boterosalas.github.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:50c0:8003::153, located in United States and belongs to FASTLY, US. The main domain is boterosalas.github.io.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on February 21st 2023. Valid for: a year.

This is the only time boterosalas.github.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:50c0:800... 2606:50c0:8003::153	54113 (FASTLY) (FASTLY)
1	23.39.251.87 23.39.251.87	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.109.4.19 52.109.4.19	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	3

3 2606:50c0:8003::153 (United States)

ASN54113 (FASTLY, US)

boterosalas.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.39.251.87 (Paris, France)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-39-251-87.deploy.static.akamaitechnologies.com

cdn.odc.officeapps.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.109.4.19 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

odc.officeapps.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	github.io boterosalas.github.io	142 KB
2	live.com cdn.odc.officeapps.live.com — Cisco Umbrella Rank: 1863 odc.officeapps.live.com — Cisco Umbrella Rank: 216	5 KB
5	2

	Domain	Requested by
3	boterosalas.github.io	boterosalas.github.io
1	odc.officeapps.live.com	boterosalas.github.io
1	cdn.odc.officeapps.live.com	boterosalas.github.io
5	3

This site contains no links.

Subject Issuer	Validity	Valid
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh
cdn.odc.officeapps.live.com Microsoft Azure TLS Issuing CA 05	`2022-10-12` - `2023-10-07`	a year	crt.sh
odc.officeapps.live.com Microsoft Azure TLS Issuing CA 02	`2023-08-07` - `2024-06-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://boterosalas.github.io/diego/
Frame ID: 714D39E2DCD103EEE5AF3B219184C899
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft

Detected technologies

GitHub Pages (CDN) Expand

Overall confidence: 100%
Detected patterns

^https?://[^/]+\.github\.io

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

146 kB
Transfer

261 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
boterosalas.github.io/diego/ 2 KB
1 KB 127ms
44ms Document
text/html 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://boterosalas.github.io/diego/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

841215eae7d0170bfc21883283be68ea0faa2b79ca65f1d9abd124a1a55ad4ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 0
cache-control: max-age=600
content-encoding: gzip
content-length: 623
content-type: text/html; charset=utf-8
date: Thu, 24 Aug 2023 00:08:16 GMT
etag: W/"60a42fce-623"
expires: Thu, 24 Aug 2023 00:18:16 GMT
last-modified: Tue, 18 May 2021 21:21:18 GMT
permissions-policy: interest-cohort=()
server: GitHub.com
strict-transport-security: max-age=31556952
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: 71b0153fec8ae83bf0dcad9aee02ca54fd4b1846
x-github-request-id: FBC0:3315:2EFD4B:4655EF:64E69F70
x-proxy-cache: MISS
x-served-by: cache-nyc-kteb1890052-NYC
x-timer: S1692835697.734002,VS0,VE15

GET
H2 200 style.css
boterosalas.github.io/diego/ 3 KB
1 KB 46ms
45ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://boterosalas.github.io/diego/style.css

Requested by

Host: boterosalas.github.io
URL: https://boterosalas.github.io/diego/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

de1d566b1dadffb7ff4888df89e9696e8dffd620bc5d081c5f84780dcfba0d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

accept-language: en-US,en;q=0.9
Referer: https://boterosalas.github.io/diego/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-fastly-request-id: f92afadf751af3475cbf9b0a482e803463b10b6e
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 24 Aug 2023 00:08:16 GMT
age: 0
x-cache: MISS
x-cache-hits: 0
x-proxy-cache: MISS
content-length: 1134
x-served-by: cache-nyc-kteb1890052-NYC
last-modified: Tue, 18 May 2021 21:21:18 GMT
server: GitHub.com
x-github-request-id: 3E84:1451:31D493:49336E:64E69F70
x-timer: S1692835697.807282,VS0,VE14
etag: W/"60a42fce-c01"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
expires: Thu, 24 Aug 2023 00:18:16 GMT

GET
H2 200 microsoft_logo.svg
cdn.odc.officeapps.live.com/odc/stat/images/hrd/ 4 KB
2 KB 478ms
116ms Image
image/svg+xml 23.39.251.87
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.odc.officeapps.live.com/odc/stat/images/hrd/microsoft_logo.svg

Requested by

Host: boterosalas.github.io
URL: https://boterosalas.github.io/diego/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

23.39.251.87 Paris, France, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-39-251-87.deploy.static.akamaitechnologies.com

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://boterosalas.github.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:08:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-officeversion: 16.0.16626.30551
x-powered-by: ASP.NET
x-officefe: OdcFE_IN_49
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
content-length: 1464
last-modified: Mon, 26 Jun 2023 13:24:12 GMT
server: Microsoft-IIS/10.0
x-usersessionid: 92c8d653-2ecb-4a6d-9cba-c7ad7ad18701
x-correlationid: 92c8d653-2ecb-4a6d-9cba-c7ad7ad18701
x-officecluster: frc-000.odc.officeapps.live.com
etag: "0e6e57e31a8d91:0"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private, max-age=870732
accept-ranges: bytes

GET
H2 200 Background-blurryGradient.svg
odc.officeapps.live.com/odc/stat/images/hrd/ 2 KB
3 KB 195ms
38ms Image
image/svg+xml 52.109.4.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://odc.officeapps.live.com/odc/stat/images/hrd/Background-blurryGradient.svg

Requested by

Host: boterosalas.github.io
URL: https://boterosalas.github.io/diego/style.css

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.109.4.19 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

16c60cd6aff6a6febabbc48e9b7692a9c3b369d12d31749f8117d6d0851d5296

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://boterosalas.github.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:08:16 GMT
x-content-type-options: nosniff
x-officeversion: 16.0.16811.30554
x-powered-by: ASP.NET
x-officefe: OdcFE_IN_68
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
content-length: 2267
last-modified: Fri, 11 Aug 2023 17:23:12 GMT
server: Microsoft-IIS/10.0
x-usersessionid: 584ae678-6332-42cd-92fc-eb2846372450
x-correlationid: 584ae678-6332-42cd-92fc-eb2846372450
x-officecluster: eus2-000.odc.officeapps.live.com
etag: "0c0348178ccd91:0"
content-type: image/svg+xml
cache-control: private, max-age=2678400
accept-ranges: bytes

GET
H2 200 LucidaGrande.ttf
boterosalas.github.io/diego/lucida-grande/ 250 KB
139 KB 64ms
64ms Font
font/ttf 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://boterosalas.github.io/diego/lucida-grande/LucidaGrande.ttf

Requested by

Host: boterosalas.github.io
URL: https://boterosalas.github.io/diego/style.css

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

ee962f0062412bae8c358a598c18ea4aa8851595600ca5735500c2ecc7309db5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Referer: https://boterosalas.github.io/diego/style.css
Origin: https://boterosalas.github.io
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-fastly-request-id: fc4d819a6989876f3196d5ce384e76569a256184
strict-transport-security: max-age=31556952
content-encoding: gzip
via: 1.1 varnish
date: Thu, 24 Aug 2023 00:08:16 GMT
age: 0
x-cache: MISS
x-cache-hits: 0
x-proxy-cache: MISS
content-length: 142488
x-served-by: cache-nyc-kteb1890052-NYC
last-modified: Tue, 18 May 2021 21:21:18 GMT
server: GitHub.com
x-github-request-id: B732:7B6E:366DA6:4DCE26:64E69F6B
x-timer: S1692835697.872912,VS0,VE33
etag: W/"60a42fce-3e964"
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Thu, 24 Aug 2023 00:18:16 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556952

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

boterosalas.github.io
cdn.odc.officeapps.live.com
odc.officeapps.live.com
23.39.251.87
2606:50c0:8003::153
52.109.4.19
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c60cd6aff6a6febabbc48e9b7692a9c3b369d12d31749f8117d6d0851d5296
841215eae7d0170bfc21883283be68ea0faa2b79ca65f1d9abd124a1a55ad4ea
de1d566b1dadffb7ff4888df89e9696e8dffd620bc5d081c5f84780dcfba0d52
ee962f0062412bae8c358a598c18ea4aa8851595600ca5735500c2ecc7309db5

boterosalas.github.io Open in urlscan Pro 2606:50c0:8003::153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

146 kBTransfer

261 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

boterosalas.github.io Open in urlscan Pro
2606:50c0:8003::153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

146 kB
Transfer

261 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!