csbs-voicemail75.ontwbb37619.website Open in urlscan Pro
109.104.151.107  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Page URL
2. https://csbs-voicemail75.ontwbb37619.website/BivtwLfF?wreply=https://lw.skype.com/login/oauth/proxy?client_id=192354&redirect_uri=https%3A%2F%2Fweb.skype.com%2FAuth%2FPostHandler&state=097fa1ar-p1ig-y2u3-4eo6-tk2ez7hr6rec&lc=6073&id=744345&rdir=true&mkt=en-US&psi=skype&lw=1 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Show response 857csbs1.ndori.org/	12 KB 12 KB	2967ms 2298ms	Document text/html	20.37.249.245 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.37.249.245 Canberra, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash c4e99bf65c82e21286a426e20521265680814c1d7bfebc9dc83fc58e56f84d5b Request headers Host 857csbs1.ndori.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 24 Jun 2021 12:56:45 GMT Server Apache/2.4.29 (Ubuntu) Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery-3.4.0.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	86 KB 39 KB	117ms 30ms	Script application/javascript	152.199.19.160 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js Requested by Host: 857csbs1.ndori.org URL: https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.19.160 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (wmi/FEEB) / Resource Hash 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://857csbs1.ndori.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 24 Jun 2021 12:56:47 GMT content-encoding gzip x-content-type-options nosniff age 9797101 x-cache HIT content-length 39406 x-xss-protection 1; mode=block last-modified Thu, 11 Apr 2019 17:22:26 GMT server ECAcc (wmi/FEEB) etag "c1ebe9218bf0d41:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	/ Show response ipapi.co/org/	19 B 603 B	411ms 395ms	XHR text/plain	2606:4700:20::ac43:45e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ipapi.co/org/ Requested by Host: ajax.aspnetcdn.com URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:20::ac43:45e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33131210303ae663897262519ef28963f131e07f3ba8a60ebeb917790b0a3d01 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Accept */* Referer https://857csbs1.ndori.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 24 Jun 2021 12:56:47 GMT vary Host, Origin cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" allow OPTIONS, GET, OPTIONS, POST, HEAD report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wSqLUumjidSdeWiarbbOwyJnqL65yQ3lMAofmlYfppPHXSM1ZDSGfqqk2o%2BQ0FcoWbRPkcPRuMSTClUlxtWeIe8TeTtCXiUS%2FbkdykIk6d3DoB%2BL6T01fRPezns9jV%2FAUQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=utf-8 access-control-allow-origin https://857csbs1.ndori.org cf-ray 66461e4018c3c272-FRA content-length 19 cf-request-id 0adfb13c0c0000c272ca0c6000000001
POST H/1.1	200 OK	redirect.php 857csbs1.ndori.org/	1 B 203 B	1963ms 1962ms	XHR text/html	20.37.249.245 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://857csbs1.ndori.org/redirect.php Requested by Host: ajax.aspnetcdn.com URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.37.249.245 Canberra, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.29 (Ubuntu) / Resource Hash Request headers Sec-Fetch-Mode cors Origin https://857csbs1.ndori.org Accept-Encoding gzip, deflate, br Accept-Language en-US Sec-Fetch-Dest empty X-Requested-With XMLHttpRequest Connection keep-alive Content-Length 27 Pragma no-cache Host 857csbs1.ndori.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Accept */* Cache-Control no-cache Referer https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Sec-Fetch-Site same-origin Accept */* Referer https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 24 Jun 2021 12:56:47 GMT Server Apache/2.4.29 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 1 Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	Primary Request BivtwLfF Show response csbs-voicemail75.ontwbb37619.website/	33 KB 33 KB	767ms 386ms	Document text/html	109.104.151.107 ITIRANA-AL-AS Imp...
General Check archive.org Show headers Download Go to Full URL https://csbs-voicemail75.ontwbb37619.website/BivtwLfF?wreply=https://lw.skype.com/login/oauth/proxy?client_id=192354&redirect_uri=https%3A%2F%2Fweb.skype.com%2FAuth%2FPostHandler&state=097fa1ar-p1ig-y2u3-4eo6-tk2ez7hr6rec&lc=6073&id=744345&rdir=true&mkt=en-US&psi=skype&lw=1 Requested by Host: 857csbs1.ndori.org URL: https://857csbs1.ndori.org/wfliiNfqteHZuPVpHeGhhMnRoUUdOelluTXViM0puJmRqPXNrcCZxeD0xJjI1MzhpMFBjZTl5Q1UxeFUwMzE1Mzc2MVAzUmVDVkoxbzJRcw== Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 109.104.151.107 Tirana, Albania, ASN48265 (ITIRANA-AL-AS Import from Pronet, AL), Reverse DNS Software Apache/2.4.34 (Ubuntu) / Resource Hash 1fc4dd8f404a735a7bc15fd3822027fff1e478c84ba569a1e14c00c99b1913c5 Request headers Host csbs-voicemail75.ontwbb37619.website Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://857csbs1.ndori.org/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://857csbs1.ndori.org/ Response headers Date Thu, 24 Jun 2021 12:56:50 GMT Server Apache/2.4.34 (Ubuntu) Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery-3.4.1.js Show response code.jquery.com/	274 KB 81 KB	25ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.js Requested by Host: csbs-voicemail75.ontwbb37619.website URL: https://csbs-voicemail75.ontwbb37619.website/BivtwLfF?wreply=https://lw.skype.com/login/oauth/proxy?client_id=192354&redirect_uri=https%3A%2F%2Fweb.skype.com%2FAuth%2FPostHandler&state=097fa1ar-p1ig-y2u3-4eo6-tk2ez7hr6rec&lc=6073&id=744345&rdir=true&mkt=en-US&psi=skype&lw=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55 Request headers Origin https://csbs-voicemail75.ontwbb37619.website Referer https://csbs-voicemail75.ontwbb37619.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 24 Jun 2021 12:56:50 GMT content-encoding gzip last-modified Wed, 01 May 2019 21:14:27 GMT server nginx etag W/"5cca0c33-4472c" vary Accept-Encoding x-hw 1624539410.dop206.fr8.t,1624539410.cds208.fr8.hc,1624539410.cds288.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 82889
GET		index-s.php tslvaa.ontwbb97098.website/common/ Frame 1D99	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

tslvaa.ontwbb97098.website

URL

https://tslvaa.ontwbb97098.website/common/index-s.php?ijbgtrf=ZGxha2thQGNzYnMub3JnOjox

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| makeid function| action

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://csbs-voicemail75.ontwbb37619.website/BivtwLfF?wreply=https://lw.skype.com/login/oauth/proxy?client_id=192354&redirect_uri=https%3A%2F%2Fweb.skype.com%2FAuth%2FPostHandler&state=097fa1ar-p1ig-y2u3-4eo6-tk2ez7hr6rec&lc=6073&id=744345&rdir=true&mkt=en-US&psi=skype&lw=1(Line 113) Message: dlakka@csbs.org::1&&skp

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

857csbs1.ndori.org
ajax.aspnetcdn.com
code.jquery.com
csbs-voicemail75.ontwbb37619.website
ipapi.co
tslvaa.ontwbb97098.website
tslvaa.ontwbb97098.website
109.104.151.107
152.199.19.160
20.37.249.245
2001:4de0:ac18::1:a:2a
2606:4700:20::ac43:45e2
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
1fc4dd8f404a735a7bc15fd3822027fff1e478c84ba569a1e14c00c99b1913c5
33131210303ae663897262519ef28963f131e07f3ba8a60ebeb917790b0a3d01
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
c4e99bf65c82e21286a426e20521265680814c1d7bfebc9dc83fc58e56f84d5b