syctus.es Open in urlscan Pro
135.125.41.30  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response syctus.es/wp-includes/css/dist/poostl-il/index/	9 KB 3 KB	270ms 78ms	Document text/html	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash c3c54edc8e73ac60fcd0af7a207a919ed336e589fdb739a0082cc31c20fadd2a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language es-ES,es;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 3036 content-security-policy upgrade-insecure-requests; content-type text/html; charset=UTF-8 date Sun, 26 Mar 2023 07:22:22 GMT server LiteSpeed strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	screen.css syctus.es/wp-includes/css/dist/poostl-il/index/	3 KB 1011 B	53ms 52ms	Stylesheet text/css	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/screen.css Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/wp-includes/css/dist/poostl-il/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Tue, 22 Feb 2022 02:48:50 GMT server LiteSpeed content-security-policy upgrade-insecure-requests; vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 899 x-xss-protection 1; mode=block expires Sun, 02 Apr 2023 07:22:22 GMT
GET H2	200	gh-buttons.css syctus.es/wp-includes/css/dist/poostl-il/index/	13 KB 2 KB	53ms 53ms	Stylesheet text/css	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/gh-buttons.css Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/wp-includes/css/dist/poostl-il/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Tue, 22 Feb 2022 02:48:58 GMT server LiteSpeed content-security-policy upgrade-insecure-requests; vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1988 x-xss-protection 1; mode=block expires Sun, 02 Apr 2023 07:22:22 GMT
GET H2	200	commons.js Show response syctus.es/wp-includes/css/dist/poostl-il/index/	1 KB 581 B	54ms 53ms	Script application/javascript	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/commons.js Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/wp-includes/css/dist/poostl-il/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Tue, 22 Feb 2022 02:49:12 GMT server LiteSpeed content-security-policy upgrade-insecure-requests; vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 504 x-xss-protection 1; mode=block expires Sun, 02 Apr 2023 07:22:22 GMT
GET H2	200	banar.jpg syctus.es/wp-includes/css/dist/poostl-il/index/	25 KB 23 KB	106ms 106ms	Image image/jpeg	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/banar.jpg Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/wp-includes/css/dist/poostl-il/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Sun, 27 Mar 2022 19:20:04 GMT server LiteSpeed content-security-policy upgrade-insecure-requests; vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 23349 x-xss-protection 1; mode=block expires Sun, 02 Apr 2023 07:22:22 GMT
GET H2	200	register-ad.png israelpost.co.il/media/1096/	74 KB 74 KB	227ms 108ms	Image image/png	66.22.35.41 RADWARE
General Check archive.org Show headers Download Go to Show image Full URL https://israelpost.co.il/media/1096/register-ad.png Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 66.22.35.41 , United States, ASN48851 (RADWARE, IL), Reverse DNS Software / Resource Hash bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:21 GMT last-modified Mon, 01 Feb 2021 08:51:50 GMT etag "d2c2307b77f8d61:0" content-type image/png access-control-expose-headers Request-Context cache-control max-age=86400 accept-ranges bytes content-length 75537 request-context appId=cid-v1:61665634-75fc-415e-8cc8-63525a50cf85
GET H2	404	gh-icons.png syctus.es/wp-includes/css/dist/poostl-il/index/	27 KB 27 KB	103ms 103ms	Image text/html	135.125.41.30 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://syctus.es/wp-includes/css/dist/poostl-il/index/gh-icons.png Requested by Host: syctus.es URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/gh-buttons.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 135.125.41.30 , France, ASN16276 (OVH, FR), Reverse DNS hl111.lucushost.org Software LiteSpeed / Resource Hash a5d0b984043c1e927931e5166819ffff1957e12c59bd66814681c1f5c7a66a5c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language es-ES,es;q=0.9 Referer https://syctus.es/wp-includes/css/dist/poostl-il/index/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers date Sun, 26 Mar 2023 07:22:22 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload server LiteSpeed content-security-policy upgrade-insecure-requests; x-litespeed-cache hit vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 link <https://syctus.es/wp-json/>; rel="https://api.w.org/" content-length 7504 x-xss-protection 1; mode=block expires Wed, 11 Jan 1984 05:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| onBodyLoad function| validate object| cardNumberField object| cvvField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://syctus.es/wp-includes/css/dist/poostl-il/index/gh-icons.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

israelpost.co.il
syctus.es
135.125.41.30
66.22.35.41
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220
a5d0b984043c1e927931e5166819ffff1957e12c59bd66814681c1f5c7a66a5c
bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac
c3c54edc8e73ac60fcd0af7a207a919ed336e589fdb739a0082cc31c20fadd2a