cloud.cdi.to Open in urlscan Pro
51.89.229.246  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ba9e051fd937_demosss.html Show response cloud.cdi.to/uploaded/	687 B 889 B	87ms 25ms	Document text/html	51.89.229.246 OVH
General Check archive.org Show headers Download Go to Full URL https://cloud.cdi.to/uploaded/ba9e051fd937_demosss.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 51.89.229.246 London, United Kingdom, ASN16276 (OVH, FR), Reverse DNS Software nginx / Resource Hash 3c755253551398d66d1912db324e5f9cad87aa8310471928132806a99dc8a1c3 Security Headers Name Value Strict-Transport-Security max-age=2592000; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control max-age=315360000 Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 06 Jun 2023 03:37:31 GMT ETag W/"647e2491-2af" Expires Thu, 31 Dec 2037 23:55:55 GMT Last-Modified Mon, 05 Jun 2023 18:08:17 GMT Referrer-Policy same-origin Server nginx Strict-Transport-Security max-age=2592000; preload Transfer-Encoding chunked X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block
GET H2	200	content.php Show response qserver.one/	715 KB 498 KB	677ms 331ms	Script text/javascript	192.64.117.158 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://qserver.one/content.php?users=Wilmenwg Requested by Host: cloud.cdi.to URL: https://cloud.cdi.to/uploaded/ba9e051fd937_demosss.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.64.117.158 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS business124-5.web-hosting.com Software LiteSpeed / PHP/7.2.34 Resource Hash 6288bbf751fdb70d52909673f772a98b6cf59ccfc4517a8161dd6ba20e23e191 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Tue, 06 Jun 2023 03:37:31 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload; server LiteSpeed referrer-policy no-referrer-when-downgrade x-powered-by PHP/7.2.34 vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript;charset=UTF-8 x-turbo-charged-by LiteSpeed x-xss-protection 1; mode=block
GET H2	404	eldemo whos.amung.us/widget/	0 0	263ms 205ms	Image text/html	2606:4700:10::6816:4aab CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/widget/eldemo Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers
GET H2	200	/ whos.amung.us/pingjs/	25 B 25 B	267ms 209ms	Image text/javascript	2606:4700:10::6816:4aab CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=eldemo&t=MONIE&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=7232 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4aab , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Tue, 06 Jun 2023 03:37:32 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare cf-ray 7d2d9e0b4ecf4191-LHR content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	51 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://whos.amung.us/widget/eldemo Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=2592000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.cdi.to
qserver.one
whos.amung.us
192.64.117.158
2606:4700:10::6816:4aab
51.89.229.246
3c755253551398d66d1912db324e5f9cad87aa8310471928132806a99dc8a1c3
6288bbf751fdb70d52909673f772a98b6cf59ccfc4517a8161dd6ba20e23e191
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855