hololens.giestig.be Open in urlscan Pro
2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9d...
Submission: On December 24 via automatic, source openphish (December 24th 2018, 5:46:00 am UTC)

Summary HTTP 30 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 30 HTTP transactions. The main IP is 2a00:f10:305:0:1c00:fcff:fe00:4eb, located in Netherlands and belongs to ASTRALUS, NL. The main domain is hololens.giestig.be.

This is the only time hololens.giestig.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
14	2a00:f10:305:... 2a00:f10:305:0:1c00:fcff:fe00:4eb	48635 (ASTRALUS) (ASTRALUS)
2	2a02:26f0:6c0... 2a02:26f0:6c00:283::34ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	209.126.103.139 209.126.103.139	30083 (HEG-US) (HEG-US - HEG US Inc.)
1	52.72.84.91 52.72.84.91	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	146.185.234.113 146.185.234.113	44050 (PIN-AS) (PIN-AS)
30	6

14 2a00:f10:305:0:1c00:fcff:fe00:4eb (Netherlands)

ASN48635 (ASTRALUS, NL)

hololens.giestig.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:283::34ef (European Union)

ASN20940 (AKAMAI-ASN1, US)

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.126.103.139 (Saint Louis, United States)

ASN30083 (HEG-US - HEG US Inc., US)
PTR: condor2710.startdedicated.com

upgraderservices.cf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
king.connectioncdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.72.84.91 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-84-91.compute-1.amazonaws.com

wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.185.234.113 (Saint Petersburg, Russian Federation)

ASN44050 (PIN-AS, RU)

146.185.234.113	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	giestig.be hololens.giestig.be	156 KB
2	gfx.ms auth.gfx.ms	293 KB
1	connectioncdn.com king.connectioncdn.com	271 B
1	auth0-extend.com wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	2 KB
1	upgraderservices.cf upgraderservices.cf	1 KB
0	drupalupdates.tk Failed drupalupdates.tk Failed
30	6

	Domain	Requested by
14	hololens.giestig.be	hololens.giestig.be
2	auth.gfx.ms	hololens.giestig.be
1	king.connectioncdn.com	upgraderservices.cf
1	wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com	hololens.giestig.be
1	upgraderservices.cf	hololens.giestig.be
0	drupalupdates.tk Failed	hololens.giestig.be
30	6

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
msagfx.live.com Microsoft IT TLS CA 4	`2017-07-27` - `2019-07-17`	2 years	crt.sh
*.auth0-extend.com Amazon	`2018-05-12` - `2019-06-12`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Frame ID: 587A3D8B6CB168161EBA8B80B7F79F4C
Requests: 6 HTTP requests in this frame

Frame: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Frame ID: F8B57AD7097D95DDEBDB856403F4CB95
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

30
Requests

10 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1116 kB
Transfer

1471 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1493260925%26rver%3d6.7.6640.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%26id%3d292841%26CBCXT%3dout%26fl%3dwld%26cobrandid%3d90015%26uaid%3da8d60e23f71e4b599fedbd2dd6b98946%26pid%3d0%26contextid%3d0EE9DFF844DE79AF%26bk%3d1500403644&id=292841&uiflavor=web&cobrandid=90015&uaid=a8d60e23f71e4b599fedbd2dd6b98946&mkt=EN-US&lc=1033&bk=1500403644
Title: Forgot my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1493260925&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1&id=292841&CBCXT=out&fl=wld&cobrandid=90015&uaid=a8d60e23f71e4b599fedbd2dd6b98946&pid=0&contextid=0EE9DFF844DE79AF&ru=https://outlook.live.com/owa/%3fnlp%3d1&bk=1500403644&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set verificationAttempt.php Show response
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/ 19 KB
6 KB 72ms
59ms Document
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

9b19160817827db92719cc1bb713dca7a294ad7ee3c7e92135cd5f74d9a3f2ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: hololens.giestig.be
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6; path=/
X-Content-Type-Options: nosniff
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 5299
Keep-Alive: timeout=5, max=100
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Converged1033.css
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 85 KB
17 KB 19ms
19ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/Converged1033.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "153be-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16603
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK microsoft_logo.svg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 4 KB
2 KB 29ms
17ms Image
image/svg+xml 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/microsoft_logo.svg

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "e43-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=5, max=100
Content-Length: 1435
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK picker_account_msa.svg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ 379 B
770 B 35ms
23ms Image
image/svg+xml 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/picker_account_msa.svg

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Aug 2017 04:33:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "17b-557dceb339080-gzip"
Vary: Accept-Encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=5, max=100
Content-Length: 254
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 404
Not Found prefetch.html Show response
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/ Frame F8B5 10 KB
3 KB 85ms
85ms Document
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Requested by

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

b1050b3071c434fdcc074016fa4d683766344babfb28751008f78b132f340afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: hololens.giestig.be
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
X-Content-Type-Options: nosniff
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2656
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 0-small.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 1 KB
1 KB 64ms
5ms Image
image/jpeg 2a02:26f0:6c00:283::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:283::34ef , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash: c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Last-Modified: Sat, 01 Jul 2017 02:01:48 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "0ce5dffdf2d21:0"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=341253
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1029
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK 0.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 291 KB
291 KB 64ms
6ms Image
image/jpeg 2a02:26f0:6c00:283::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:283::34ef , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Microsoft-IIS/8.5 /
Resource Hash: 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/verificationAttempt.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Last-Modified: Sat, 01 Jul 2017 02:01:48 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G003 V: 0
ETag: "0ce5dffdf2d21:0"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=337215
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 298105
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK drupal.js Show response
upgraderservices.cf/ Frame F8B5 3 KB
1 KB 1599ms
137ms Script
application/javascript 209.126.103.139
HEG US Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://upgraderservices.cf/drupal.js
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Protocol: HTTP/1.1
Server: 209.126.103.139 Saint Louis, United States, ASN30083 (HEG-US - HEG US Inc., US),
Reverse DNS: condor2710.startdedicated.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 2d0dcd926f200765f63ec7ee5a983d14ce6a5e763ed2d04fdff87b88717ccdf9

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:43 GMT
Content-Encoding: gzip
Server: Apache/2.4.18 (Ubuntu)
Connection: close
Content-Length: 1257
Vary: Accept-Encoding
Content-Type: application/javascript

GET check.js
drupalupdates.tk/ Frame F8B5 0
0

GET
H/1.1 200
OK css_hbkBHRY8Daq4NUMRFdNMs-zDBxFoBfC5ntfPS20CVwc.css
hololens.giestig.be/sites/default/files/css/ Frame F8B5 3 KB
2 KB 28ms
16ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_hbkBHRY8Daq4NUMRFdNMs-zDBxFoBfC5ntfPS20CVwc.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

85b9011d163c0daab835431115d34cb3ecc307116805f0b99ed7cf4b6d025707

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "41f-55564c102b1d4"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 1055
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK css_JCY_XIQAlFCN_AbvjWfbNrXAa03IOm7FrXUxsDgkibE.css
hololens.giestig.be/sites/default/files/css/ Frame F8B5 1 KB
901 B 26ms
14ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_JCY_XIQAlFCN_AbvjWfbNrXAa03IOm7FrXUxsDgkibE.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

24263f5c840094508dfc06ef8d67db36b5c06b4dc83a6ec5ad7531b0382489b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:47 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "18b-55564c107c2b4"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 395
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK css_E62ZEKedYm_zM64tZC3NbyssbSXcyQktLI2_k3Ls3Tk.css
hololens.giestig.be/sites/default/files/css/ Frame F8B5 512 B
766 B 25ms
13ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_E62ZEKedYm_zM64tZC3NbyssbSXcyQktLI2_k3Ls3Tk.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

13ad9910a79d626ff333ae2d642dcd6f2b2c6d25dcc9092d2c8dbf9372ecdd39

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:45 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "104-55564c0f3061d"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 260
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK css_HTdYZ7IecnT2Flk3-Qqjsj1K5kXl2IjDkle1RcV-KlQ.css
hololens.giestig.be/sites/default/files/css/ Frame F8B5 164 KB
29 KB 27ms
14ms Stylesheet
text/css 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/css/css_HTdYZ7IecnT2Flk3-Qqjsj1K5kXl2IjDkle1RcV-KlQ.css

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

1d375867b21e7274f6165937f90aa3b23d4ae645e5d888c39257b545c57e2a54

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:46 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "72e3-55564c104d0cc"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=100
Content-Length: 29411
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK js_MpKfe1sTh5JIVGCZ17DsAuT1rqAC38MLLlkjqjQ1X_k.js Show response
hololens.giestig.be/sites/default/files/js/ Frame F8B5 110 KB
39 KB 25ms
13ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_MpKfe1sTh5JIVGCZ17DsAuT1rqAC38MLLlkjqjQ1X_k.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

32929f7b5b13879248546099d7b0ec02e4f5aea002dfc30b2e5923aa34355ff9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:54 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "9938-55564c17735ee"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 39224
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK js_CwP66t6LdsqLgaXhhlSqVekMekJtInqRpmnECh57PGw.js Show response
hololens.giestig.be/sites/default/files/js/ Frame F8B5 67 KB
14 KB 27ms
15ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_CwP66t6LdsqLgaXhhlSqVekMekJtInqRpmnECh57PGw.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

0b03faeade8b76ca8b81a5e18654aa55e90c7a426d227a91a669c40a1e7b3c6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:52 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "3621-55564c15847f8"
Vary: Accept-encoding,User-Agent
Upgrade: h2,h2c
Cache-Control: max-age=1209600
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=5, max=100
Content-Length: 13857
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 200
OK hololens-logo.png
hololens.giestig.be/sites/default/files/ Frame F8B5 39 KB
39 KB 15ms
13ms Image
image/png 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/sites/default/files/hololens-logo.png

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

23ffb630fc865c9803e7c6ed9517b81389ac72502a48ebe0e438d790b642cff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:18 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "9b1c-55564bf4de59a"
Content-Type: image/png
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 39708
Expires: Mon, 07 Jan 2019 05:45:41 GMT

GET
H/1.1 404
Not Found hololens_home.jpg
hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/sites/all/themes/hololens/img/ Frame F8B5 530 B
530 B 48ms
47ms Image
text/html 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/sites/all/themes/hololens/img/hololens_home.jpg

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

26f0dcdc824866cb08675578f920751a8fcdac002594f971772cf9bb7522acc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Cookie: PHPSESSID=ko2i33sn3e6uil1kph2tjjj6n6
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 353

GET
H/1.1 200
OK full-http-control Show response
wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/ Frame F8B5 1 KB
2 KB 449ms
110ms Script
text/javascript 52.72.84.91
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/full-http-control
Requested by: Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.84.91 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-72-84-91.compute-1.amazonaws.com
Software: webtask /
Resource Hash: bc2e0dd55d677e24dc65338456454660a84f77a99fae5cddd379291633c44b15

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 24 Dec 2018 05:45:42 GMT
Server: webtask
x-auth0-stats: {"worker_pid":6,"response":{"200":19},"time":0,"uptime":77.74,"memory":{"rss":46858240,"heapTotal":21315584,"heapUsed":14228256,"external":242070}}
content-type: text/javascript
x-auth0-proxy-stats: {"proxy_host":"172.20.62.71","proxy_pid":48,"container_id":"62229447-9cad-414a-b7db-b81a9b3027fb","latency":5,"uptime":362352.277,"memory":{"rss":97505280,"heapTotal":61607936,"heapUsed":46591200,"external":711007},"req_id":"1545630342469.52955"}
x-wt-response-source: webtask
x-wt-request-id: 1545630342469.52955
Connection: keep-alive
Content-Length: 1105

GET
H/1.1 200
OK js_L50O_PWoAuMOxVjnzZCkNSSmI0kFwhZsO1_KS8WnGKw.js Show response
hololens.giestig.be/sites/default/files/js/ Frame F8B5 8 KB
3 KB 14ms
13ms Script
text/javascript 2a00:f10:305:0:1c00:fcff:fe00:4eb
ASTRALUS

General

Check archive.org

Show headers Download Go to

Full URL

http://hololens.giestig.be/sites/default/files/js/js_L50O_PWoAuMOxVjnzZCkNSSmI0kFwhZsO1_KS8WnGKw.js

Requested by

Host: hololens.giestig.be
URL: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html

Protocol

HTTP/1.1

Server

2a00:f10:305:0:1c00:fcff:fe00:4eb , Netherlands, ASN48635 (ASTRALUS, NL),

Reverse DNS

Software

Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4 /

Resource Hash

2f9d0efcf5a802e30ec558e7cd90a43524a6234905c2166c3b5fca4bc5a718ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:42 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Jul 2017 18:21:53 GMT
Server: Apache/2.4.37 (cPanel) OpenSSL/1.0.2p mod_bwlimited/1.4
ETag: "8b4-55564c16d75d7"
Vary: Accept-encoding,User-Agent
Content-Type: text/javascript
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2228
Expires: Mon, 07 Jan 2019 05:45:42 GMT

POST
H/1.1 200
OK stats.php Show response
king.connectioncdn.com/f/ Frame F8B5 5 B
271 B 281ms
141ms XHR
text/html 209.126.103.139
HEG US Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://king.connectioncdn.com/f/stats.php
Requested by: Host: upgraderservices.cf
URL: http://upgraderservices.cf/drupal.js
Protocol: HTTP/1.1
Server: 209.126.103.139 Saint Louis, United States, ASN30083 (HEG-US - HEG US Inc., US),
Reverse DNS: condor2710.startdedicated.com
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
Origin: http://hololens.giestig.be
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Mon, 24 Dec 2018 05:45:43 GMT
Content-Encoding: gzip
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: close
Content-Length: 25

GET
H/1.1 200
OK hhY6.js Show response
146.185.234.113/ Frame F8B5 664 KB
664 KB 76ms
38ms Script
application/javascript 146.185.234.113
PIN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://146.185.234.113/hhY6.js
Requested by: Host: wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com
URL: https://wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com/full-http-control
Protocol: HTTP/1.1
Server: 146.185.234.113 Saint Petersburg, Russian Federation, ASN44050 (PIN-AS, RU),
Reverse DNS
Software: nginx/1.6.2 /
Resource Hash: 3899cec93c65c297043a1f714510c529652bcc7e568fbb271889a14e9d844afa

Request headers

Referer: http://hololens.giestig.be/includes/filetransfer/mine/Share_doc-file/files/prefetch.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 24 Dec 2018 05:45:43 GMT
Last-Modified: Fri, 21 Dec 2018 08:02:58 GMT
Server: nginx/1.6.2
ETag: "5c1c9e32-a5ff4"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 679924

GET f1c5c07f-a8e7-40ea-85b5-7333af917c8f
http://hololens.giestig.be/ Frame F8B5 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: drupalupdates.tk
URL: http://drupalupdates.tk/check.js

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Domain: hololens.giestig.be
URL: blob:http://hololens.giestig.be/f1c5c07f-a8e7-40ea-85b5-7333af917c8f

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| empty

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hololens.giestig.be/	1969-12-31 23:59:59	Name: has_js Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
drupalupdates.tk
hololens.giestig.be
king.connectioncdn.com
upgraderservices.cf
wt-23afbbf05d73a701c3ef54b49e4de14c-0.sandbox.auth0-extend.com
drupalupdates.tk
hololens.giestig.be
146.185.234.113
209.126.103.139
2a00:f10:305:0:1c00:fcff:fe00:4eb
2a02:26f0:6c00:283::34ef
52.72.84.91
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0b03faeade8b76ca8b81a5e18654aa55e90c7a426d227a91a669c40a1e7b3c6c
0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff
13ad9910a79d626ff333ae2d642dcd6f2b2c6d25dcc9092d2c8dbf9372ecdd39
1d375867b21e7274f6165937f90aa3b23d4ae645e5d888c39257b545c57e2a54
23ffb630fc865c9803e7c6ed9517b81389ac72502a48ebe0e438d790b642cff8
24263f5c840094508dfc06ef8d67db36b5c06b4dc83a6ec5ad7531b0382489b1
26f0dcdc824866cb08675578f920751a8fcdac002594f971772cf9bb7522acc3
2d0dcd926f200765f63ec7ee5a983d14ce6a5e763ed2d04fdff87b88717ccdf9
2f9d0efcf5a802e30ec558e7cd90a43524a6234905c2166c3b5fca4bc5a718ac
32929f7b5b13879248546099d7b0ec02e4f5aea002dfc30b2e5923aa34355ff9
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
3899cec93c65c297043a1f714510c529652bcc7e568fbb271889a14e9d844afa
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
85b9011d163c0daab835431115d34cb3ecc307116805f0b99ed7cf4b6d025707
9b19160817827db92719cc1bb713dca7a294ad7ee3c7e92135cd5f74d9a3f2ea
b1050b3071c434fdcc074016fa4d683766344babfb28751008f78b132f340afc
bc2e0dd55d677e24dc65338456454660a84f77a99fae5cddd379291633c44b15
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

hololens.giestig.be Open in urlscan Pro 2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

30 Requests

10 %HTTPS

40 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

1116 kBTransfer

1471 kBSize

1 Cookies

4 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

hololens.giestig.be Open in urlscan Pro
2a00:f10:305:0:1c00:fcff:fe00:4eb Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

10 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

1116 kB
Transfer

1471 kB
Size

1
Cookies

30 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!