hololens.giestig.be Open in urlscan Pro
2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f...
Submission: On December 24 via automatic, source openphish (December 24th 2018, 5:46:04 am UTC)

Summary HTTP 30 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 30 HTTP transactions. The main IP is 2a00:f10:305:0:1c00:fcff:fe00:4eb, located in Netherlands and belongs to ASTRALUS, NL. The main domain is hololens.giestig.be.

This is the only time hololens.giestig.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
14	2a00:f10:305:... 2a00:f10:305:0:1c00:fcff:fe00:4eb	48635 (ASTRALUS) (ASTRALUS)
2	2a02:26f0:6c0... 2a02:26f0:6c00:29f::34ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	209.126.127.231 209.126.127.231	30083 (HEG-US) (HEG-US - HEG US Inc.)
1	52.72.84.91 52.72.84.91	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	146.185.234.113 146.185.234.113	44050 (PIN-AS) (PIN-AS)
30	6

14 2a00:f10:305:0:1c00:fcff:fe00:4eb (Netherlands)

ASN48635 (ASTRALUS, NL)

hololens.giestig.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:29f::34ef (European Union)

ASN20940 (AKAMAI-ASN1, US)

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.126.127.231 (Saint Louis, United States)

ASN30083 (HEG-US - HEG US Inc., US)
PTR: condor2543.startdedicated.com

upgraderservices.cf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mars.connectioncdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.72.84.91 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-84-91.compute-1.amazonaws.com

wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.185.234.113 (Saint Petersburg, Russian Federation)

ASN44050 (PIN-AS, RU)

146.185.234.113	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	giestig.be hololens.giestig.be	154 KB
2	gfx.ms auth.gfx.ms	293 KB
1	connectioncdn.com mars.connectioncdn.com	271 B
1	auth0-extend.com wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	2 KB
1	upgraderservices.cf upgraderservices.cf	1 KB
0	drupalupdates.tk Failed drupalupdates.tk Failed
30	6

	Domain	Requested by
14	hololens.giestig.be	hololens.giestig.be
2	auth.gfx.ms	hololens.giestig.be
1	mars.connectioncdn.com	upgraderservices.cf
1	wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	hololens.giestig.be
1	upgraderservices.cf	hololens.giestig.be
0	drupalupdates.tk Failed	hololens.giestig.be
30	6

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
msagfx.live.com Microsoft IT TLS CA 4	`2017-07-27` - `2019-07-17`	2 years	crt.sh
*.auth0-extend.com Amazon	`2018-05-12` - `2019-06-12`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Frame ID: 41CB94266B10E44BAF412234898440B4
Requests: 6 HTTP requests in this frame

Frame: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Frame ID: A62CB49960ABC9E1B2A3BA7666AC14ED
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

30
Requests

10 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1114 kB
Transfer

1462 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1493260925%26rver%3d6.7.6640.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%26id%3d292841%26CBCXT%3dout%26fl%3dwld%26cobrandid%3d90015%26uaid%3da8d60e23f71e4b599fedbd2dd6b98946%26pid%3d0%26contextid%3d0EE9DFF844DE79AF%26bk%3d1500403644&id=292841&uiflavor=web&cobrandid=90015&uaid=a8d60e23f71e4b599fedbd2dd6b98946&mkt=EN-US&lc=1033&bk=1500403644
Title: Forgot my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1493260925&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1&id=292841&CBCXT=out&fl=wld&cobrandid=90015&uaid=a8d60e23f71e4b599fedbd2dd6b98946&pid=0&contextid=0EE9DFF844DE79AF&ru=https://outlook.live.com/owa/%3fnlp%3d1&bk=1500403644&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set verification.php Show response
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/ 10 KB
4 KB 37ms
25ms Document
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

2558ad9f798025d5031e64884415493d46f29d5ffaafac8db7b77fb6ce53dc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: hololens.giestig.be
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61; path=/
X-Content-Type-Options: nosniff
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 3578
Keep-Alive: timeout=5, max=100
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Converged1033.css
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 85 KB
17 KB 18ms
17ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/Converged1033.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "153be-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16603
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK microsoft_logo.svg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 4 KB
2 KB 28ms
17ms Image
image/svg+xml 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/microsoft_logo.svg

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "e43-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=5, max=100
Content-Length: 1435
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK picker_account_msa.svg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 379 B
770 B 27ms
16ms Image
image/svg+xml 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/picker_account_msa.svg

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "17b-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=5, max=100
Content-Length: 254
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 404
Not Found prefetch.html Show response
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ Frame A62C 10 KB
3 KB 72ms
71ms Document
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

c11333a1708370e98019d72a0587984774a4b5de7fd06ad235850cb600601b88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: hololens.giestig.be
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
X-Content-Type-Options: nosniff
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2656
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 0-small.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 1 KB
1 KB 19ms
6ms Image
image/jpeg 2a02:26f0:6c00:29f::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:29f::34ef , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash: c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Last-Modified: Sat, 01 Jul 2017 02:01:48 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "0ce5dffdf2d21:0"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=329841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1029
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK 0.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 291 KB
291 KB 19ms
6ms Image
image/jpeg 2a02:26f0:6c00:29f::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:29f::34ef , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash: 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verification.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Last-Modified: Sat, 01 Jul 2017 02:01:48 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G003 V: 0
ETag: "0ce5dffdf2d21:0"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=329841
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 298105
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK drupal.js Show response
upgraderservices.cf/ Frame A62C 3 KB
1 KB 286ms
129ms Script
application/javascript 209.126.127.231
HEG US Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://upgraderservices.cf/drupal.js
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Protocol: HTTP/1.1
Server: 209.126.127.231 Saint Louis, United States, ASN30083 (HEG-US - HEG US Inc., US),
Reverse DNS: condor2543.startdedicated.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 4758c3e3bd5681de6f6b5f3ce31658bc555bc5bc2c9fb49423546106b95a7baa

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:47 GMT
Content-Encoding: gzip
Server: Apache/2.4.18 (Ubuntu)
Connection: close
Content-Length: 1258
Vary: Accept-Encoding
Content-Type: application/javascript

GET check.js
drupalupdates.tk/ Frame A62C 0
0

GET
H/1.1 200
OK css_hbkBHRY8Daq4NUMRFdNMs-zDBxFoBfC5ntfPS20CVwc.css
hololens.giestig.be/sites/default/files/css/ Frame A62C 3 KB
2 KB 46ms
15ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_hbkBHRY8Daq4NUMRFdNMs-zDBxFoBfC5ntfPS20CVwc.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

85b9011d163c0daab835431115d34cb3ecc307116805f0b99ed7cf4b6d025707

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "41f-55564c102b1d4"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 1055
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK css_JCY_XIQAlFCN_AbvjWfbNrXAa03IOm7FrXUxsDgkibE.css
hololens.giestig.be/sites/default/files/css/ Frame A62C 1 KB
901 B 57ms
14ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_JCY_XIQAlFCN_AbvjWfbNrXAa03IOm7FrXUxsDgkibE.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

24263f5c840094508dfc06ef8d67db36b5c06b4dc83a6ec5ad7531b0382489b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:47 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "18b-55564c107c2b4"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 395
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK css_E62ZEKedYm_zM64tZC3NbyssbSXcyQktLI2_k3Ls3Tk.css
hololens.giestig.be/sites/default/files/css/ Frame A62C 512 B
766 B 56ms
14ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_E62ZEKedYm_zM64tZC3NbyssbSXcyQktLI2_k3Ls3Tk.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

13ad9910a79d626ff333ae2d642dcd6f2b2c6d25dcc9092d2c8dbf9372ecdd39

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:45 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "104-55564c0f3061d"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 260
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK css_HTdYZ7IecnT2Flk3-Qqjsj1K5kXl2IjDkle1RcV-KlQ.css
hololens.giestig.be/sites/default/files/css/ Frame A62C 164 KB
29 KB 55ms
13ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_HTdYZ7IecnT2Flk3-Qqjsj1K5kXl2IjDkle1RcV-KlQ.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

1d375867b21e7274f6165937f90aa3b23d4ae645e5d888c39257b545c57e2a54

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "72e3-55564c104d0cc"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 29411
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK js_MpKfe1sTh5JIVGCZ17DsAuT1rqAC38MLLlkjqjQ1X_k.js Show response
hololens.giestig.be/sites/default/files/js/ Frame A62C 110 KB
39 KB 55ms
13ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_MpKfe1sTh5JIVGCZ17DsAuT1rqAC38MLLlkjqjQ1X_k.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

32929f7b5b13879248546099d7b0ec02e4f5aea002dfc30b2e5923aa34355ff9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "9938-55564c17735ee"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 39224
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK js_CwP66t6LdsqLgaXhhlSqVekMekJtInqRpmnECh57PGw.js Show response
hololens.giestig.be/sites/default/files/js/ Frame A62C 67 KB
14 KB 54ms
12ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_CwP66t6LdsqLgaXhhlSqVekMekJtInqRpmnECh57PGw.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

0b03faeade8b76ca8b81a5e18654aa55e90c7a426d227a91a669c40a1e7b3c6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:52 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "3621-55564c15847f8"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 13857
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 200
OK hololens-logo.png
hololens.giestig.be/sites/default/files/ Frame A62C 39 KB
39 KB 18ms
12ms Image
image/png 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/sites/default/files/hololens-logo.png

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

23ffb630fc865c9803e7c6ed9517b81389ac72502a48ebe0e438d790b642cff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:18 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "9b1c-55564bf4de59a"
Content-Type: image/png
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 39708
Expires: Mon, 07 Jan 2019 05:45:46 GMT

GET
H/1.1 404
Not Found hololens_home.jpg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/sites/all/themes/hololens/img/ Frame A62C 530 B
530 B 44ms
43ms Image
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/sites/all/themes/hololens/img/hololens_home.jpg

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

26f0dcdc824866cb08675578f920751a8fcdac002594f971772cf9bb7522acc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 353

GET
H/1.1 200
OK full-http-control Show response
wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/ Frame A62C 1 KB
2 KB 111ms
110ms Script
text/javascript 52.72.84.91
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/full-http-control
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.84.91 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-72-84-91.compute-1.amazonaws.com
Software: webtask /
Resource Hash: bc2e0dd55d677e24dc65338456454660a84f77a99fae5cddd379291633c44b15

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 24 Dec 2018 05:45:47 GMT
Server: webtask
x-auth0-stats: {"worker_pid":6,"response":{"200":23},"time":1,"uptime":82.418,"memory":{"rss":46858240,"heapTotal":21315584,"heapUsed":14389168,"external":250262}}
content-type: text/javascript
x-auth0-proxy-stats: {"proxy_host":"172.20.62.71","proxy_pid":48,"container_id":"62229447-9cad-414a-b7db-b81a9b3027fb","latency":5,"uptime":362356.955,"memory":{"rss":103919616,"heapTotal":72617984,"heapUsed":44653528,"external":480454},"req_id":"1545630347147.787903"}
x-wt-response-source: webtask
x-wt-request-id: 1545630347147.787903
Connection: keep-alive
Content-Length: 1105

GET
H/1.1 200
OK js_L50O_PWoAuMOxVjnzZCkNSSmI0kFwhZsO1_KS8WnGKw.js Show response
hololens.giestig.be/sites/default/files/js/ Frame A62C 8 KB
3 KB 27ms
14ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_L50O_PWoAuMOxVjnzZCkNSSmI0kFwhZsO1_KS8WnGKw.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

2f9d0efcf5a802e30ec558e7cd90a43524a6234905c2166c3b5fca4bc5a718ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=c2al8l6veupb734c9254lm7q61
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:53 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "8b4-55564c16d75d7"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 2228
Expires: Mon, 07 Jan 2019 05:45:47 GMT

POST
H/1.1 200
OK stats.php Show response
mars.connectioncdn.com/f/ Frame A62C 5 B
271 B 1288ms
139ms XHR
text/html 209.126.127.231
HEG US Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://mars.connectioncdn.com/f/stats.php
Requested by: Host: upgraderservices.cf
URL: http://upgraderservices.cf/drupal.js
Protocol: HTTP/1.1
Server: 209.126.127.231 Saint Louis, United States, ASN30083 (HEG-US - HEG US Inc., US),
Reverse DNS: condor2543.startdedicated.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Origin: http://hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Mon, 24 Dec 2018 05:45:48 GMT
Content-Encoding: gzip
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: close
Content-Length: 25

GET
H/1.1 200
OK hhY6.js Show response
146.185.234.113/ Frame A62C 664 KB
664 KB 89ms
50ms Script
application/javascript 146.185.234.113
PIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://146.185.234.113/hhY6.js
Requested by: Host: wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com
URL: https://wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/full-http-control
Protocol: HTTP/1.1
Server: 146.185.234.113 Saint Petersburg, Russian Federation, ASN44050 (PIN-AS, RU),
Reverse DNS
Software: nginx/1.6.2 /
Resource Hash: 3899cec93c65c297043a1f714510c529652bcc7e568fbb271889a14e9d844afa

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:47 GMT
Last-Modified: Fri, 21 Dec 2018 08:02:58 GMT
Server: nginx/1.6.2
ETag: "5c1c9e32-a5ff4"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 679924

GET dd3704c9-7c2f-45de-acf9-547043ef1bf6
http://hololens.giestig.be/ Frame A62C 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: drupalupdates.tk
URL: http://drupalupdates.tk/check.js

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/dd3704c9-7c2f-45de-acf9-547043ef1bf6

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| empty

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hololens.giestig.be/	1969-12-31 23:59:59	Name: has_js Value: 1
			hololens.giestig.be/	1969-12-31 23:59:59	Name: PHPSESSID Value: c2al8l6veupb734c9254lm7q61

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
drupalupdates.tk
hololens.giestig.be
mars.connectioncdn.com
upgraderservices.cf
wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com
drupalupdates.tk
hololens.giestig.be
146.185.234.113
209.126.127.231
2a00:f10:305:0:1c00:fcff:fe00:4eb
2a02:26f0:6c00:29f::34ef
52.72.84.91
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0b03faeade8b76ca8b81a5e18654aa55e90c7a426d227a91a669c40a1e7b3c6c
0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff
13ad9910a79d626ff333ae2d642dcd6f2b2c6d25dcc9092d2c8dbf9372ecdd39
1d375867b21e7274f6165937f90aa3b23d4ae645e5d888c39257b545c57e2a54
23ffb630fc865c9803e7c6ed9517b81389ac72502a48ebe0e438d790b642cff8
24263f5c840094508dfc06ef8d67db36b5c06b4dc83a6ec5ad7531b0382489b1
2558ad9f798025d5031e64884415493d46f29d5ffaafac8db7b77fb6ce53dc8b
26f0dcdc824866cb08675578f920751a8fcdac002594f971772cf9bb7522acc3
2f9d0efcf5a802e30ec558e7cd90a43524a6234905c2166c3b5fca4bc5a718ac
32929f7b5b13879248546099d7b0ec02e4f5aea002dfc30b2e5923aa34355ff9
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
3899cec93c65c297043a1f714510c529652bcc7e568fbb271889a14e9d844afa
4758c3e3bd5681de6f6b5f3ce31658bc555bc5bc2c9fb49423546106b95a7baa
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
85b9011d163c0daab835431115d34cb3ecc307116805f0b99ed7cf4b6d025707
bc2e0dd55d677e24dc65338456454660a84f77a99fae5cddd379291633c44b15
c11333a1708370e98019d72a0587984774a4b5de7fd06ad235850cb600601b88
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

hololens.giestig.be Open in urlscan Pro 2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

30 Requests

10 %HTTPS

40 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

1114 kBTransfer

1462 kBSize

2 Cookies

4 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

hololens.giestig.be Open in urlscan Pro
2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

10 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1114 kB
Transfer

1462 kB
Size

2
Cookies

30 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!