graybackproductions.com Open in urlscan Pro
69.194.236.160  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ALTA.htm Show response graybackproductions.com/	4 KB 4 KB	655ms 174ms	Document text/html	69.194.236.160 IHNET
General Check archive.org Show headers Download Go to Full URL https://graybackproductions.com/ALTA.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 69.194.236.160 Houston, United States, ASN33494 (IHNET, US), Reverse DNS huntaddicts.com Software Apache / Resource Hash 0af6462e9757f6fb4a8b829ef12c3c266767aa8892850460ca5bdda5906fcf02 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains; Request headers Host graybackproductions.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 20 Nov 2020 15:40:31 GMT Server Apache Strict-Transport-Security max-age=63072000; includeSubdomains; Last-Modified Wed, 08 Jan 2020 16:02:14 GMT Accept-Ranges bytes Content-Length 3661 Keep-Alive timeout=5, max=10000 Connection Keep-Alive Content-Type text/html
GET H2	200	1g0f0h.css d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/	486 KB 49 KB	209ms 89ms	Stylesheet text/css	54.230.228.231 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd Requested by Host: graybackproductions.com URL: https://graybackproductions.com/ALTA.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.228.231 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-228-231.waw50.r.cloudfront.net Software AmazonS3 / Resource Hash 2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6 Request headers Referer https://graybackproductions.com/ALTA.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 18:59:21 GMT content-encoding gzip last-modified Wed, 23 Sep 2020 06:55:57 GMT server AmazonS3 age 247582 etag "a0e95bead30d865e0568e839bea91130" x-cache Hit from cloudfront content-type text/css via 1.1 89b8117bd9270d922b4549a30cd5ce50.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop WAW50-C1 accept-ranges bytes content-length 50226 x-amz-cf-id 41so7DCSvOevPptWZLNhjRMjGgD2owXS5_N7eswV9tTFAgtBu_xdPA==
GET H2	200	Ofc365_MSNews.png pronto-core-cdn.prontomarketing.com/2/wp-content/uploads/sites/33/2017/10/	3 KB 4 KB	55ms 25ms	Image image/webp	2606:4700:20::681a:725 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://pronto-core-cdn.prontomarketing.com/2/wp-content/uploads/sites/33/2017/10/Ofc365_MSNews.png Requested by Host: graybackproductions.com URL: https://graybackproductions.com/ALTA.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:725 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 405d34d02a1cbb0605b544e1a0ebfe9249fb849bcf15a9bce978f1783e4b9bd8 Request headers Referer https://graybackproductions.com/ALTA.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 15:45:41 GMT via 1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront) cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 238454 cf-polished origFmt=png, origSize=8558 x-cache Hit from cloudfront content-disposition inline; filename="Ofc365_MSNews.webp" access-control-allow-methods GET,PUT,POST,DELETE,OPTIONS content-length 2718 cf-request-id 0687ee402a0000d6b165030000000001 pragma public last-modified Fri, 19 Jan 2018 17:02:48 GMT server cloudflare etag "5a6224b8-216e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=61%2Bh7QYqqEyuAxRS%2FMZckuK3liLRgajFsyLA0xmzyTdq99ka%2B%2FeZY8GddGBIYwy9RVwth1%2FDxNu6s8Zz2OR%2F1DByZuDLyknSGKZpQj3s8fG6Ay0VwlTciF4w5PVD8kZwtoWK3%2BIrnc7NrG%2Bu2KKblg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * expires Sat, 03 Feb 2029 18:59:20 GMT cache-control public, max-age=259200000 x-amz-cf-pop FRA50-C1 accept-ranges bytes cf-ray 5f534cad0c8ad6b1-FRA access-control-allow-headers Content-Type x-amz-cf-id ndkeAYGoVn9IsClmudOr7ehthoueG8Ng7S2lvxugT4Zl6rWZp2kGYA== cf-bgj imgq:100,h2pri
GET H2	200	images encrypted-tbn0.gstatic.com/	6 KB 7 KB	36ms 15ms	Image image/jpeg	2a00:1450:4001:803::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQbYvwZiUq6WvMN4WiDx9XYcjal16LSHuDkf2BQUsT3G_rgZWLErQ&s Requested by Host: graybackproductions.com URL: https://graybackproductions.com/ALTA.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 25744fb93b0cbaff15a8537a47d1db5b3c12ceef7721ac8498606752ec77fd35 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://graybackproductions.com/ALTA.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 15:45:42 GMT x-content-type-options nosniff last-modified Sun, 16 Dec 2018 09:46:36 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6482 x-xss-protection 0 expires Sat, 20 Nov 2021 15:45:42 GMT
GET H2	200	20dpjc.woff2 d1di2lzuh97fh2.cloudfront.net/files/20/20d/	63 KB 64 KB	179ms 67ms	Font application/font-woff2	54.230.228.231 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1di2lzuh97fh2.cloudfront.net/files/20/20d/20dpjc.woff2 Requested by Host: d1di2lzuh97fh2.cloudfront.net URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.228.231 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-228-231.waw50.r.cloudfront.net Software AmazonS3 / Resource Hash 47107401d0adb375ab9aa167f9d62489a849d510e740a307b5a4db60e5db3562 Request headers Origin https://graybackproductions.com Referer https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 15:31:28 GMT via 1.1 7cd2262b9bb2f116de2e74d9d97ab5d1.cloudfront.net (CloudFront) age 87255 x-cache Hit from cloudfront content-length 64632 last-modified Wed, 23 Sep 2020 07:02:11 GMT server AmazonS3 etag "73f0a88bbca1bec19fb1303c689d04c6" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop WAW50-C1 accept-ranges bytes x-amz-cf-id nChjE_uKjztS-aClZdzFhFa9yLQmZ7j6dRztNZ065PyjeDcU5lAd_Q==
GET H2	200	3ncu8u.woff2 d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/	63 KB 63 KB	196ms 101ms	Font application/font-woff2	54.230.228.231 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/3ncu8u.woff2 Requested by Host: d1di2lzuh97fh2.cloudfront.net URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.228.231 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-228-231.waw50.r.cloudfront.net Software AmazonS3 / Resource Hash 1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591 Request headers Origin https://graybackproductions.com Referer https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 15:31:28 GMT via 1.1 7cd2262b9bb2f116de2e74d9d97ab5d1.cloudfront.net (CloudFront) age 87255 x-cache Hit from cloudfront content-length 64320 last-modified Wed, 23 Sep 2020 07:20:33 GMT server AmazonS3 etag "d26871e8149b5759f814fd3c7a4f784b" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop WAW50-C1 accept-ranges bytes x-amz-cf-id 3zLKpAX58EOvV6AK2IPi2kXDK2CLxFmVSrCg63IpKqILDjZJgTmsyw==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| el

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1di2lzuh97fh2.cloudfront.net
encrypted-tbn0.gstatic.com
graybackproductions.com
pronto-core-cdn.prontomarketing.com
2606:4700:20::681a:725
2a00:1450:4001:803::200e
54.230.228.231
69.194.236.160
0af6462e9757f6fb4a8b829ef12c3c266767aa8892850460ca5bdda5906fcf02
1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591
25744fb93b0cbaff15a8537a47d1db5b3c12ceef7721ac8498606752ec77fd35
2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6
405d34d02a1cbb0605b544e1a0ebfe9249fb849bcf15a9bce978f1783e4b9bd8
47107401d0adb375ab9aa167f9d62489a849d510e740a307b5a4db60e5db3562