sbt.ca Open in urlscan Pro
104.218.61.151  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.html Show response sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/	9 KB 2 KB	386ms 88ms	Document text/html	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash dbfd2b018b43f878a9fd40e499d66975105d15da00538083c4373822515e2598 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language en-CA,en;q=0.9 Response headers content-type text/html last-modified Sat, 23 Oct 2021 15:56:28 GMT accept-ranges bytes content-encoding br vary Accept-Encoding content-length 2089 date Wed, 08 Dec 2021 19:58:13 GMT server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 25 KB	46ms 19ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617 age 19820052 cdn-cachedat 2021-03-10 13:26:21 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 6c3e502570d25d787639333e97698c12 cdn-requestcountrycode US cf-ray 6ba891394c467150-YUL cdn-cache HIT cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	72ms 21ms	Script text/javascript	2607:f8b0:4006:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:27:35 GMT content-encoding gzip x-content-type-options nosniff age 52238 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 08 Dec 2022 05:27:35 GMT
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/	21 KB 7 KB	72ms 28ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1390285 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 6696 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-5309" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0MHVQN2rsBMQWETWeaS10I9ubUKBIbku5a2ZGgfkO94KdTt8dSFKu2m7R3ZN8Ef06Ei9cOSQEfGSQlDvJdbEDasOWUMUfBWGcBSZLSJkUvrUf6JaMICmrU1UFTcQtp8APnZsYqL0o%2B5ftb0sZ8HXURo6"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6ba891396f23ecfe-YUL expires Mon, 28 Nov 2022 19:58:13 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 15 KB	56ms 31ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617 age 23589018 cdn-cachedat 2021-03-10 13:26:22 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 8a0e70cadf0c0c5b1d0c33d233c3670a cdn-requestcountrycode US cf-ray 6ba891394c487150-YUL cdn-cache HIT cdn-requestpullsuccess True
GET H2	200	adobe.jpg sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	30 KB 30 KB	168ms 166ms	Image image/jpeg	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/adobe.jpg Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash 26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 30925 expires Wed, 15 Dec 2021 19:58:13 GMT
GET H2	200	outlook1.png sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	771 B 810 B	157ms 157ms	Image image/png	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/outlook1.png Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash 57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 771 expires Wed, 15 Dec 2021 19:58:13 GMT
GET H2	200	office3651.png sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	18 KB 18 KB	219ms 218ms	Image image/png	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/office3651.png Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash a2f26b68a6c8810c1aeb4048c938f835a86ba83756a7a440f989b967e78f3ba8 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 18025 expires Wed, 15 Dec 2021 19:58:13 GMT
GET H2	200	other1.png sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	21 KB 21 KB	220ms 220ms	Image image/png	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/other1.png Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash 3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 21882 expires Wed, 15 Dec 2021 19:58:13 GMT
GET H2	200	gmail.png sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	65 KB 65 KB	228ms 228ms	Image image/png	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/gmail.png Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash acf087c1757f08b0cfd53d59066544d7ef0bfcc50999e77c5813739cd9dc1479 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 66743 expires Wed, 15 Dec 2021 19:58:13 GMT
GET H2	200	7.jpg sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/	101 KB 101 KB	306ms 305ms	Image image/jpeg	104.218.61.151 UNMETERED
General Check archive.org Show headers Download Go to Show image Full URL https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/images/7.jpg Requested by Host: sbt.ca URL: https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.218.61.151 Kitchener, Canada, ASN54133 (UNMETERED, CA), Reverse DNS h104-218-61-151.ip4.unmetered.hosting Software LiteSpeed / Resource Hash 3b90d0e8ac409fc6bb13eae21873c3c2f3e47c705d7d0d742abed1fe5ab64fe3 Request headers Accept-Language en-CA,en;q=0.9 Referer https://sbt.ca/wp-content/plugins/lkcnwnzjas/zip/allinone/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Wed, 08 Dec 2021 19:58:13 GMT last-modified Sat, 23 Oct 2021 15:56:28 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 103696 expires Wed, 15 Dec 2021 19:58:13 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer) OneDrive (Online) Generic (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
sbt.ca
104.218.61.151
2606:4700::6810:135e
2606:4700::6812:bcf
2607:f8b0:4006:80c::200a
26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
3b90d0e8ac409fc6bb13eae21873c3c2f3e47c705d7d0d742abed1fe5ab64fe3
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
a2f26b68a6c8810c1aeb4048c938f835a86ba83756a7a440f989b967e78f3ba8
acf087c1757f08b0cfd53d59066544d7ef0bfcc50999e77c5813739cd9dc1479
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
dbfd2b018b43f878a9fd40e499d66975105d15da00538083c4373822515e2598
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d