamays.me Open in urlscan Pro
192.185.181.56  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response latoyamays.me/Stubbs/	6 KB 1 KB	822ms 523ms	Document text/html	192.185.181.56 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.181.56 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-181-56.unifiedlayer.com Software Apache / Resource Hash 2cf660a8417078dfaecf137229e43c0ef1e9289881a66cee8c1924e9255a1a8d Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers vary Accept-Encoding content-encoding gzip content-length 1319 content-type text/html; charset=UTF-8 date Thu, 13 Jan 2022 12:03:57 GMT server Apache
GET H2	200	icon fonts.googleapis.com/	569 B 868 B	42ms 17ms	Stylesheet text/css	142.250.185.106 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/icon?family=Material+Icons Requested by Host: latoyamays.me URL: https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.106 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f10.1e100.net Software ESF / Resource Hash d44a3249e2be052d683c7b58d03890937199b056a6313bd7ae0834281a70a2d6 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://latoyamays.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 13 Jan 2022 12:03:58 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Thu, 13 Jan 2022 12:03:58 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 13 Jan 2022 12:03:58 GMT
GET H2	200	materialize.min.css cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/css/	139 KB 18 KB	92ms 34ms	Stylesheet text/css	104.16.18.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/css/materialize.min.css Requested by Host: latoyamays.me URL: https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b079a3ff21ceabb15fa5cac7f24b887e2cceac470b8eddeb9361fafa335db88 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://latoyamays.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 12:03:58 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 60910 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 17475 timing-allow-origin * last-modified Mon, 04 May 2020 16:12:46 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03efe-22a11" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SM3GtEx4F8y6NTGqDIkLIqzhys2RV5hm5BE%2B8Y2OJeHiQ1kIKHjJA%2BmgCtMdrpUuIlbacbPXbxWBkrmETpvaNfy2p%2F0sLTgB6b1DXpB1bY5ij0ecJQ2WsvmMOqy6advGiuwIjc8A"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6cce7c025ad735d1-MAN expires Tue, 03 Jan 2023 12:03:58 GMT
GET H2	200	style.css latoyamays.me/Stubbs/pattern/	1 KB 572 B	198ms 198ms	Stylesheet text/css	192.185.181.56 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://latoyamays.me/Stubbs/pattern/style.css Requested by Host: latoyamays.me URL: https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.181.56 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-181-56.unifiedlayer.com Software Apache / Resource Hash 73390e575949e63444941474c1d0a6ac4806b7ca550842452a3581cd1d617f1d Request headers Accept-Language de-DE,de;q=0.9 Referer https://latoyamays.me/Stubbs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 12:03:58 GMT content-encoding gzip last-modified Tue, 25 Feb 2020 18:00:51 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 482
GET H2	200	materialize.min.js Show response cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/	177 KB 36 KB	93ms 36ms	Script application/javascript	104.16.18.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/materialize.min.js Requested by Host: latoyamays.me URL: https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53f7070cc4c81c278c72f7a106fd71434e766cf49b26d6ee8b0e1003d7132b3d Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://latoyamays.me/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 13 Jan 2022 12:03:58 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4468267 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 36877 timing-allow-origin * last-modified Mon, 04 May 2020 16:12:46 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03efe-2c375" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q6sAwYVagGJaioEjt6ugBIQlxP2jcQD%2BH4oJGn4uH5RU0xRzUKv%2BPaBgq%2BEU%2BhOSIZHhFHxcCW37lVtRfXPSqHvnf300ZSj7ZcixffLafwGqYs%2BsBvI%2BKs1gCJfmHaxGOBGKvieB"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6cce7c025ad935d1-MAN expires Tue, 03 Jan 2023 12:03:58 GMT
GET H2	200	mt.png latoyamays.me/Stubbs/display/	5 KB 5 KB	203ms 203ms	Image image/png	192.185.181.56 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://latoyamays.me/Stubbs/display/mt.png Requested by Host: latoyamays.me URL: https://latoyamays.me/Stubbs/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.181.56 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-181-56.unifiedlayer.com Software Apache / Resource Hash c2165b7a8bfd65bcf4c5a85000b7f78fc8eb2cc36174bb6dfad76fff7c1d017c Request headers Accept-Language de-DE,de;q=0.9 Referer https://latoyamays.me/Stubbs/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 13 Jan 2022 12:03:58 GMT last-modified Sat, 27 Apr 2019 16:03:08 GMT server Apache accept-ranges bytes content-length 5465 content-type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Square (Financial)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onsecuritypolicyviolation object| onslotchange function| _get function| _createClass function| _possibleConstructorReturn function| _inherits function| _classCallCheck function| Component function| docHandleKeydown function| docHandleKeyup function| docHandleFocus function| docHandleBlur function| getTime object| $jscomp object| $jscomp$this function| cash object| M object| Waves

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://latoyamays.me/Stubbs/(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/materialize.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://latoyamays.me/Stubbs/(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/materialize.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
latoyamays.me
104.16.18.94
142.250.185.106
192.185.181.56
2cf660a8417078dfaecf137229e43c0ef1e9289881a66cee8c1924e9255a1a8d
3b079a3ff21ceabb15fa5cac7f24b887e2cceac470b8eddeb9361fafa335db88
53f7070cc4c81c278c72f7a106fd71434e766cf49b26d6ee8b0e1003d7132b3d
73390e575949e63444941474c1d0a6ac4806b7ca550842452a3581cd1d617f1d
c2165b7a8bfd65bcf4c5a85000b7f78fc8eb2cc36174bb6dfad76fff7c1d017c
d44a3249e2be052d683c7b58d03890937199b056a6313bd7ae0834281a70a2d6