sgp1.digitaloceanspaces.com Open in urlscan Pro
103.253.144.208  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://ghstwins.shop/ Page URL
2. https://sgp1.digitaloceanspaces.com/65cfe2c6-7dc4-439a-b57f-81165e59cdba65cfe2c6-7dc4-439a-b57f/NoVoice.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ ghstwins.shop/	287 B 511 B	259ms 111ms	Document text/html	20.231.2.161 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://ghstwins.shop/ Protocol HTTP/1.1 Server 20.231.2.161 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Accept-Ranges bytes Content-Length 287 Content-Type text/html Date Tue, 18 Oct 2022 08:36:23 GMT ETag "84fde7ba86e2d81:0" Last-Modified Tue, 18 Oct 2022 00:15:29 GMT Server Microsoft-IIS/8.5
GET H2	200	Primary Request NoVoice.html Show response sgp1.digitaloceanspaces.com/65cfe2c6-7dc4-439a-b57f-81165e59cdba65cfe2c6-7dc4-439a-b57f/	641 KB 641 KB	1026ms 510ms	Document text/html	103.253.144.208 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://sgp1.digitaloceanspaces.com/65cfe2c6-7dc4-439a-b57f-81165e59cdba65cfe2c6-7dc4-439a-b57f/NoVoice.html Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.253.144.208 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS sgp1.digitaloceanspaces.com Software / Resource Hash dfbbb3217a3208e0b09866173f3f8df71bb9380a3ed500d65ced3721b6c887f3 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer http://ghstwins.shop/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers accept-ranges bytes content-length 656161 content-type text/html date Tue, 18 Oct 2022 08:36:24 GMT etag "e4e95aaf596be3c32d7d054f606025c9" last-modified Mon, 17 Oct 2022 22:13:16 GMT strict-transport-security max-age=15552000; includeSubDomains; preload vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id tx00000000000007a51cb02-00634e6588-1cd01b00-sgp1b x-rgw-object-type Normal
GET H2	200	logoff.owa outlook.live.com/mail/ Frame 4646	0 0	224ms 65ms	Document text/html	2603:1026:203:9f::2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://outlook.live.com/mail/logoff.owa Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1026:203:9f::2 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Security Headers Name Value Content-Security-Policy default-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net swx.cdn.skype.com 'self'; script-src 'nonce-3JjrOCzC95UfXKcz19tZnQ==' *.res.office365.com *.fluidpreview.office.net *.cdn.office.net wss://*.delve.office.com:443 shellprod.msocdn.com amcdn.msauth.net amcdn.msftauth.net *.bing.com *.skype.com *.skypeassets.com *.delve.office.com *.cdn.office.net static.teams.microsoft.com *.googleapis.com teams.microsoft.com cdn.forms.office.net blob: 'report-sample' 'self' 'wasm-unsafe-eval' acdn.adnxs.com cdn.adnxs.com *.aolcdn.com jill.fc.yahoo.com stage-jill.fc.yahoo.com jac.yahoosandbox.com stage-jac.yahoosandbox.com *.arkoselabs.com; style-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net shellprod.msocdn.com *.skype.com 'self' 'report-sample' 'unsafe-inline' *.arkoselabs.com 'unsafe-inline'; img-src * data: blob: filesystem: cid:; connect-src blob: data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.services.web.outlook.com login.live.com spoprod-a.akamaihd.net shellprod.msocdn.com *.bing.com *.office.net *.office.com *.office365.com *.officeapps.live.com *.skype.com *.skypeassets.com *.spoppe.com *.onedrive.com my.microsoftpersonalcontent.com browser.pipe.aria.microsoft.com *.gateway.messenger.live.com dev.virtualearth.net *.trouter.skype.com *.trouter.io wss://*.trouter.skype.com wss://*.trouter.skype.com:443 wss://*.trouter.io:443 media.licdn.com *.facebook.com onerm.olsvc.com *.qas.binginternal.com *.qas.bing.net wss://*.qas.bing.net:443 wss://*.platform.bing.com wss://*.botframework.com:443 wss://augloop.office.com wss://*.augloop.office.com outlook.live.com graph.microsoft.com *.graph.microsoft.com *.googleapis.com *.office.microsoft.com api.box.com api.dropboxapi.com *.users.storage.live.com www.onenote.com *.storage.msn.com wss://*.pushd.svc.ms wss://*.pushs.svc.ms wss://*.pushb.svc.ms wss://*.pushp.svc.ms wss://*.svc.ms nleditor.osi.officeppe.net pptservicescast.officeapps.live.com *.sharepoint-df.com *.sharepoint.com wss://*.delve.office.com:443 wss://*.loki.delve.office.com:443 wss://*.loki.delve.office.com *.delve.office.com *.loki.delve.office.com web.vortex.data.microsoft.com *.events.data.microsoft.com *.online.lync.com *.infra.lync.com wss://*.cortana.ai *.cortana.ai fs.microsoft.com 'self' attachment.outlook.live.net *.adnxs.com api.taboola.com tlx.3lift.com jill.fc.yahoo.com stage-jill.fc.yahoo.com api.msn.com ris.api.iris.microsoft.com srtb.msn.com wss://augloop-dogfood.officeppe.com wss://*.augloop-dogfood.officeppe.com wss://augloop-gcc.office.com wss://*.augloop-gcc.office.com aesir.office.com *.oscs.protection.outlook.com *.safelinks.protection.outlook.com arc.msn.com *.dynamics.com *.mos.microsoft.com; base-uri browser.pipe.aria.microsoft.com 'self'; form-action *.officeapps.live.com *.sharepoint-df.com *.sharepoint.com *.odwebp.svc.ms; object-src *.office.net 'self' attachment.outlook.live.net; frame-ancestors 'self' teams.microsoft.com; font-src data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net spoprod-a.akamaihd.net *.skype.com ms-appx-web: sharepointonline.com *.sharepointonline.com *.delve.office.com fs.microsoft.com 'self'; media-src blob: *.res.office365.com *.cdn.office.net *.skype.com *.office.net *.office365.net *.office365-net.us *.office.com 'self' attachment.outlook.live.net *.adnxs.com; frame-src * data: mailto:; manifest-src 'self'; worker-src 'self' blob: *.office.com; child-src 'self' blob: *.office.com; report-uri https://csp.microsoft.com/report/OutlookWeb-Mail-PROD; upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://sgp1.digitaloceanspaces.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers cache-control no-cache content-encoding br content-security-policy default-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net swx.cdn.skype.com 'self'; script-src 'nonce-3JjrOCzC95UfXKcz19tZnQ==' *.res.office365.com *.fluidpreview.office.net *.cdn.office.net wss://*.delve.office.com:443 shellprod.msocdn.com amcdn.msauth.net amcdn.msftauth.net *.bing.com *.skype.com *.skypeassets.com *.delve.office.com *.cdn.office.net static.teams.microsoft.com *.googleapis.com teams.microsoft.com cdn.forms.office.net blob: 'report-sample' 'self' 'wasm-unsafe-eval' acdn.adnxs.com cdn.adnxs.com *.aolcdn.com jill.fc.yahoo.com stage-jill.fc.yahoo.com jac.yahoosandbox.com stage-jac.yahoosandbox.com *.arkoselabs.com; style-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net shellprod.msocdn.com *.skype.com 'self' 'report-sample' 'unsafe-inline' *.arkoselabs.com 'unsafe-inline'; img-src * data: blob: filesystem: cid:; connect-src blob: data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.services.web.outlook.com login.live.com spoprod-a.akamaihd.net shellprod.msocdn.com *.bing.com *.office.net *.office.com *.office365.com *.officeapps.live.com *.skype.com *.skypeassets.com *.spoppe.com *.onedrive.com my.microsoftpersonalcontent.com browser.pipe.aria.microsoft.com *.gateway.messenger.live.com dev.virtualearth.net *.trouter.skype.com *.trouter.io wss://*.trouter.skype.com wss://*.trouter.skype.com:443 wss://*.trouter.io:443 media.licdn.com *.facebook.com onerm.olsvc.com *.qas.binginternal.com *.qas.bing.net wss://*.qas.bing.net:443 wss://*.platform.bing.com wss://*.botframework.com:443 wss://augloop.office.com wss://*.augloop.office.com outlook.live.com graph.microsoft.com *.graph.microsoft.com *.googleapis.com *.office.microsoft.com api.box.com api.dropboxapi.com *.users.storage.live.com www.onenote.com *.storage.msn.com wss://*.pushd.svc.ms wss://*.pushs.svc.ms wss://*.pushb.svc.ms wss://*.pushp.svc.ms wss://*.svc.ms nleditor.osi.officeppe.net pptservicescast.officeapps.live.com *.sharepoint-df.com *.sharepoint.com wss://*.delve.office.com:443 wss://*.loki.delve.office.com:443 wss://*.loki.delve.office.com *.delve.office.com *.loki.delve.office.com web.vortex.data.microsoft.com *.events.data.microsoft.com *.online.lync.com *.infra.lync.com wss://*.cortana.ai *.cortana.ai fs.microsoft.com 'self' attachment.outlook.live.net *.adnxs.com api.taboola.com tlx.3lift.com jill.fc.yahoo.com stage-jill.fc.yahoo.com api.msn.com ris.api.iris.microsoft.com srtb.msn.com wss://augloop-dogfood.officeppe.com wss://*.augloop-dogfood.officeppe.com wss://augloop-gcc.office.com wss://*.augloop-gcc.office.com aesir.office.com *.oscs.protection.outlook.com *.safelinks.protection.outlook.com arc.msn.com *.dynamics.com *.mos.microsoft.com; base-uri browser.pipe.aria.microsoft.com 'self'; form-action *.officeapps.live.com *.sharepoint-df.com *.sharepoint.com *.odwebp.svc.ms; object-src *.office.net 'self' attachment.outlook.live.net; frame-ancestors 'self' teams.microsoft.com; font-src data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net spoprod-a.akamaihd.net *.skype.com ms-appx-web: sharepointonline.com *.sharepointonline.com *.delve.office.com fs.microsoft.com 'self'; media-src blob: *.res.office365.com *.cdn.office.net *.skype.com *.office.net *.office365.net *.office365-net.us *.office.com 'self' attachment.outlook.live.net *.adnxs.com; frame-src * data: mailto:; manifest-src 'self'; worker-src 'self' blob: *.office.com; child-src 'self' blob: *.office.com; report-uri https://csp.microsoft.com/report/OutlookWeb-Mail-PROD; upgrade-insecure-requests; content-type text/html date Tue, 18 Oct 2022 08:36:25 GMT expires -1 ms-cv 7RQwV5pTsJA7wSuEdfgzlA.1.1 pragma no-cache referrer-policy strict-origin request-id 573014ed-539a-90b0-3bc1-2b8475f83394 runtime_model B2 server Microsoft-IIS/10.0 strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-app-name Mail x-backendhttpstatus 200 200 x-bepartition CLEURPRD06DUB07 x-beserver DB9PR06MB7436 x-besku UNKNOWN x-calculatedbetarget DB9PR06MB7436.EURPRD06.PROD.OUTLOOK.COM x-calculatedfetarget DU2PR04CU012.internal.outlook.com x-client-version 20221006031.10 x-clique CLEURPRD06DUB07 x-feefzinfo DHR x-feproxyinfo AM5PR0602CA0001.EURPRD06.PROD.OUTLOOK.COM x-feserver DU2PR04CA0344 AM5PR0602CA0001 x-firsthopcafeefz DHR x-powered-by ASP.NET x-preferredroutingkeydiagnostics 0 x-proxy-backendserverstatus 200 x-proxy-routingcorrectness 1 x-rum-validated 1 x-web-server-version 22.10.7.2
GET H/1.1	200 OK	Converged.css leepsolutions.co.za/css/	106 KB 106 KB	1239ms 353ms	Stylesheet text/css	196.41.122.224 Cybersmart
General Check archive.org Show headers Download Go to Full URL https://leepsolutions.co.za/css/Converged.css Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 196.41.122.224 Kempton Park, South Africa, ASN36874 (Cybersmart, ZA), Reverse DNS cpanel28.mywebserver.co.za Software nginx / Resource Hash 0603673e88c54ce422463cedaf6ac9fea8bb09b8f1e40a690eacb7f92e0849e8 Request headers accept-language it-IT,it;q=0.9 Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Tue, 18 Oct 2022 08:36:26 GMT Last-Modified Mon, 22 Aug 2022 18:11:10 GMT Server nginx Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 108546
GET H/1.1	200 OK	wp-muter.css leepsolutions.co.za/wp-includes/css/	1 KB 2 KB	1063ms 181ms	Stylesheet text/css	196.41.122.224 Cybersmart
General Check archive.org Show headers Download Go to Full URL https://leepsolutions.co.za/wp-includes/css/wp-muter.css Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 196.41.122.224 Kempton Park, South Africa, ASN36874 (Cybersmart, ZA), Reverse DNS cpanel28.mywebserver.co.za Software nginx / Resource Hash 01c5170f0704fabc9588118ccbee06864e2446e515e2ddc03d5bfc8f93102d80 Request headers accept-language it-IT,it;q=0.9 Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Tue, 18 Oct 2022 08:36:26 GMT Last-Modified Tue, 23 Aug 2022 14:00:23 GMT Server nginx Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1397
GET H/1.1	200 OK	bootload.css leepsolutions.co.za/css/	1 KB 1 KB	1065ms 180ms	Stylesheet text/css	196.41.122.224 Cybersmart
General Check archive.org Show headers Download Go to Full URL https://leepsolutions.co.za/css/bootload.css Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 196.41.122.224 Kempton Park, South Africa, ASN36874 (Cybersmart, ZA), Reverse DNS cpanel28.mywebserver.co.za Software nginx / Resource Hash 1566af7bbc97a7553824577eea286d1833de04fd1163ed786be4f083880da62e Request headers accept-language it-IT,it;q=0.9 Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Tue, 18 Oct 2022 08:36:26 GMT Last-Modified Thu, 08 Sep 2022 04:21:52 GMT Server nginx Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1290
GET H/1.1	200 OK	Depan.css leepsolutions.co.za/css/	7 KB 7 KB	1064ms 179ms	Stylesheet text/css	196.41.122.224 Cybersmart
General Check archive.org Show headers Download Go to Full URL https://leepsolutions.co.za/css/Depan.css Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 196.41.122.224 Kempton Park, South Africa, ASN36874 (Cybersmart, ZA), Reverse DNS cpanel28.mywebserver.co.za Software nginx / Resource Hash 9a876b21f916adbb0df0e6a6c90d8901d81e5275730407c5a7edef551cefd7fa Request headers accept-language it-IT,it;q=0.9 Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Tue, 18 Oct 2022 08:36:26 GMT Last-Modified Tue, 27 Sep 2022 16:44:44 GMT Server nginx Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 6915
GET H/1.1	200 OK	logo.svg leepsolutions.co.za/wp-content/themes/twentynineteen/img/	4 KB 4 KB	1065ms 178ms	Image image/svg+xml	196.41.122.224 Cybersmart
General Check archive.org Show headers Download Go to Show image Full URL https://leepsolutions.co.za/wp-content/themes/twentynineteen/img/logo.svg Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 196.41.122.224 Kempton Park, South Africa, ASN36874 (Cybersmart, ZA), Reverse DNS cpanel28.mywebserver.co.za Software nginx / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language it-IT,it;q=0.9 Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Tue, 18 Oct 2022 08:36:26 GMT Last-Modified Thu, 08 Sep 2022 12:30:57 GMT Server nginx Vary Accept-Encoding Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 3651
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 34 KB	116ms 35ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:09:43 GMT content-encoding gzip x-content-type-options nosniff age 1602 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 18 Oct 2023 08:09:43 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/	57 KB 16 KB	75ms 30ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:36:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 601, 617, 617 age 15395474 cdn-cachedat 2021-04-23 05:56:27 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:08 GMT server cloudflare cdn-requestpullcode 200 vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 13a164c1391b56541d90ff7de83aa7ab timing-allow-origin * cdn-requestcountrycode EG cf-ray 75bff23d391759b3-MXP cdn-requestpullsuccess True
GET H2	200	bootstrap.bundle.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/	77 KB 22 KB	91ms 46ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.bundle.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:36:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 601, 617, 617 age 15394509 cdn-cachedat 2021-04-23 05:36:00 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:08 GMT server cloudflare cdn-requestpullcode 200 vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 0c8e21cb7e0712b60af2b3a6215fe617 timing-allow-origin * cdn-requestcountrycode EG cf-ray 75bff23d391c59b3-MXP cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/	85 KB 27 KB	77ms 26ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:36:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 3422180 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27433 last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1538f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5fEAmKWRIpgdXlLGl%2B1gnK5xzSWjuRgEW5UHVfIhKZQ0rOgHCLFFYU2LeWsztskFb2vH1zwQDYKMFVUj18gYFzjYyAMJmDR0zCrahHcC9DxBiW2tMla6jK4hHuxadMeNRopTaEb%2BOnu86bg9VJm8nHSr"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 75bff23d3875bafd-MXP expires Sun, 08 Oct 2023 08:36:25 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	138ms 57ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:21:57 GMT content-encoding gzip x-content-type-options nosniff age 868 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 18 Oct 2023 08:21:57 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 14 KB	76ms 31ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: ghstwins.shop URL: http://ghstwins.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 18 Oct 2022 08:36:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 723, 617, 617 age 5233802 cdn-cachedat 2021-07-24 10:52:10 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid c60073e21cbf9fb14834b984d87d67f4 timing-allow-origin * cdn-requestcountrycode EG cdn-status 200 cf-ray 75bff23d391f59b3-MXP cdn-requestpullsuccess True
POST H2	200	OutlookWeb-Mail-PROD csp.microsoft.com/report/	2 B 246 B	452ms 276ms	Other text/plain	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://csp.microsoft.com/report/OutlookWeb-Mail-PROD Requested by Host: sgp1.digitaloceanspaces.com URL: https://sgp1.digitaloceanspaces.com/65cfe2c6-7dc4-439a-b57f-81165e59cdba65cfe2c6-7dc4-439a-b57f/NoVoice.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://sgp1.digitaloceanspaces.com/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Content-Type application/csp-report Response headers access-control-allow-origin * date Tue, 18 Oct 2022 08:36:25 GMT request-context appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref 0imVOYwAAAACLF6JJqG0iQZaiwrjTIiu0TUlMMzBFREdFMDYyMQA4NGJmZDMzYi0zY2JjLTRhZDMtOTg2Yy0wZGRmYjU3OWM4ZDQ= x-cache CONFIG_NOCACHE content-type text/plain; charset=utf-8
GET DATA	200 OK	truncated /	746 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a0585cf97751506584bac5a945b8ea2730517e9d97f2018a0e0fcd21c044ac5 Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap object| jQuery112406940282114245333 string| LinkPHP function| redirectCU function| redirectKK

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.live.com/	1970-01-20 15:33:38	Name: ClientId Value: 0809C3B114C24D66860E930B5A6834E2

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.bundle.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	Message: Refused to frame 'https://outlook.live.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' teams.microsoft.com".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
csp.microsoft.com
ghstwins.shop
leepsolutions.co.za
outlook.live.com
sgp1.digitaloceanspaces.com
stackpath.bootstrapcdn.com
103.253.144.208
196.41.122.224
20.231.2.161
2603:1026:203:9f::2
2606:4700::6811:190e
2606:4700::6812:bcf
2620:1ec:46::45
2a00:1450:4001:82b::200a
01c5170f0704fabc9588118ccbee06864e2446e515e2ddc03d5bfc8f93102d80
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0603673e88c54ce422463cedaf6ac9fea8bb09b8f1e40a690eacb7f92e0849e8
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
1566af7bbc97a7553824577eea286d1833de04fd1163ed786be4f083880da62e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5a0585cf97751506584bac5a945b8ea2730517e9d97f2018a0e0fcd21c044ac5
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
9a876b21f916adbb0df0e6a6c90d8901d81e5275730407c5a7edef551cefd7fa
dfbbb3217a3208e0b09866173f3f8df71bb9380a3ed500d65ced3721b6c887f3