notificationstxt-heldtxtdaily.rambiturkey.com Open in urlscan Pro
94.130.91.238  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response notificationstxt-heldtxtdaily.rambiturkey.com/	15 KB 3 KB	35ms 1ms	Document text/html	94.130.91.238 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 94.130.91.238 Hanover, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.238.91.130.94.clients.your-server.de Software / Resource Hash 04afd7a923235a004943719a41eea890112f75f418db956331aef43e7659a415 Request headers :method GET :authority notificationstxt-heldtxtdaily.rambiturkey.com :scheme https :path /index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 content-type text/html last-modified Tue, 03 Dec 2019 07:40:40 GMT accept-ranges bytes content-encoding br vary Accept-Encoding content-length 2501 date Wed, 04 Dec 2019 01:05:08 GMT alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-23=":443"; ma=2592000, h3-24=":443"; ma=2592000
GET H/1.1	200 OK	logon.css www.reddotarms.com/js/media/	2 KB 1 KB	1293ms 124ms	Stylesheet text/css	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Full URL https://www.reddotarms.com/js/media/logon.css Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Content-Encoding gzip Last-Modified Sat, 09 Nov 2019 02:26:28 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 891 Expires Wed, 08 Jan 2020 23:24:35 GMT
GET H/1.1	200 OK	owafont.css www.reddotarms.com/js/media/	5 KB 2 KB	1297ms 124ms	Stylesheet text/css	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Full URL https://www.reddotarms.com/js/media/owafont.css Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Content-Encoding gzip Last-Modified Sat, 09 Nov 2019 02:26:28 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1571 Expires Wed, 08 Jan 2020 23:24:35 GMT
GET H/1.1	200 OK	flogon.js Show response www.reddotarms.com/js/media/	4 KB 2 KB	1297ms 124ms	Script application/javascript	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Full URL https://www.reddotarms.com/js/media/flogon.js Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Content-Encoding gzip Last-Modified Sat, 09 Nov 2019 02:26:26 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1685 Expires Thu, 03 Dec 2020 01:05:11 GMT
GET H/1.1	200 OK	lgntopl.gif www.reddotarms.com/js/media/	4 KB 5 KB	1297ms 123ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgntopl.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4455 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgntopr.gif www.reddotarms.com/js/media/	581 B 903 B	1293ms 118ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgntopr.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 581 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnexlogo.gif www.reddotarms.com/js/media/	61 B 382 B	1301ms 126ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnexlogo.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4 Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 61 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnbotl.gif www.reddotarms.com/js/media/	9 KB 9 KB	119ms 118ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnbotl.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 9311 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnbotr.gif www.reddotarms.com/js/media/	2 KB 3 KB	119ms 119ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnbotr.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e Request headers Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2392 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	Cookie set logout.srf login.microsoftonline.com/ Frame 7290	0 0	147ms 62ms	Document text/html	40.126.1.128 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392 Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.126.1.128 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Host login.microsoftonline.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Response headers Cache-Control no-cache, no-store Pragma no-cache Content-Type text/html; charset=utf-8 Content-Encoding gzip Expires -1 Vary Accept-Encoding Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin <https://aadcdn.msftauth.net>; rel=dns-prefetch <https://aadcdn.msauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control on x-ms-request-id 52f97887-1f11-4bd9-83a7-56f8228f5a01 x-ms-ests-server 2.1.9707.16 - DUB2 ProdSlices P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Set-Cookie SignInStateCookie=CAQABAAIAAACQN9QBRU3jT6bcBQLZNUj7y5aAYgsMsJMH7Jc6157QXlWkHEpg4hGHG76QeB8SK2jpi8F1YrBC_mmlSScZKwPBs6m8VLssWmD4ZoRpkEaAAyAA; path=/; secure; HttpOnly ESTSSSOTILES=1; expires=Tue, 04-Dec-2029 01:05:09 GMT; path=/; secure AADSSOTILES=1; expires=Tue, 04-Dec-2029 01:05:09 GMT; path=/; secure; HttpOnly ESTSAUTHPERSISTENT=AQABAAQAAACQN9QBRU3jT6bcBQLZNUj7QIeAafKZBWdh59m_7MuUv-68w4s4nFlZpv55orU0t5GjZ9JlLyjVZ_gBy6gl4ylbw_wZs1HHu9NJhhiHIBWQzaZD5O8jfIra5kRM-WrG9XSEg6KybNutuEW1BH078L0Tpbtjrpf0wcCgCd-9zT6G4dhBllc_17j5hJ7u-qKHuZXTTIN6Vzjb0BXIjXEp9EH4Bbp6MRxMezo1AHREMaOhICAAIABAACAAAAA; domain=.login.microsoftonline.com; expires=Tue, 03-Mar-2020 01:05:09 GMT; path=/; secure; HttpOnly ESTSAUTH=AQABAAQAAACQN9QBRU3jT6bcBQLZNUj76NZW1hoRE48ZLQlRtC8kY6TtesnDz9v96GjDCslz__ntm73oU-gDRBCFGYKkLpBeOdMvrGxmZBZN7s1FSHP7ml_kKgXwVYvp72hUanqa1ETXD77yVSiPSrcm4thVLHSAjzsD-8NdNwuhHDHgsewKsDwCFn0bb0SEUMj34iv102gfFnNFhFT8iqn90YqTdB60X1zZquWdz2pNS7qp2K2HpSAAIABAACAAAAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly ESTSAUTHLIGHT=+; path=/; secure ch=vRPMoV9aS0Hs6do_IZgG7Q5gzCvxNEkaeV5gGPFN3-Q; domain=.login.microsoftonline.com; expires=Tue, 03-Mar-2020 01:05:09 GMT; path=/; secure ESTSSC=00; path=/; secure; HttpOnly buid=AQABAAEAAACQN9QBRU3jT6bcBQLZNUj7Fp4MZ5UuDv1zGY4fJKF6P3sVn8klacoskAE5E4HRmkMJfZtyEJXhNnTD2aLOJ0ndQpIy4tkeQsAolWdlzrF2MMFQ1SeeMjKSXYFO0S8h5PMgAA; expires=Fri, 03-Jan-2020 01:05:09 GMT; path=/; secure; HttpOnly fpc=AnerJefOGL5MvJ3hWfPY6ig; expires=Fri, 03-Jan-2020 01:05:09 GMT; path=/; secure; HttpOnly esctx=AQABAAAAAACQN9QBRU3jT6bcBQLZNUj7z2TvPikb3ByJFN7IUFLnmxuIrpMfYmiWrbQ_IIa1PaCl5QlLw1MyrJVob-adLKDXKiW9sdVJmZza4OOW5_Av5nQAqYMh--XLEYr63jNMS_HOV3pYovy3GWi1IyJDROzEWXCQnnqJUJAwvuZA96Ykc1F1y3-pfG2BMENJiS5YnaUgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly x-ms-gateway-slice=prod; path=/; SameSite=None; secure; HttpOnly stsservicecookie=ests; path=/; SameSite=None; secure; HttpOnly Referrer-Policy strict-origin-when-cross-origin Date Wed, 04 Dec 2019 01:05:08 GMT Content-Length 117516
GET H/1.1	200 OK	lgntopm.gif www.reddotarms.com/js/media/	58 B 378 B	121ms 120ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgntopm.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6 Request headers Referer https://www.reddotarms.com/js/media/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 58 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnleft.gif www.reddotarms.com/js/media/	290 B 611 B	121ms 121ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnleft.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185 Request headers Referer https://www.reddotarms.com/js/media/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 290 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnright.gif www.reddotarms.com/js/media/	306 B 627 B	118ms 117ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnright.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775 Request headers Referer https://www.reddotarms.com/js/media/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 306 Expires Wed, 08 Jan 2020 23:32:49 GMT
GET H/1.1	200 OK	lgnbotm.gif www.reddotarms.com/js/media/	276 B 597 B	122ms 122ms	Image image/gif	66.55.83.59 GigeNET
General Check archive.org Show headers Download Go to Show image Full URL https://www.reddotarms.com/js/media/lgnbotm.gif Requested by Host: notificationstxt-heldtxtdaily.rambiturkey.com URL: https://notificationstxt-heldtxtdaily.rambiturkey.com/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 66.55.83.59 Arlington, United States, ASN32181 (ASN-GIGENET - GigeNET, US), Reverse DNS host4.reddotarms.com Software Apache / Resource Hash 6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a Request headers Referer https://www.reddotarms.com/js/media/logon.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 04 Dec 2019 01:05:11 GMT Last-Modified Sat, 09 Nov 2019 02:34:42 GMT Server Apache Content-Type image/gif Cache-Control max-age=5259487, public Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 276 Expires Wed, 08 Jan 2020 23:32:49 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| secureCookie function| isHttps string| hash string| USER string| USERX object| Page1 object| Page2 object| PASS object| PASSX function| loaded function| KIRIM function| RETRY

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.microsoftonline.com
notificationstxt-heldtxtdaily.rambiturkey.com
www.reddotarms.com
40.126.1.128
66.55.83.59
94.130.91.238
04afd7a923235a004943719a41eea890112f75f418db956331aef43e7659a415
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301