reterydrthdft.jimdofree.com Open in urlscan Pro
34.247.94.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kit.do/QpRAEa
Effective URL:
https://reterydrthdft.jimdofree.com/
Submission Tags: falconsandbox
Submission: On November 07 via api (November 7th 2021, 7:35:57 am UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 15 HTTP transactions. The main IP is 34.247.94.78, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is reterydrthdft.jimdofree.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on February 24th 2020. Valid for: 2 years.

This is the only time reterydrthdft.jimdofree.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3037::ac43:ba77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.247.94.78 34.247.94.78	16509 (AMAZON-02) (AMAZON-02)
8	151.101.194.2 151.101.194.2	54113 (FASTLY) (FASTLY)
1	151.101.66.2 151.101.66.2	54113 (FASTLY) (FASTLY)
1	64.20.41.188 64.20.41.188	19318 (IS-AS-1) (IS-AS-1)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
1	34.248.180.87 34.248.180.87	16509 (AMAZON-02) (AMAZON-02)
1	67.202.94.94 67.202.94.94	32748 (STEADFAST) (STEADFAST)
1	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
15	9

1 2606:4700:3037::ac43:ba77 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

kit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.247.94.78 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-94-78.eu-west-1.compute.amazonaws.com

reterydrthdft.jimdofree.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.194.2 (United States)

ASN54113 (FASTLY, US)

assets.jimstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.jimstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.2 (United States)

ASN54113 (FASTLY, US)

u.jimcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.20.41.188 (United States)

ASN19318 (IS-AS-1, US)
PTR: c2techsys.com

mega-scripts.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.180.87 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-180-87.eu-west-1.compute.amazonaws.com

a.jimdo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.94 (United States)

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	jimstatic.com assets.jimstatic.com fonts.jimstatic.com	336 KB
1	fbcdn.net static.xx.fbcdn.net	2 KB
1	amung.us whos.amung.us	27 B
1	jimdo.com a.jimdo.com	262 B
1	googletagmanager.com www.googletagmanager.com	32 KB
1	mega-scripts.club mega-scripts.club	41 KB
1	jimcdn.com u.jimcdn.com	5 KB
1	jimdofree.com reterydrthdft.jimdofree.com	5 KB
1	kit.do 1 redirects kit.do	2 KB
15	9

	Domain	Requested by
5	assets.jimstatic.com	reterydrthdft.jimdofree.com assets.jimstatic.com
3	fonts.jimstatic.com	u.jimcdn.com fonts.jimstatic.com
1	static.xx.fbcdn.net	reterydrthdft.jimdofree.com
1	whos.amung.us	reterydrthdft.jimdofree.com
1	a.jimdo.com	assets.jimstatic.com
1	www.googletagmanager.com	reterydrthdft.jimdofree.com
1	mega-scripts.club	reterydrthdft.jimdofree.com
1	u.jimcdn.com	reterydrthdft.jimdofree.com
1	reterydrthdft.jimdofree.com
1	kit.do	1 redirects
15	10

This site contains no links.

Subject Issuer	Validity	Valid
*.jimdofree.com RapidSSL RSA CA 2018	`2020-02-24` - `2022-04-24`	2 years	crt.sh
*.jimstatic.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.jimcdn.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
mega-scripts.club cPanel, Inc. Certification Authority	`2021-09-14` - `2021-12-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
*.jimdo.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-05-21` - `2022-06-21`	a year	crt.sh
whos.amung.us Sectigo RSA Domain Validation Secure Server CA	`2020-05-21` - `2022-05-21`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-08-16` - `2021-11-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://reterydrthdft.jimdofree.com/
Frame ID: 1CFFACAE92ECA3F62607BFDC12CB2B21
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kit.do/QpRAEa HTTP 302
https://reterydrthdft.jimdofree.com/ Page URL

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

9
Domains

10
Subdomains

9
IPs

3
Countries

422 kB
Transfer

1288 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kit.do/QpRAEa HTTP 302
https://reterydrthdft.jimdofree.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
reterydrthdft.jimdofree.com/
Redirect Chain

https://kit.do/QpRAEa
https://reterydrthdft.jimdofree.com/

13 KB
5 KB

211ms
75ms

Document
text/html

34.247.94.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://reterydrthdft.jimdofree.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

34.247.94.78 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-94-78.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

732f122f013ad70ad20a9d633293def0a60653b9a6003c3a3424f98a7404a409

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sun, 07 Nov 2021 07:35:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-RateLimit-Limit: 8000
X-RateLimit-Remaining: 7997
X-RateLimit-Reset: 39
X-Jimdo-Instance: i-001fa38996b11b175
X-Jimdo-Wid: s8e655f312f4b5cdd
Cache-Control: no-cache, no-store, must-revalidate
Strict-Transport-Security: max-age=604800
Server: nginx
Content-Encoding: gzip

Redirect headers

date: Sun, 07 Nov 2021 07:35:52 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.2.26
cache-control: no-cache, private max-age=0
location: https://reterydrthdft.jimdofree.com
expires: Sun, 07 Nov 2021 07:35:52 GMT
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MaMyp6L5eAkRSAMFFrMQSWuXmvTB3pu7nmqA%2Fp%2B7tCLmjYop3N3quoTxwM6%2BUfH587XfAlXT1brRROFQ7e5lIOiT5KLuhnw15H8F4j9L2aOrajLk1xEMpmC5cTLt9W9TcdYEpFc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6aa4e325ef11d6f1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 ckies.js.c4e80683fb02bdc0ba01.js Show response
assets.jimstatic.com/ 2 KB
1 KB 39ms
15ms Script
application/javascript 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jimstatic.com/ckies.js.c4e80683fb02bdc0ba01.js
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c59dab7124ad69703a6bb26c68b9583d2af62169a5992861fc246c8cda479ae0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
age: 16763364
etag: "f988bb1f56190440cd4813cd934d2b07"
x-served-by: cache-lcy19261-LCY, cache-fra19140-FRA
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-timer: S1636270553.138340,VS0,VE0
content-length: 892
x-cache-hits: 1, 37413

GET
H2 200 cookieControl.js.007e7d70561ad946c7f1.js Show response
assets.jimstatic.com/ 25 KB
8 KB 38ms
14ms Script
application/javascript 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jimstatic.com/cookieControl.js.007e7d70561ad946c7f1.js
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4a588a13da54a0c162a15715b5c71bd870b860a7c5e81d11dee1cea3dc4c6a7d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
age: 1491040
etag: "def1c2a30f15f995f02d8a4cc7fe33b1"
x-served-by: cache-lcy19250-LCY, cache-fra19140-FRA
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-timer: S1636270553.138432,VS0,VE0
content-length: 8511
x-cache-hits: 1, 37505

GET
H2 200 layout.css
u.jimcdn.com/cms/o/s8e655f312f4b5cdd/layout/dm_052515a0bbb670c7e72cd9ff1eadc492/css/ 29 KB
5 KB 107ms
83ms Stylesheet
text/css 151.101.66.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://u.jimcdn.com/cms/o/s8e655f312f4b5cdd/layout/dm_052515a0bbb670c7e72cd9ff1eadc492/css/layout.css?t=1526995598

Requested by

Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9454f5d56f9ed4405959f8c799e291e8bc6792f982cbd63570d19a713277de06

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 0
x-cache: MISS
content-length: 5139
x-served-by: cache-fra19153-FRA
access-control-allow-origin: *
server: nginx
x-timer: S1636270553.137977,VS0,VE75
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
via: 1.1 varnish
cache-control: public, max-age=691200
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 web.css.77cfc915fe222f26e0fee5315a170b55.css
assets.jimstatic.com/ 228 KB
62 KB 30ms
6ms Stylesheet
text/css 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jimstatic.com/web.css.77cfc915fe222f26e0fee5315a170b55.css
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5f83806a71543acfa41689841f5813c9cec8b14382f6c1f0493393e0a3ca58ba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
age: 3463376
etag: "c0f1a65bf86a73a6b0adef04eebdb4f7"
x-served-by: cache-lcy19236-LCY, cache-fra19140-FRA
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-timer: S1636270553.138243,VS0,VE0
content-length: 62987
x-cache-hits: 1, 22976

GET
H2 200 web.js.85d2f03d01f1292782b0.js Show response
assets.jimstatic.com/ 694 KB
228 KB 8ms
7ms Script
application/javascript 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jimstatic.com/web.js.85d2f03d01f1292782b0.js
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: eb13ea421f55a90fa4d251295edcf637758a2f65943402771f8410048b5419e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
age: 8349499
etag: "f4611e7c964152654b8f94f40c2b7a4e"
x-served-by: cache-lcy19221-LCY, cache-fra19140-FRA
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-timer: S1636270553.165143,VS0,VE0
content-length: 233071
x-cache-hits: 1, 13507

GET
H2 200 / Show response
mega-scripts.club/ 167 KB
41 KB 843ms
272ms Script
text/html 64.20.41.188
IS-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://mega-scripts.club/?token=f24e9a1993e012da722dca6b6ceabd30
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 64.20.41.188 , United States, ASN19318 (IS-AS-1, US),
Reverse DNS: c2techsys.com
Software: LiteSpeed /
Resource Hash: 359fff2de82d4e714964152dd385026890f949f9bd46be32aa7f03385d62bf3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: br
server: LiteSpeed
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

GET
H2 200 css
fonts.jimstatic.com/ 10 KB
2 KB 55ms
55ms Stylesheet
text/css 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.jimstatic.com/css?family=Noto+Sans:400,700,400italic,700italic|Kelly+Slab

Requested by

Host: u.jimcdn.com
URL: https://u.jimcdn.com/cms/o/s8e655f312f4b5cdd/layout/dm_052515a0bbb670c7e72cd9ff1eadc492/css/layout.css?t=1526995598

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

d9813cd11b414066a1519b4f37271371be5747ab576a939f89fae35745f17c4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://u.jimcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish
x-cache: MISS
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
content-length: 976
x-xss-protection: 0
x-served-by: cache-fra19140-FRA
last-modified: Sun, 07 Nov 2021 06:23:41 GMT
server: nginx/1.21.3
date: Sun, 07 Nov 2021 07:35:53 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
expires: Sun, 07 Nov 2021 07:35:53 GMT
cache-control: private, max-age=86400, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
x-cache-hits: 0

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 80 KB
32 KB 106ms
14ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WDBL3P

Requested by

Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

44f23467329c81465df13dcfd562fa7d22aa91ec182fe854e7203fb6cb35d670

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32275
x-xss-protection: 0
last-modified: Sun, 07 Nov 2021 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 07 Nov 2021 07:35:53 GMT

GET
H2 200 o-0IIpQlx3QUlC5A4PNr5TRA.woff2
fonts.jimstatic.com/s/notosans/v21/ 16 KB
16 KB 93ms
6ms Font
font/woff2 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.jimstatic.com/s/notosans/v21/o-0IIpQlx3QUlC5A4PNr5TRA.woff2

Requested by

Host: fonts.jimstatic.com
URL: https://fonts.jimstatic.com/css?family=Noto+Sans:400,700,400italic,700italic|Kelly+Slab

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

sffe /

Resource Hash

4a9f53c02752e79270686f1b2a3616b86d3af1ea2a288f2977e34b1141d552ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.jimstatic.com/css?family=Noto+Sans:400,700,400italic,700italic|Kelly+Slab
Origin: https://reterydrthdft.jimdofree.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1602457
via: 1.1 varnish
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 16079
x-xss-protection: 0
x-served-by: cache-fra19158-FRA
last-modified: Tue, 14 Sep 2021 16:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
expires: Wed, 19 Oct 2022 18:28:16 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
x-cache-hits: 12

GET
H2 200 75bbc5f8afda440f1457513ed2118221.png
assets.jimstatic.com/ 3 KB
3 KB 7ms
6ms Image
image/png 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.jimstatic.com/75bbc5f8afda440f1457513ed2118221.png
Requested by: Host: assets.jimstatic.com
URL: https://assets.jimstatic.com/web.css.77cfc915fe222f26e0fee5315a170b55.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 72ce4ef58b1760f190fc5e8e380c721e2781cf4089fcb00021a3580a0448baed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://assets.jimstatic.com/web.css.77cfc915fe222f26e0fee5315a170b55.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
age: 5653418
etag: "75bbc5f8afda440f1457513ed2118221"
x-served-by: cache-lcy19257-LCY, cache-fra19140-FRA
x-cache: HIT, HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-timer: S1636270553.367864,VS0,VE0
content-length: 3385
x-cache-hits: 1, 1887

GET
H2 200 o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2
fonts.jimstatic.com/s/notosans/v21/ 16 KB
16 KB 23ms
6ms Font
font/woff2 151.101.194.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.jimstatic.com/s/notosans/v21/o-0NIpQlx3QUlC5A4PNjXhFVZNyB.woff2

Requested by

Host: fonts.jimstatic.com
URL: https://fonts.jimstatic.com/css?family=Noto+Sans:400,700,400italic,700italic|Kelly+Slab

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

sffe /

Resource Hash

8beec539128cea621e511cd54f21a0d17ff891a16a0ebd7a98a3e4fbc00bd0e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.jimstatic.com/css?family=Noto+Sans:400,700,400italic,700italic|Kelly+Slab
Origin: https://reterydrthdft.jimdofree.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 498064
via: 1.1 varnish
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 16203
x-xss-protection: 0
x-served-by: cache-fra19158-FRA
last-modified: Tue, 14 Sep 2021 16:43:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
expires: Tue, 01 Nov 2022 13:14:49 GMT
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
x-cache-hits: 3

GET
H/1.1 200
OK loginstate Show response
a.jimdo.com/app/web/ 64 B
262 B 179ms
34ms Script
application/javascript 34.248.180.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://a.jimdo.com/app/web/loginstate?callback=jQuery112008200393325059121_1636270552967&owi=s8e655f312f4b5cdd&_=1636270552968

Requested by

Host: assets.jimstatic.com
URL: https://assets.jimstatic.com/web.js.85d2f03d01f1292782b0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.248.180.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-248-180-87.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

0ba479061e4a37a55e42dba58e20d7be1e491fc9b72839e194f6e71c0522701c

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Sun, 07 Nov 2021 07:35:53 GMT
Server: nginx
Connection: keep-alive
Content-Length: 64
Strict-Transport-Security: max-age=10886400
Content-Type: application/javascript

GET
H2 200 /
whos.amung.us/pingjs/ 27 B
27 B 313ms
101ms Image
text/javascript 67.202.94.94
STEADFAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whos.amung.us/pingjs/?k=onthelow&t=Blacksar%20Inc.&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=5196
Requested by: Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.202.94.94 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: amung.us
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Sun, 07 Nov 2021 07:35:54 GMT
content-encoding: gzip
content-type: text/javascript;charset=UTF-8

GET
H2 200 dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ 2 KB
2 KB 21ms
7ms Image
image/svg+xml 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg

Requested by

Host: reterydrthdft.jimdofree.com
URL: https://reterydrthdft.jimdofree.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://reterydrthdft.jimdofree.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: br
x-content-type-options: nosniff
content-md5: NiMA5zHIsmaYxSYEaw9fHg==
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.xx.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1027
x-xss-protection: 0
x-fb-debug: wmU5Y+APjyDk5B063WHpWaZcwx5RmEnOUsyyBUH42BXZGg4dtzO74By51sxeq2z+zDrGzy0xUb1r3L04NBut4g==
x-fb-trip-id: 686109401
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
date: Sun, 07 Nov 2021 07:35:54 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
x-fb-rlafr: 0
timing-allow-origin: *
expires: Sun, 06 Nov 2022 03:19:10 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.kit.do/	1970-01-19 22:31:17	Name: XSRF-TOKEN Value: eyJpdiI6ImdEWGk4UEJKNXhKYTJKMFgxd0FuNHc9PSIsInZhbHVlIjoiRDhISFVDV29XcCt0bFA4SFc2NGJVZStacE91ZlYyMnRMSFlpbTJQZlRFZ1BqaEJVZlEzeFREWGJOa2l5NnB2KyIsIm1hYyI6ImUzZjFiNjBlOTc2ZWJiOWIyMzI0ZTk0Yzk2NmEzNmYzOTdhYTUwYWU5NTlmMzIzYzQ2NTRjNWE2MmRmNzIxZTIifQ%3D%3D
.kit.do/	1970-01-19 22:31:17	Name: kitdo_session Value: eyJpdiI6ImJzWXU5aVkwYlFaZDNMaDUyVlZHY3c9PSIsInZhbHVlIjoiRUtsSjJsNDRQMkgxUUlFd2l5bE9xSVdUVmxGdjgwaEVlM1EvWklad0ZMSEpOdUtPNElnZGFFS0k1S2pYTWhBRCIsIm1hYyI6ImJlOTkwODQ3YjY1ZTEwMjcyMWJhZDJiMjVhZWViMmZiN2RiZmNkYjMxN2M2MDJiMzlhZjY4NDRhYzk0MTMyYTEifQ%3D%3D
.kit.do/	1970-01-23 14:07:10	Name: utid Value: eyJpdiI6ImFvLzYxUkc4em1hbitvQ0Q1aCtNaGc9PSIsInZhbHVlIjoiZXVsSEJCZ055RmtNWWtFWWZhRWw1RWVnRlpra1ZPb0UyTmN0SldWMlhNMD0iLCJtYWMiOiI4ZGU2ZGVmY2VhNTU4Y2MzNTlkY2Q0ZjExZGJiNjc3ZjMzOWViZmZkMzg3NDk2NjYzMjRjZGNiMWNlODNlNzgxIn0%3D
.kit.do/	1970-01-20 07:16:46	Name: locale Value: en

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=604800

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.jimdo.com
assets.jimstatic.com
fonts.jimstatic.com
kit.do
mega-scripts.club
reterydrthdft.jimdofree.com
static.xx.fbcdn.net
u.jimcdn.com
whos.amung.us
www.googletagmanager.com
151.101.194.2
151.101.66.2
2606:4700:3037::ac43:ba77
2a00:1450:4001:82a::2008
2a03:2880:f01c:8012:face:b00c:0:3
34.247.94.78
34.248.180.87
64.20.41.188
67.202.94.94
0ba479061e4a37a55e42dba58e20d7be1e491fc9b72839e194f6e71c0522701c
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
359fff2de82d4e714964152dd385026890f949f9bd46be32aa7f03385d62bf3f
44f23467329c81465df13dcfd562fa7d22aa91ec182fe854e7203fb6cb35d670
4a588a13da54a0c162a15715b5c71bd870b860a7c5e81d11dee1cea3dc4c6a7d
4a9f53c02752e79270686f1b2a3616b86d3af1ea2a288f2977e34b1141d552ec
5f83806a71543acfa41689841f5813c9cec8b14382f6c1f0493393e0a3ca58ba
72ce4ef58b1760f190fc5e8e380c721e2781cf4089fcb00021a3580a0448baed
732f122f013ad70ad20a9d633293def0a60653b9a6003c3a3424f98a7404a409
8beec539128cea621e511cd54f21a0d17ff891a16a0ebd7a98a3e4fbc00bd0e5
9454f5d56f9ed4405959f8c799e291e8bc6792f982cbd63570d19a713277de06
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
c59dab7124ad69703a6bb26c68b9583d2af62169a5992861fc246c8cda479ae0
d9813cd11b414066a1519b4f37271371be5747ab576a939f89fae35745f17c4b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb13ea421f55a90fa4d251295edcf637758a2f65943402771f8410048b5419e7

reterydrthdft.jimdofree.com Open in urlscan Pro 34.247.94.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

9 Domains

10 Subdomains

9 IPs

3 Countries

422 kBTransfer

1288 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

reterydrthdft.jimdofree.com Open in urlscan Pro
34.247.94.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

9
Domains

10
Subdomains

9
IPs

3
Countries

422 kB
Transfer

1288 kB
Size

4
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!