sgp1.digitaloceanspaces.com Open in urlscan Pro
103.253.144.208  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Y38839gh.html Show response sgp1.digitaloceanspaces.com/39940403040sp/	130 KB 130 KB	40ms 21ms	Document text/html	103.253.144.208 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.253.144.208 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS sgp1.digitaloceanspaces.com Software / Resource Hash c90bfc93161fe595a520402c48d63bc0ebea95bacf73b9cee129996e7d04cc7c Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers accept-ranges bytes content-length 133015 content-type text/html date Thu, 08 Aug 2024 13:03:26 GMT etag "9d241b7e775d0dc2fdbb8d0d62a461e0" last-modified Wed, 07 Aug 2024 12:33:50 GMT strict-transport-security max-age=15552000; includeSubDomains; preload vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method x-amz-request-id tx0000002f1df599f35a10a-0066b4c21e-3cc88ff8-sgp1b x-envoy-upstream-healthchecked-cluster x-rgw-object-type Normal
GET H2	403	hover.css sgp1.digitaloceanspaces.com/39940403040sp/css/	0 0	22ms 21ms	Stylesheet application/xml	103.253.144.208 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://sgp1.digitaloceanspaces.com/39940403040sp/css/hover.css Requested by Host: sgp1.digitaloceanspaces.com URL: https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.253.144.208 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS sgp1.digitaloceanspaces.com Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Thu, 08 Aug 2024 13:03:26 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-amz-request-id tx00000f37060f8e01f3ed1-0066b4c21e-3cc9162e-sgp1b x-envoy-upstream-healthchecked-cluster vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method content-type application/xml cache-control max-age=0 accept-ranges bytes content-length 248
GET H2	401	ii_c5byfb.png res.cloudinary.com/pta/image/upload/v1631524936/	26 B 26 B	199ms 36ms	Image text/plain	2606:4700::6811:c901 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://res.cloudinary.com/pta/image/upload/v1631524936/ii_c5byfb.png Requested by Host: sgp1.digitaloceanspaces.com URL: https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:c901 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash df60ebf3b7f6345c95e6b2f9a8d07fb7f2320a3e735ce4b2919f529a03d7c57b Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers pragma no-cache date Thu, 08 Aug 2024 13:03:26 GMT strict-transport-security max-age=604800 server cloudflare vary Accept-Encoding content-type text/plain;charset=UTF-8 access-control-allow-origin * access-control-expose-headers Content-Length,Server-Timing cache-control private, no-transform, max-age=0, no-cache server-timing cld-cloudflare;dur=15;start=2024-08-08T13:03:26.318Z;desc=hit,rtt;dur=3 accept-ranges none timing-allow-origin * cf-ray 8affb4dd6d6e409b-SIN content-length 26
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	41ms 5ms	Script text/javascript	2404:6800:4003:c1c::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: sgp1.digitaloceanspaces.com URL: https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4003:c1c::5f Singapore, Singapore, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://sgp1.digitaloceanspaces.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Tue, 06 Aug 2024 07:03:53 GMT content-encoding gzip x-content-type-options nosniff age 194373 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Aug 2025 07:03:53 GMT
GET H2	404	favicon.ico sgp1.digitaloceanspaces.com/	246 B 323 B	8ms 8ms	Other application/xml	103.253.144.208 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://sgp1.digitaloceanspaces.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 103.253.144.208 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS sgp1.digitaloceanspaces.com Software / Resource Hash 634f95bd38e61b4ea3c46b4d3dfc142817c87fc185f0a4e3b9720dea26b2ead4 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Thu, 08 Aug 2024 13:03:26 GMT strict-transport-security max-age=15552000; includeSubDomains; preload x-amz-request-id tx00000f99387f6233c42e4-0066b4c21e-3cc88ff8-sgp1b x-envoy-upstream-healthchecked-cluster content-type application/xml cache-control max-age=0 accept-ranges bytes content-length 246

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| myFunction function| validate object| locate string| text function| delineate number| theright function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sgp1.digitaloceanspaces.com/39940403040sp/css/hover.css Message: Failed to load resource: the server responded with a status of 403 ()
recommendation	verbose	URL: https://sgp1.digitaloceanspaces.com/39940403040sp/Y38839gh.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://res.cloudinary.com/pta/image/upload/v1631524936/ii_c5byfb.png Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://sgp1.digitaloceanspaces.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
res.cloudinary.com
sgp1.digitaloceanspaces.com
103.253.144.208
2404:6800:4003:c1c::5f
2606:4700::6811:c901
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
634f95bd38e61b4ea3c46b4d3dfc142817c87fc185f0a4e3b9720dea26b2ead4
c90bfc93161fe595a520402c48d63bc0ebea95bacf73b9cee129996e7d04cc7c
df60ebf3b7f6345c95e6b2f9a8d07fb7f2320a3e735ce4b2919f529a03d7c57b