bellsouth-5.jimdosite.com Open in urlscan Pro
52.208.193.50  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response bellsouth-5.jimdosite.com/	315 KB 73 KB	168ms 67ms	Document text/html	52.208.193.50 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bellsouth-5.jimdosite.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 52.208.193.50 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-208-193-50.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 3217cec529d02ed41a5f0ddad589a7a37d6125e2d269fc669640ab190f01bab0 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.jimdo.com jimdo.com; worker-src blob: Request headers Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 30 Nov 2021 16:28:52 GMT Content-Type text/html Content-Length 74393 Connection keep-alive Vary Accept-Encoding Accept-Language, Origin, Cookie X-RateLimit-Limit 8000 X-RateLimit-Remaining 7999 X-RateLimit-Reset 0 Content-Encoding gzip Content-Security-Policy default-src * data: blob: 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.jimdo.com jimdo.com; worker-src blob: Content-Language de Server nginx
GET H2	200	67513863e4a8311e4a0e.css jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/	135 KB 28 KB	31ms 6ms	Stylesheet text/css	2a04:4e42:200::591 FASTLY
General Check archive.org Show headers Download Go to Full URL https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/67513863e4a8311e4a0e.css Requested by Host: bellsouth-5.jimdosite.com URL: https://bellsouth-5.jimdosite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:200::591 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 44aca4640673b93b507ba0bc4c052c23b8d6474b4463740c2fb46d72a3cc45ff Request headers Accept-Language de-DE,de;q=0.9 Referer https://bellsouth-5.jimdosite.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT via 1.1 varnish, 1.1 varnish age 100291 x-cache MISS, HIT content-encoding gzip content-length 28103 x-amz-id-2 Gq1SYGSs04zoLYSTLaG7Dx2M4IsPgtoOOl48s6QviIMmYohZwxqp6bmpYYySNOl29QY4obZfIuI= x-served-by cache-fra19121-FRA, cache-hhn4052-HHN last-modified Mon, 29 Nov 2021 12:11:10 GMT x-timer S1638289733.043923,VS0,VE0 etag "2dbb7d7c10be633e1c7220043fd0bb79" vary Accept-Encoding x-amz-request-id PT3DWW5NSY0WY573 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-type text/css x-cache-hits 0, 3605
GET H2	200	css fonts.jimstatic.com/	420 B 245 B	81ms 57ms	Stylesheet text/css	151.101.130.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fonts.jimstatic.com/css?display=swap&family=Poppins:600,700 Requested by Host: bellsouth-5.jimdosite.com URL: https://bellsouth-5.jimdosite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.21.4 / Resource Hash e4afac81570bceac3940424eb8559203c61dd761ea0d63249970f2dadce016fc Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://bellsouth-5.jimdosite.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-cache MISS cross-origin-resource-policy cross-origin vary Accept-Encoding content-length 201 x-xss-protection 0 x-served-by cache-fra19143-FRA server nginx/1.21.4 cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * expires Tue, 30 Nov 2021 16:28:53 GMT cache-control private, max-age=86400 accept-ranges bytes timing-allow-origin * x-cache-hits 0
GET H2	200	css fonts.jimstatic.com/	408 B 560 B	79ms 55ms	Stylesheet text/css	151.101.130.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700 Requested by Host: bellsouth-5.jimdosite.com URL: https://bellsouth-5.jimdosite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.21.4 / Resource Hash b4c0c39c85a79468b96b16acbf0b644c6d0d5e4c56767cebb9a45ec11d618592 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://bellsouth-5.jimdosite.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-cache MISS cross-origin-resource-policy cross-origin vary Accept-Encoding content-length 201 x-xss-protection 0 x-served-by cache-fra19143-FRA server nginx/1.21.4 cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * expires Tue, 30 Nov 2021 16:28:53 GMT cache-control private, max-age=86400 accept-ranges bytes timing-allow-origin * x-cache-hits 0
GET H2	200	779ec8bca5ab1f2ffc2f.js Show response jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/	5 MB 1 MB	32ms 13ms	Script application/javascript	2a04:4e42:200::591 FASTLY
General Check archive.org Show headers Download Go to Full URL https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/779ec8bca5ab1f2ffc2f.js Requested by Host: bellsouth-5.jimdosite.com URL: https://bellsouth-5.jimdosite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:200::591 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 59c39ebd87b3efc9684de5aeac1c359673b31a776146de89d0b83c909ad83342 Request headers Accept-Language de-DE,de;q=0.9 Referer https://bellsouth-5.jimdosite.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT via 1.1 varnish, 1.1 varnish age 5324 x-cache HIT, HIT content-encoding gzip content-length 1322864 x-amz-id-2 YEB/oHAualOBX03U6aybS/A77af7QuJIO2Jnef+U/BS7ujx4+ZF7+iSELOLeSpQns20ejgrAVng= x-served-by cache-fra19142-FRA, cache-hhn4052-HHN last-modified Tue, 30 Nov 2021 14:40:01 GMT x-timer S1638289733.044020,VS0,VE0 etag "47919c3f37483551e41e124206299671" vary Accept-Encoding x-amz-request-id 6D74BWSKVNM1Z458 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-type application/javascript x-cache-hits 1, 7
GET H2	200	KFOmCnqEu92Fr1Mu4mxP.ttf fonts.jimstatic.com/s/roboto/v29/	35 KB 21 KB	22ms 7ms	Font font/ttf	151.101.130.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fonts.jimstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxP.ttf Requested by Host: fonts.jimstatic.com URL: https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software sffe / Resource Hash 52e0349a641604d5204952039bfac8acde78242227defae8864d1caa48b8c5c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700 Origin https://bellsouth-5.jimdosite.com Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT content-encoding gzip x-content-type-options nosniff age 4123329 via 1.1 varnish content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes x-cache HIT cross-origin-resource-policy cross-origin content-length 20743 x-xss-protection 0 x-served-by cache-fra19122-FRA last-modified Wed, 22 Sep 2021 16:13:21 GMT server sffe vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/ttf access-control-allow-origin * expires Thu, 13 Oct 2022 23:06:44 GMT cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" x-cache-hits 25
GET H2	200	45f2e5ed-44fa-4e89-9df7-e8e9ca06b5fa.png jimdo-storage.freetls.fastly.net/image/260006490/	2 KB 3 KB	18ms 9ms	Image image/webp	2a04:4e42:200::591 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://jimdo-storage.freetls.fastly.net/image/260006490/45f2e5ed-44fa-4e89-9df7-e8e9ca06b5fa.png?quality=80&auto=webp&disable=upscale&width=320&height=72&trim=0,0,0,0 Requested by Host: bellsouth-5.jimdosite.com URL: https://bellsouth-5.jimdosite.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:200::591 , United States, ASN54113 (FASTLY, US), Reverse DNS Software gunicorn/19.9.0 / Resource Hash a872ade5fa0ba16b6fbf0acd5ebf6e63b980323f286830fd9428a5b91019134c Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Accept-Language de-DE,de;q=0.9 Referer https://bellsouth-5.jimdosite.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT via 1.1 varnish, 1.1 varnish age 12900 x-cache HIT, MISS fastly-io-info ifsz=2448 idim=320x72 ifmt=png ofsz=2370 odim=320x72 ofmt=webp fastly-stats io=1 content-length 2370 x-served-by cache-fra19133-FRA, cache-hhn4052-HHN server gunicorn/19.9.0 x-timer S1638289733.127726,VS0,VE3 x-frame-options SAMEORIGIN etag "iHIcsUJJ9DlHvqHV7ljrsJpYfv/ZJ2v7CxEWWp1EhWc" vary Accept content-language en access-control-allow-origin * expires Wed, 30 Nov 2022 12:53:53 GMT cache-control max-age=31536000, public accept-ranges bytes content-type image/webp x-cache-hits 1, 0
POST H/1.1	204 No Content	cf at.jimdo-platform-eks.net/	0 193 B	139ms 40ms	Ping text/plain	52.212.161.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://at.jimdo-platform-eks.net/cf Requested by Host: jimdo-dolphin-static-assets-prod.freetls.fastly.net URL: https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/779ec8bca5ab1f2ffc2f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.212.161.198 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-212-161-198.eu-west-1.compute.amazonaws.com Software nginx/1.19.8 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://bellsouth-5.jimdosite.com/ Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin https://bellsouth-5.jimdosite.com Date Tue, 30 Nov 2021 16:28:53 GMT Server nginx/1.19.8 Connection keep-alive Content-Length 0
GET H2	200	pxiByp8kv8JHgFVrLEj6Z1xlEA.ttf fonts.jimstatic.com/s/poppins/v15/	16 KB 10 KB	8ms 8ms	Font font/ttf	151.101.130.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fonts.jimstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlEA.ttf Requested by Host: fonts.jimstatic.com URL: https://fonts.jimstatic.com/css?display=swap&family=Poppins:600,700 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software sffe / Resource Hash 0b27d34226cc692a7d586e6371204cfb33d9a603fc42f7f0e82d74586bad320b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.jimstatic.com/css?display=swap&family=Poppins:600,700 Origin https://bellsouth-5.jimdosite.com Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT content-encoding gzip x-content-type-options nosniff age 1897293 via 1.1 varnish content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes x-cache HIT cross-origin-resource-policy cross-origin content-length 10622 x-xss-protection 0 x-served-by cache-fra19122-FRA last-modified Thu, 05 Nov 2020 22:02:10 GMT server sffe vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/ttf access-control-allow-origin * expires Tue, 08 Nov 2022 17:27:21 GMT cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" x-cache-hits 1
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc9.ttf fonts.jimstatic.com/s/roboto/v29/	35 KB 20 KB	6ms 6ms	Font font/ttf	151.101.130.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fonts.jimstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc9.ttf Requested by Host: fonts.jimstatic.com URL: https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.130.2 , United States, ASN54113 (FASTLY, US), Reverse DNS Software sffe / Resource Hash 52dc362cae7e441a98741305a38b045859ac60e99377d9d88922ec32cb944cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.jimstatic.com/css?display=swap&family=Roboto:400,700 Origin https://bellsouth-5.jimdosite.com Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 30 Nov 2021 16:28:53 GMT content-encoding gzip x-content-type-options nosniff age 5355442 via 1.1 varnish content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes x-cache HIT cross-origin-resource-policy cross-origin content-length 20778 x-xss-protection 0 x-served-by cache-fra19122-FRA last-modified Wed, 22 Sep 2021 16:13:28 GMT server sffe vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/ttf access-control-allow-origin * expires Thu, 29 Sep 2022 16:51:42 GMT cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" x-cache-hits 2
POST H/1.1	204 No Content	cf at.jimdo-platform-eks.net/	0 193 B	122ms 37ms	Ping text/plain	52.212.161.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://at.jimdo-platform-eks.net/cf Requested by Host: jimdo-dolphin-static-assets-prod.freetls.fastly.net URL: https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/779ec8bca5ab1f2ffc2f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.212.161.198 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-212-161-198.eu-west-1.compute.amazonaws.com Software nginx/1.19.8 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://bellsouth-5.jimdosite.com/ Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin https://bellsouth-5.jimdosite.com Date Tue, 30 Nov 2021 16:28:53 GMT Server nginx/1.19.8 Connection keep-alive Content-Length 0
POST H/1.1	204 No Content	cf at.jimdo-platform-eks.net/	0 193 B	45ms 39ms	Ping text/plain	52.212.161.198 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://at.jimdo-platform-eks.net/cf Requested by Host: jimdo-dolphin-static-assets-prod.freetls.fastly.net URL: https://jimdo-dolphin-static-assets-prod.freetls.fastly.net/renderer/static/779ec8bca5ab1f2ffc2f.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.212.161.198 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-212-161-198.eu-west-1.compute.amazonaws.com Software nginx/1.19.8 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://bellsouth-5.jimdosite.com/ Accept-Language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Content-Type text/plain;charset=UTF-8 Response headers access-control-allow-origin https://bellsouth-5.jimdosite.com Date Tue, 30 Nov 2021 16:28:53 GMT Server nginx/1.19.8 Connection keep-alive Content-Length 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler string| __dolphin_environment__ function| _ boolean| VimeoPlayerResizeEmbeds_ object| Modernizr object| DD_LOGS object| DD_RUM boolean| CKIES_OPTIN function| gaOptout object| jimdoDolphinData

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src * data: blob: 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.jimdo.com jimdo.com; worker-src blob:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

at.jimdo-platform-eks.net
bellsouth-5.jimdosite.com
fonts.jimstatic.com
jimdo-dolphin-static-assets-prod.freetls.fastly.net
jimdo-storage.freetls.fastly.net
151.101.130.2
2a04:4e42:200::591
52.208.193.50
52.212.161.198
0b27d34226cc692a7d586e6371204cfb33d9a603fc42f7f0e82d74586bad320b
3217cec529d02ed41a5f0ddad589a7a37d6125e2d269fc669640ab190f01bab0
44aca4640673b93b507ba0bc4c052c23b8d6474b4463740c2fb46d72a3cc45ff
52dc362cae7e441a98741305a38b045859ac60e99377d9d88922ec32cb944cfa
52e0349a641604d5204952039bfac8acde78242227defae8864d1caa48b8c5c1
59c39ebd87b3efc9684de5aeac1c359673b31a776146de89d0b83c909ad83342
a872ade5fa0ba16b6fbf0acd5ebf6e63b980323f286830fd9428a5b91019134c
b4c0c39c85a79468b96b16acbf0b644c6d0d5e4c56767cebb9a45ec11d618592
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4afac81570bceac3940424eb8559203c61dd761ea0d63249970f2dadce016fc