dourahost.com Open in urlscan Pro
206.51.228.226  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://dourahost.com/onupd/adobe-home/index.html Page URL
2. https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.html Show response dourahost.com/onupd/adobe-home/	3 KB 3 KB	399ms 123ms	Document text/html	206.51.228.226 HVC-AS
General Check archive.org Show headers Download Go to Full URL https://dourahost.com/onupd/adobe-home/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 206.51.228.226 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 206-51-228-226.static.hvvc.us Software Apache / Resource Hash e003370842999f7305c6297d1a04f3ce2c6f67e423792f87550b9f644f518a92 Request headers Host dourahost.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 06 May 2021 09:07:35 GMT Server Apache Last-Modified Thu, 21 May 2020 14:01:44 GMT Accept-Ranges bytes Content-Length 3213 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://dourahost.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 05 May 2021 16:47:38 GMT content-encoding gzip x-content-type-options nosniff age 58797 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 05 May 2022 16:47:38 GMT
GET H/1.1	200 OK	Primary Request login.html Show response dourahost.com/onupd/adobe-home/	780 KB 780 KB	124ms 124ms	Document text/html	206.51.228.226 HVC-AS
General Check archive.org Show headers Download Go to Full URL https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 206.51.228.226 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 206-51-228-226.static.hvvc.us Software Apache / Resource Hash 2b22d9a53455d7f24028000cb8927e3d476d197c49a37f79c9e1682959bb530b Request headers Host dourahost.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://dourahost.com/onupd/adobe-home/index.html Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://dourahost.com/onupd/adobe-home/index.html Response headers Date Thu, 06 May 2021 09:07:35 GMT Server Apache Last-Modified Fri, 19 Jun 2020 02:23:28 GMT Accept-Ranges bytes Content-Length 798406 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	font-awesome.css dourahost.com/onupd/adobe-home/Sign-In-PDF-CLOUD_files/	0 186 B	237ms 236ms	Stylesheet text/html	206.51.228.226 HVC-AS
General Check archive.org Show headers Download Go to Full URL https://dourahost.com/onupd/adobe-home/Sign-In-PDF-CLOUD_files/font-awesome.css Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 206.51.228.226 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 206-51-228-226.static.hvvc.us Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host dourahost.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,*/*;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Connection keep-alive Referer https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 06 May 2021 09:07:36 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 0 Content-Type text/html; charset=utf-8
GET H2	200	jquery-3.3.1.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	85 KB 30 KB	31ms 9ms	Script application/javascript	152.199.19.160 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.19.160 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F2D) / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://dourahost.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 06 May 2021 09:07:36 GMT content-encoding gzip x-content-type-options nosniff age 4752669 x-cache HIT content-length 30394 x-xss-protection 1; mode=block last-modified Mon, 22 Jan 2018 19:27:49 GMT server ECAcc (frc/8F2D) etag "80288516b793d31:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET DATA	200 OK	truncated /	1001 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 634e6e82dbd1604a2cfd9b0303f024ef20c71eca2d655a3a2c2fd5680a5a3ed9 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	qLcPmYb.jpg i.imgur.com/	48 KB 48 KB	34ms 16ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/qLcPmYb.jpg Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 180f3bc8288f8f33b56133542536937dadecc33ceb27fcba770739061a4f5f80 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://dourahost.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 06 May 2021 09:07:36 GMT x-content-type-options nosniff age 3018532 x-cache HIT, HIT content-length 48843 x-served-by cache-bwi5135-BWI, cache-hhn4069-HHN last-modified Sat, 29 Dec 2018 09:03:04 GMT server cat factory 1.0 x-timer S1620292056.359637,VS0,VE1 etag "47eb410e11eb45bef6391d125b3dec31" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H/1.1	200 OK	login.html dourahost.com/onupd/adobe-home/	64 KB 64 KB	125ms 124ms	Image text/html	206.51.228.226 HVC-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Requested by Host: dourahost.com URL: https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 206.51.228.226 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 206-51-228-226.static.hvvc.us Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host dourahost.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x Connection keep-alive Referer https://dourahost.com/onupd/adobe-home/login.html?log=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x&log2=CE5nCaUi8COR8TAHSeN36M26XP1BqQkykAHrdYrzbT17EMBb4KpbtqW9IQ7wtNMN5fWLSFlkb1vlimgu20jiJgU3t5hwI02awJ2x User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 06 May 2021 09:07:36 GMT Last-Modified Fri, 19 Jun 2020 02:23:28 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 798406

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Adobe Update

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _0x2c2d function| _0x50f6 object| CryptoJS object| Zlib function| templatePage function| $ function| jQuery function| mg

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
ajax.googleapis.com
dourahost.com
i.imgur.com
151.101.112.193
152.199.19.160
206.51.228.226
2a00:1450:4001:831::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
180f3bc8288f8f33b56133542536937dadecc33ceb27fcba770739061a4f5f80
2b22d9a53455d7f24028000cb8927e3d476d197c49a37f79c9e1682959bb530b
634e6e82dbd1604a2cfd9b0303f024ef20c71eca2d655a3a2c2fd5680a5a3ed9
e003370842999f7305c6297d1a04f3ce2c6f67e423792f87550b9f644f518a92
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855