www.xn--80adjmiclob4agh7n.xn--p1ai Open in urlscan Pro Puny
www.твоякосметика.рф IDN
178.170.244.69  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request ClientSharepointdocuments.pdf.htm Show response www.xn--80adjmiclob4agh7n.xn--p1ai/Sharepoint/	13 KB 13 KB	253ms 97ms	Document text/html	178.170.244.69 REDDOCK
General Check archive.org Show headers Download Go to Full URL https://www.xn--80adjmiclob4agh7n.xn--p1ai/Sharepoint/ClientSharepointdocuments.pdf.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.170.244.69 , Russian Federation, ASN206812 (REDDOCK, RU), Reverse DNS bxhost011.rdock.ru Software nginx / Resource Hash 5175b8cf64baa7b28d3c1a7d665d88cf2b35b93c12262d0930d939c67ad4d050 Security Headers Name Value Strict-Transport-Security max-age=31536000; Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers content-type text/html date Wed, 26 Jun 2024 04:40:16 GMT server nginx strict-transport-security max-age=31536000;
GET DATA	200 OK	truncated /	1023 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 634990d96028ad5f0417e406482eec1c5325cf0dcb738601514a929b1807b70d Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 60a046fd6f8c4d5097f12dd4effd486bcf95a6118cbb03bfc174139ecb710f36 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| cc function| cd function| step1 function| step2 function| se function| validate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.xn--80adjmiclob4agh7n.xn--p1ai
178.170.244.69
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
5175b8cf64baa7b28d3c1a7d665d88cf2b35b93c12262d0930d939c67ad4d050
60a046fd6f8c4d5097f12dd4effd486bcf95a6118cbb03bfc174139ecb710f36
634990d96028ad5f0417e406482eec1c5325cf0dcb738601514a929b1807b70d