drittohub.com Open in urlscan Pro
2606:4700:3030::ac43:a6da  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response drittohub.com/dvd/privateinvestordeck/	22 KB 8 KB	330ms 298ms	Document text/html	2606:4700:3030::ac43:a6da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:a6da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c2e1f30695df5bf36b478304ce1aed49331c5ecfa987d4e7587a8f2ab7f9bd7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7426449f6e549199-FRA content-encoding br content-type text/html date Mon, 29 Aug 2022 15:19:58 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" last-modified Wed, 16 Mar 2022 06:38:22 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dMDrI9lluxf9f%2B8%2FY%2BoiixXkxv%2BmSAf0Jn%2Bn%2Fa62M88tiywYHJ6a5SG40dXrLKXNrMcdN0hw9fJdkyEY4hK91d4SiUaY3ARjd%2BAZfYAZbTElFtQfAmDRep0XkSKxQStDyMxkv0%2BRHSV1dAVW"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	1200px-Microsoft_logo_%282012%29.svg.png upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/	21 KB 23 KB	77ms 28ms	Image image/png	2620:0:862:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/1200px-Microsoft_logo_%282012%29.svg.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/8.0.8 / Resource Hash f2f4485ba9fceb2926c0a541344eaf5ecdba5be4dbf75f823a73036224beebfb Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 14:04:53 GMT nel { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0} age 4505 x-cache-status hit-front x-cache cp3053 miss, cp3051 hit/5 content-disposition inline;filename*=UTF-8''Microsoft_logo_%282012%29.svg.png server-timing cache;desc="hit-front", host;desc="cp3051" content-length 21995 x-client-ip 2a03:1b20:6:f011::2e accept-ranges bytes last-modified Sun, 08 May 2022 19:56:59 GMT server ATS/8.0.8 etag dd522f10e0735d7995b8d63f3cba2945 strict-transport-security max-age=106384710; includeSubDomains; preload report-to { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } content-type image/png access-control-allow-origin * access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache permissions-policy interest-cohort=(),ch-ua-arch=(self "intake-analytics.wikimedia.org"),ch-ua-bitness=(self "intake-analytics.wikimedia.org"),ch-ua-full-version-list=(self "intake-analytics.wikimedia.org"),ch-ua-model=(self "intake-analytics.wikimedia.org"),ch-ua-platform-version=(self "intake-analytics.wikimedia.org") accept-ch Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version timing-allow-origin *
GET H2	200	folder.png spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/	444 B 967 B	71ms 20ms	Image image/png	23.6.113.24 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/folder.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 23.6.113.24 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-6-113-24.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 29 Aug 2022 15:19:59 GMT content-md5 RLL5gHuYw8pCjo0/TAtEsg== alt-svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" content-length 444 x-ms-lease-status unlocked last-modified Fri, 15 Jan 2021 19:39:57 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D8B98D570EBC35 content-type image/png access-control-allow-origin * x-ms-request-id 226f83ce-101e-0040-4312-718115000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 timing-allow-origin *
GET H2	404	microsoft-logo.png drittohub.com/_layouts/15/images/	315 B 315 B	295ms 294ms	Image text/html	2606:4700:3030::ac43:a6da CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://drittohub.com/_layouts/15/images/microsoft-logo.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:a6da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/dvd/privateinvestordeck/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 15:19:59 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aTc1I35LoVO56PvLOcpOVu31SmjZFdlvy261gvn5rxCIpRu53%2FCX4S13hqJqOEI2kEaiWL5pYvviA84RS0vV9jyqV%2BauwomE7aNqqkx8CSwvXKO146%2Baz7c3fo1JBA1SMbe%2FX5%2Bv4YcJR4fG"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 742644a22a779199-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	email-decode.min.js Show response drittohub.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	10ms 9ms	Script application/javascript	2606:4700:3030::ac43:a6da CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://drittohub.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:a6da , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/dvd/privateinvestordeck/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 15:19:59 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 23 Aug 2022 11:02:51 GMT server cloudflare etag W/"6304b3db-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options DENY report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=542XL8ms%2FA%2B1cLzMnxl1S6u%2F%2By%2BTe7dAgLAjAbJls0BYymDiRyFAzbfm%2B6qMVq%2FDm1CCs6asZTCVeDktSgHj9UDtM8%2F4hLS%2F5X1HFC0QZqxBiJJP6s5sSgp5%2BqA%2FO2xelikTgysPBNjskg2b"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 742644a22a769199-FRA vary Accept-Encoding expires Wed, 31 Aug 2022 15:19:59 GMT
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	60ms 18ms	Script application/javascript	2001:4de0:ac18::1:a:1a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 15:19:59 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-15851" vary Accept-Encoding x-hw 1661786399.dop113.am5.t,1661786399.cds209.am5.hn,1661786399.cds260.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	49ms 16ms	Script text/javascript	2a00:1450:400e:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400e:801::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Sun, 28 Aug 2022 01:39:36 GMT content-encoding gzip x-content-type-options nosniff age 135623 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30306 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 28 Aug 2023 01:39:36 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://drittohub.com/_layouts/15/images/microsoft-logo.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
drittohub.com
spoprod-a.akamaihd.net
upload.wikimedia.org
2001:4de0:ac18::1:a:1a
23.6.113.24
2606:4700:3030::ac43:a6da
2620:0:862:ed1a::2:b
2a00:1450:400e:801::200a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
5c2e1f30695df5bf36b478304ce1aed49331c5ecfa987d4e7587a8f2ab7f9bd7
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa
f2f4485ba9fceb2926c0a541344eaf5ecdba5be4dbf75f823a73036224beebfb