urlscan.io logo urlscan.io
SecurityTrails logo

drbethwestie.com Open in urlscan Pro
45.60.98.166  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://instaedit.in/ui/
Effective URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1...
Submission Tags: falconsandbox
Submission: On May 12 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 57 HTTP transactions. The main IP is 45.60.98.166, located in United States and belongs to INCAPSULA, US. The main domain is drbethwestie.com. The Cisco Umbrella rank of the primary domain is 501146.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2022 Q2 on May 11th 2022. Valid for: 6 months.
This is the only time drbethwestie.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 168.119.9.104 24940 (HETZNER-AS)
2 9 45.60.98.166 19551 (INCAPSULA)
1 2620:1ec:bdf::45 8068 (MICROSOFT...)
2 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
57 6
1    168.119.9.104 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.104.9.119.168.clients.your-server.de
instaedit.in
9    45.60.98.166 (United States)

ASN19551 (INCAPSULA, US)
drbethwestie.com
1    2620:1ec:bdf::45 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
2    2a06:98c1:3121::a (United States)

ASN13335 (CLOUDFLARENET, US)
imgdb.net
1    2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
Apex Domain
Subdomains		 Transfer
9 drbethwestie.com
drbethwestie.com — Cisco Umbrella Rank: 501146
108 KB
2 imgdb.net
imgdb.net
116 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 660
30 KB
1 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1324
2 KB
1 instaedit.in
instaedit.in
395 B
0 googletagmanager.com Failed
www.googletagmanager.com Failed
57 6
Domain Requested by
9 drbethwestie.com 2 redirects drbethwestie.com
instaedit.in
2 imgdb.net drbethwestie.com
1 code.jquery.com drbethwestie.com
1 aadcdn.msauth.net drbethwestie.com
1 instaedit.in
0 www.googletagmanager.com Failed drbethwestie.com
57 6

This site contains links to these domains. Also see Links.

Domain
login.live.com
login.microsoftonline.com
Subject Issuer Validity Valid
instaedit.in
cPanel, Inc. Certification Authority		 2022-02-15 -
2022-05-16		 3 months crt.sh
imperva.com
GlobalSign Atlas R3 DV TLS CA 2022 Q2		 2022-05-11 -
2022-11-09		 6 months crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2022-02-22 -
2023-02-22		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-11 -
2023-05-10		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh

This page contains 2 frames:

Primary Page: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Frame ID: 274BE55E54065178E0CB0A1DB1E008FE
Requests: 12 HTTP requests in this frame

Frame: https://drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/prefetch(1).html
Frame ID: B56E4A5C48CB3EBBCC1BB4FF661C91DF
Requests: 45 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

  1. https://instaedit.in/ui/ Page URL
  2. https://drbethwestie.com/ysuwoo Page URL
  3. https://drbethwestie.com/ysuwoo HTTP 301
    https://drbethwestie.com/ysuwoo/ HTTP 302
    https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&12... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

57
Requests

21 %
HTTPS

60 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

256 kB
Transfer

676 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://instaedit.in/ui/ Page URL
  2. https://drbethwestie.com/ysuwoo Page URL
  3. https://drbethwestie.com/ysuwoo HTTP 301
    https://drbethwestie.com/ysuwoo/ HTTP 302
    https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

57 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
instaedit.in/ui/ 		333 B
395 B 		Document
General
Check archive.org
Download Go to
Full URL
https://instaedit.in/ui/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
168.119.9.104 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.104.9.119.168.clients.your-server.de
Software
LiteSpeed / PHP/7.3.33
Resource Hash
b113167c028216842c38ec39f64bdad5f83320c10433eefb75d2458c80b74c49

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
132
content-type
text/html; charset=UTF-8
date
Thu, 12 May 2022 15:57:07 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.3.33
ysuwoo
drbethwestie.com/ 		212 B
553 B 		Document
General
Check archive.org
Download Go to
Full URL
https://drbethwestie.com/ysuwoo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d

Request headers

Referer
https://instaedit.in/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
content-length
212
content-type
text/html
x-iinfo
14-7285954-0 0NNN RT(1652371029412 131) q(0 -1 -1 1) r(0 -1) B10(4,314,0) U18
_Incapsula_Resource
drbethwestie.com/ 		172 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://drbethwestie.com/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
f07396cdd4a453a2deab210f601e1e8bc18f4a42924c7e626b91eb450a98f737

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/ysuwoo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-encoding
gzip
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
25073
content-type
application/javascript
_Incapsula_Resource
drbethwestie.com/ 		29 B
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://drbethwestie.com/_Incapsula_Resource?SWHANEDL=2753594738163490810,7342740903799431544,6531543414855098430,21978
Requested by
Host: instaedit.in
URL: https://instaedit.in/ui/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/ysuwoo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
29
content-type
application/javascript
Primary Request xzp5tt9ppu4rc7zf9n3czjcd.php
drbethwestie.com/ysuwoo/
Redirect Chain
  • https://drbethwestie.com/ysuwoo
  • https://drbethwestie.com/ysuwoo/
  • https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
202 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Requested by
Host: instaedit.in
URL: https://instaedit.in/ui/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Apache /
Resource Hash
8525f6d3afdd02407dc4648c6922b2690be79909d146a27adaa4e6fe767b2482

Request headers

Referer
https://drbethwestie.com/ysuwoo
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 12 May 2022 15:57:10 GMT
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
server
Apache
vary
Accept-Encoding
x-cdn
Imperva
x-endurance-cache-level
0
x-iinfo
14-7285954-7286232 PNNN RT(1652371029412 1371) q(0 0 0 -1) r(1 1) U12
x-nginx-cache
WordPress

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Thu, 12 May 2022 15:57:10 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
location
xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
pragma
no-cache
server
Apache
x-cdn
Imperva
x-endurance-cache-level
0
x-iinfo
14-7285954-7286232 PNNN RT(1652371029412 1173) q(0 0 0 -1) r(1 1) U11
x-nginx-cache
WordPress
_Incapsula_Resource
drbethwestie.com/ 		1 B
89 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://drbethwestie.com/_Incapsula_Resource?SWKMTFSR=1&e=0.6795980076356374
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/ysuwoo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain
_Incapsula_Resource
drbethwestie.com/ 		0
0
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 12 May 2022 15:57:10 GMT
content-encoding
gzip
x-azure-ref-originshield
0rkR7YgAAAAAq445eKfl/SL+o4HHi6mKsQU1TMDRFREdFMTgxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
TCP_HIT
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:38 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D79B8373CB2849
x-azure-ref
0Vy59YgAAAABzvDnJ3WrXRbskqpIvHZLxRlJBRURHRTEwMjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
a068c09f-201e-0001-109f-611c71000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36.png
imgdb.net/storage/uploads/ 		57 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://imgdb.net/storage/uploads/9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36.png?x=138bcee624fa04ef9b75e86211a9fe0d
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 15:57:11 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3890
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58722
last-modified
Sun, 06 Mar 2022 18:41:28 GMT
server
cloudflare
etag
"62250058-e562"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=top5HwbUt9N3k3UmJcFKytpvJfLDE065haMH5ZhnjKbkogwrEHLuYp6R0O5J6wMGBNhG5taRQ44dKAzFbPtpWvblKvJJgFu77yDEfYD%2FHcJqCl1y0lHko9rMcB5gYzyo1yvWxWeMKnY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
70a459418c049b8c-FRA
9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36.png
imgdb.net/storage/uploads/ 		57 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://imgdb.net/storage/uploads/9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36.png?x=a5dbd4393ff6a725c7e62b61df7e72f0
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c044e63760691b0884d4abc3efe3b875ad95433467936eae55f2071010a0a36

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 15:57:11 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3890
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58722
last-modified
Sun, 06 Mar 2022 18:41:28 GMT
server
cloudflare
etag
"62250058-e562"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKOP2vuiacNnZi2ZD%2Fi1ANjMYIKYNZCaMDUZknlmmuWgH1n5FDtyFFaew5%2BCVAhv0IZEKuZkfgYCXCIYVtmFj5vPxaJ2xPG7bm4GmhUR%2FmtcToVPQZUJiAv%2FBytlhpoxu%2BvQcgWZO84%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
70a459419c069b8c-FRA
prefetch(1).html
drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/ Frame B56E 		72 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/prefetch(1).html
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Apache /
Resource Hash
dd3f5101a1db50de383a18259e62dc799f4d982984c41b9a3acea165eb8f74bc

Request headers

Referer
https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, must-revalidate, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 12 May 2022 15:57:11 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
link
<https://drbethwestie.com/wp-json/>; rel="https://api.w.org/"
server
Apache
vary
Accept-Encoding
x-cdn
Imperva
x-endurance-cache-level
0
x-iinfo
14-7285954-7286485 NNNN CT(41 52 0) RT(1652371029412 1709) q(0 0 1 -1) r(1 6) U11
x-nginx-cache
WordPress
ellipsis_grey.svg
drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/ellipsis_grey.svg
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.98.166 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Apache /
Resource Hash
7736ca4bca6ecb89eecba27a301bae1ab16bf8edac1c40c3549e04126f7350a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 15:57:11 GMT
content-encoding
gzip
x-nginx-cache
WordPress
server
Apache
vary
Accept-Encoding
x-endurance-cache-level
0
content-type
text/html; charset=UTF-8
x-iinfo
14-7285954-7286232 PNNN RT(1652371029412 1705) q(0 0 0 -1) r(5 5) U11
cache-control
no-cache, must-revalidate, max-age=0
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
link
<https://drbethwestie.com/wp-json/>; rel="https://api.w.org/"
x-cdn
Imperva
expires
Wed, 11 Jan 1984 05:00:00 GMT
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: drbethwestie.com
URL: https://drbethwestie.com/ysuwoo/xzp5tt9ppu4rc7zf9n3czjcd.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://drbethwestie.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 15:57:11 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-1538f"
vary
Accept-Encoding
x-hw
1652371031.dop126.fr8.t,1652371031.cds281.fr8.hn,1652371031.cds057.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30288
js
www.googletagmanager.com/gtag/ Frame B56E 		0
0
style.min.css
drbethwestie.com/wp-includes/css/dist/block-library/ Frame B56E 		0
0
video-container.min.css
drbethwestie.com/wp-content/plugins/simple-embed-code/css/ Frame B56E 		0
0
style.min.css
drbethwestie.com/wp-content/themes/hello-elementor/ Frame B56E 		0
0
theme.min.css
drbethwestie.com/wp-content/themes/hello-elementor/ Frame B56E 		0
0
elementor-icons.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/lib/eicons/css/ Frame B56E 		0
0
frontend-legacy.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/css/ Frame B56E 		0
0
frontend.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/css/ Frame B56E 		0
0
post-1380.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
frontend.min.css
drbethwestie.com/wp-content/plugins/elementor-pro/assets/css/ Frame B56E 		0
0
global.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
post-34.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
post-152.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
post-241.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
post-2094.css
drbethwestie.com/wp-content/uploads/elementor/css/ Frame B56E 		0
0
fontawesome.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ Frame B56E 		0
0
solid.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/ Frame B56E 		0
0
frontend-gtag.min.js
drbethwestie.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/ Frame B56E 		0
0
wp-emoji-release.min.js
drbethwestie.com/wp-includes/js/ Frame B56E 		0
0
animations.min.css
drbethwestie.com/wp-content/plugins/elementor/assets/lib/animations/ Frame B56E 		0
0
jquery.min.js
drbethwestie.com/wp-includes/js/jquery/ Frame B56E 		0
0
jquery-migrate.min.js
drbethwestie.com/wp-includes/js/jquery/ Frame B56E 		0
0
jquery.smartmenus.min.js
drbethwestie.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/ Frame B56E 		0
0
frontend.js
drbethwestie.com/wp-content/plugins/pixel-caffeine/build/ Frame B56E 		0
0
webpack-pro.runtime.min.js
drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/ Frame B56E 		0
0
webpack.runtime.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/js/ Frame B56E 		0
0
frontend-modules.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/js/ Frame B56E 		0
0
regenerator-runtime.min.js
drbethwestie.com/wp-includes/js/dist/vendor/ Frame B56E 		0
0
wp-polyfill.min.js
drbethwestie.com/wp-includes/js/dist/vendor/ Frame B56E 		0
0
hooks.min.js
drbethwestie.com/wp-includes/js/dist/ Frame B56E 		0
0
i18n.min.js
drbethwestie.com/wp-includes/js/dist/ Frame B56E 		0
0
frontend.min.js
drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/ Frame B56E 		0
0
waypoints.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/lib/waypoints/ Frame B56E 		0
0
core.min.js
drbethwestie.com/wp-includes/js/jquery/ui/ Frame B56E 		0
0
swiper.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/lib/swiper/ Frame B56E 		0
0
share-link.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/lib/share-link/ Frame B56E 		0
0
dialog.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/lib/dialog/ Frame B56E 		0
0
frontend.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/js/ Frame B56E 		0
0
preloaded-elements-handlers.min.js
drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/ Frame B56E 		0
0
preloaded-modules.min.js
drbethwestie.com/wp-content/plugins/elementor/assets/js/ Frame B56E 		0
0
jquery.sticky.min.js
drbethwestie.com/wp-content/plugins/elementor-pro/assets/lib/sticky/ Frame B56E 		0
0
underscore.min.js
drbethwestie.com/wp-includes/js/ Frame B56E 		0
0
wp-util.min.js
drbethwestie.com/wp-includes/js/ Frame B56E 		0
0
frontend.min.js
drbethwestie.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/ Frame B56E 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
drbethwestie.com
URL
https://drbethwestie.com/_Incapsula_Resource?ES2LURCT=67&t=78&d=complete%20(s%3A2%2Cc%3A132%2Cr%3A781)
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=UA-133145997-1
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/simple-embed-code/css/video-container.min.css?ver=5.9.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/themes/hello-elementor/style.min.css?ver=2.5.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/themes/hello-elementor/theme.min.css?ver=2.5.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.15.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/post-1380.css?ver=1652201160
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.7.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/global.css?ver=1652201220
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/post-34.css?ver=1652201160
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/post-152.css?ver=1652201160
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/post-241.css?ver=1652201220
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/uploads/elementor/css/post-2094.css?ver=1652201160
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=5.15.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=8.5.2
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.0.1
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/pixel-caffeine/build/frontend.js?ver=2.3.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.min.js?ver=3.7.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.6.5
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver=3.7.0
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/underscore.min.js?ver=1.13.1
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-includes/js/wp-util.min.js?ver=5.9.3
Domain
drbethwestie.com
URL
https://drbethwestie.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.4.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror

3 Cookies

Domain/Path Name / Value
.drbethwestie.com/ Name: visid_incap_2764287
Value: 03zd7zQdQpOtOHVbsOgAJFUufWIAAAAAQUIPAAAAAAAO1gogOHwxSwl68CYRgr97
.drbethwestie.com/ Name: incap_ses_1446_2764287
Value: hTVCMqJ0mRW6yNA+mjkRFFUufWIAAAAAb9J0aIZnGVophyurHnMAjA==
drbethwestie.com/ Name: PHPSESSID
Value: 83a8187657a78dbd24ecb092f7628929

2 Console Messages

Source Level URL
Text
network error URL: https://drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/ellipsis_grey.svg
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://drbethwestie.com/ysuwoo/Sign%20in%20to%20your%20account_files/prefetch(1).html
Message:
Failed to load resource: the server responded with a status of 404 ()