repdata.c-sgroup.com Open in urlscan Pro
63.240.117.228 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://semimasssi.blogspot.com/
Effective URL:
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/
Submission Tags: 7010024
Submission: On March 09 via api (March 9th 2021, 1:07:39 pm UTC) from NL

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 9 HTTP transactions. The main IP is 63.240.117.228, located in United States and belongs to ATT-CERFNET-BLOCK, US. The main domain is repdata.c-sgroup.com.

This is the only time repdata.c-sgroup.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OVH (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2009	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
3 4	63.240.117.228 63.240.117.228	17232 (ATT-CERFN...) (ATT-CERFNET-BLOCK)
9	6

3 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

semimasssi.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

themes.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 63.240.117.228 (United States) 3 redirects

ASN17232 (ATT-CERFNET-BLOCK, US)
PTR: promoitems.c-sgroup.com

repdata.c-sgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	c-sgroup.com 3 redirects repdata.c-sgroup.com	45 KB
3	blogspot.com semimasssi.blogspot.com	19 KB
2	blogger.com www.blogger.com	55 KB
1	googleusercontent.com themes.googleusercontent.com	224 KB
1	blogblog.com resources.blogblog.com	47 KB
1	gstatic.com www.gstatic.com	4 KB
9	6

	Domain	Requested by
4	repdata.c-sgroup.com	3 redirects
3	semimasssi.blogspot.com	semimasssi.blogspot.com
2	www.blogger.com	semimasssi.blogspot.com
1	themes.googleusercontent.com	semimasssi.blogspot.com
1	resources.blogblog.com	semimasssi.blogspot.com
1	www.gstatic.com	semimasssi.blogspot.com
9	6

This site contains links to these domains. Also see Links.

Domain
www.ovh.com

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.blogger.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/
Frame ID: CFAADAB3EB33955D963938BF3E317F14
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://semimasssi.blogspot.com/ Page URL
http://repdata.c-sgroup.com/FR/Ovh.web HTTP 301
http://repdata.c-sgroup.com/FR/Ovh.web/ HTTP 302
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8 HTTP 301
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/ Page URL

Detected technologies

Blogger (Blogs) Expand

Overall confidence: 100%
Detected patterns

url /^https?:\/\/[^/]+\.blogspot\.com/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /^https?:\/\/[^/]+\.blogspot\.com/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

Page Statistics

9
Requests

89 %
HTTPS

80 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

393 kB
Transfer

709 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ovh.com/fr/
Title: Copyright OVH 1999 - 2020

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://semimasssi.blogspot.com/ Page URL
http://repdata.c-sgroup.com/FR/Ovh.web HTTP 301
http://repdata.c-sgroup.com/FR/Ovh.web/ HTTP 302
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8 HTTP 301
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
semimasssi.blogspot.com/ 64 KB
15 KB 197ms
154ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://semimasssi.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

92ca0d6ddc2183dfa7c3d036d25cd0e854e5874105a6e4f6e5b67fd1bca9639f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: semimasssi.blogspot.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
expires: Tue, 09 Mar 2021 13:07:22 GMT
date: Tue, 09 Mar 2021 13:07:22 GMT
cache-control: private, max-age=0
last-modified: Tue, 09 Mar 2021 12:17:30 GMT
etag: W/"0e5809fdf5fb844f9f50a26131c4c3326e1dbeb539023864c29e1a824831e251"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 14798
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 clipboard.min.js Show response
www.gstatic.com/external_hosted/clipboardjs/ 12 KB
4 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a00d3cabd4a8dbdbd2e992e238d11ec889fb3cc7751d9bc271f063a17ec8bf7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 13:07:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 0
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4096
x-xss-protection: 0
expires: Tue, 09 Mar 2021 13:07:23 GMT

GET
H2 200 4088626223-indie_compiled.js Show response
resources.blogblog.com/blogblog/data/res/ 136 KB
47 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:82a::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.blogblog.com/blogblog/data/res/4088626223-indie_compiled.js

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b133050a469454e669debd992f116fc1c413d1035733336740120c02f3160947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 00:26:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Mar 2021 12:12:25 GMT
server: sffe
age: 391249
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47678
x-xss-protection: 0
expires: Fri, 12 Mar 2021 00:26:34 GMT

GET
H3-Q050 200 sprite_v1_6.css.svg
semimasssi.blogspot.com/responsive/ 7 KB
3 KB 40ms
21ms Other
image/svg+xml 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://semimasssi.blogspot.com/responsive/sprite_v1_6.css.svg

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 12:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Mar 2021 11:10:36 GMT
server: sffe
age: 892
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2244
x-xss-protection: 0
expires: Tue, 16 Mar 2021 12:52:31 GMT

GET
H2 200 image
themes.googleusercontent.com/ 223 KB
224 KB 247ms
213ms Image
image/jpeg 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://themes.googleusercontent.com/image?id=L1lcAxxz0CLgsDzixEprHJ2F38TyEjCyE3RSAjynQDks0lT1BDc1OxXKaTEdLc89HPvdB11X9FDw&options=w1600

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

6a5482e0dc4e77a6be20281b13d7ef4d8b67521e73b66bc633ea4e4242934be9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 13:07:23 GMT
x-content-type-options: nosniff
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 228521
x-xss-protection: 0
expires: Wed, 10 Mar 2021 13:07:23 GMT

GET
H3-Q050 200 cookienotice.js Show response
semimasssi.blogspot.com/js/ 6 KB
2 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://semimasssi.blogspot.com/js/cookienotice.js

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 09 Mar 2021 12:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Mar 2021 11:10:36 GMT
server: sffe
age: 892
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2026
x-xss-protection: 0
expires: Tue, 16 Mar 2021 12:52:31 GMT

GET
H2 200 629644797-widgets.js Show response
www.blogger.com/static/v1/widgets/ 143 KB
52 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82a::2009
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/629644797-widgets.js

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68b924795300f45fca9372150c9c12adf42aeabce707597c00eea2d9ca2da923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 01:55:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Mar 2021 19:09:46 GMT
server: sffe
age: 126706
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53275
x-xss-protection: 0
expires: Tue, 08 Mar 2022 01:55:37 GMT

GET
H3-Q050 200 blogger_logo_round_35.png
www.blogger.com/img/ 2 KB
3 KB 34ms
18ms Image
image/png 2a00:1450:4001:82a::2009
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.blogger.com/img/blogger_logo_round_35.png

Requested by

Host: semimasssi.blogspot.com
URL: https://semimasssi.blogspot.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://semimasssi.blogspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Mar 2021 05:09:08 GMT
x-content-type-options: nosniff
last-modified: Mon, 08 Mar 2021 04:10:17 GMT
server: sffe
age: 115095
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2531
x-xss-protection: 0
expires: Mon, 15 Mar 2021 05:09:08 GMT

GET
H/1.1

200
OK

Primary Request / Show response
repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/
Redirect Chain

http://repdata.c-sgroup.com/FR/Ovh.web
http://repdata.c-sgroup.com/FR/Ovh.web/
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8
http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/

68 KB
44 KB

523ms
522ms

Document
text/html

63.240.117.228
ATT-CERFNET-BLOCK

General

Check archive.org

Show headers Download Go to

Full URL: http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/
Protocol: HTTP/1.1
Server: 63.240.117.228 , United States, ASN17232 (ATT-CERFNET-BLOCK, US),
Reverse DNS: promoitems.c-sgroup.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.29
Resource Hash: 4d1706ba0ec170c60246bb0f8a3972f0a3fb6e98c6fd91b7886608f1b5906006

Request headers

Host: repdata.c-sgroup.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://semimasssi.blogspot.com/

Response headers

Date: Tue, 09 Mar 2021 12:55:22 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.29
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Date: Tue, 09 Mar 2021 12:55:22 GMT
Server: Apache/2.4.7 (Ubuntu)
Location: http://repdata.c-sgroup.com/FR/Ovh.web/33c46c4e4df7bf3f0e6c7886046745c8/
Content-Length: 365
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 4 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5366ccb46a615851732f11cdc9206c3c302f527a3f3e7fa54e01e0ac8223d5a

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 3 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf94cb7689eb606007bd2ef09c512e74337959b7e1aacb84cb6734e374e95262

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: deedc1faecf1f585890bb43e5d2cabe5fb9f9365609a68931f7387bc11ba8cac

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed3690b9a541493bb2db82cc846d76ffa2f1ffc7b07009072712a8480f552a5b

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd5cb34d06ea58c1f7d9af7e7095db28f481eb40c5a6900abefb79886614c23a

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1092e77793b870361aded2b6d78a8367da9f089a3f72d9947aa6ed4da7ab2311

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a458b1def189d665001ace859e247304bca3ffb370452894d68fb2f5907eefa5

Request headers

Referer: http://repdata.c-sgroup.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OVH (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

repdata.c-sgroup.com
resources.blogblog.com
semimasssi.blogspot.com
themes.googleusercontent.com
www.blogger.com
www.gstatic.com
2a00:1450:4001:813::2001
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2009
2a00:1450:4001:82b::2001
63.240.117.228
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
1092e77793b870361aded2b6d78a8367da9f089a3f72d9947aa6ed4da7ab2311
4d1706ba0ec170c60246bb0f8a3972f0a3fb6e98c6fd91b7886608f1b5906006
65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407
68b924795300f45fca9372150c9c12adf42aeabce707597c00eea2d9ca2da923
6a5482e0dc4e77a6be20281b13d7ef4d8b67521e73b66bc633ea4e4242934be9
73d16aca9b019e42dd2de3a10e5049b5606268ce0d8e3a167b05b37acb9b0e9c
92ca0d6ddc2183dfa7c3d036d25cd0e854e5874105a6e4f6e5b67fd1bca9639f
a00d3cabd4a8dbdbd2e992e238d11ec889fb3cc7751d9bc271f063a17ec8bf7d
a458b1def189d665001ace859e247304bca3ffb370452894d68fb2f5907eefa5
b133050a469454e669debd992f116fc1c413d1035733336740120c02f3160947
bd5cb34d06ea58c1f7d9af7e7095db28f481eb40c5a6900abefb79886614c23a
bf94cb7689eb606007bd2ef09c512e74337959b7e1aacb84cb6734e374e95262
c5366ccb46a615851732f11cdc9206c3c302f527a3f3e7fa54e01e0ac8223d5a
deedc1faecf1f585890bb43e5d2cabe5fb9f9365609a68931f7387bc11ba8cac
e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383
ed3690b9a541493bb2db82cc846d76ffa2f1ffc7b07009072712a8480f552a5b

repdata.c-sgroup.com Open in urlscan Pro 63.240.117.228 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

89 %HTTPS

80 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

393 kBTransfer

709 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

repdata.c-sgroup.com Open in urlscan Pro
63.240.117.228 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

80 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

393 kB
Transfer

709 kB
Size

0
Cookies

9 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!