santehraboti.by Open in urlscan Pro
91.227.16.21 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php
Effective URL:
https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0...
Submission: On October 06 via automatic, source phishtank (October 6th 2022, 1:14:55 pm UTC) — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 21 HTTP transactions. The main IP is 91.227.16.21, located in Russian Federation and belongs to EXIMIUS-AS, RU. The main domain is santehraboti.by.
TLS certificate: Issued by R3 on September 25th 2022. Valid for: 3 months.

This is the only time santehraboti.by was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
14	91.227.16.21 91.227.16.21	207027 (EXIMIUS-AS) (EXIMIUS-AS)
7	2a02:26f0:10e... 2a02:26f0:10e:2a2::1e0f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
21	2

14 91.227.16.21 (Russian Federation)

ASN207027 (EXIMIUS-AS, RU)
PTR: srv21.host-food.ru

santehraboti.by	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:10e:2a2::1e0f (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

r4.res.office365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	santehraboti.by santehraboti.by	3 MB
7	office365.com r4.res.office365.com — Cisco Umbrella Rank: 229	705 KB
21	2

	Domain	Requested by
14	santehraboti.by	santehraboti.by
7	r4.res.office365.com	santehraboti.by
21	2

This site contains no links.

Subject Issuer	Validity	Valid
santehraboti.by R3	`2022-09-25` - `2022-12-24`	3 months	crt.sh
*.res.outlook.com Microsoft RSA TLS CA 01	`2022-06-02` - `2023-06-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
Frame ID: A81425E4C6AB585E84DD81F9C6BB27C0
Requests: 6 HTTP requests in this frame

Frame: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
Frame ID: F42BA28C0F12AA7EE59A81811C5DB7E7
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php Page URL
https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessi... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

21
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

3656 kB
Transfer

6057 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php Page URL
https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 index.php
santehraboti.by/wp-includes/fileoffice/officework/officework/ 254 B
547 B 172ms
73ms Document
text/html 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 / PHP/7.4.29

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 06 Oct 2022 13:14:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx/1.14.1
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-power-supply-by: 220 Volt
x-powered-by: PHP/7.4.29

GET
H2 200 Primary Request Login.php Show response
santehraboti.by/wp-includes/fileoffice/officework/officework/ 22 KB
5 KB 74ms
74ms Document
text/html 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 / PHP/7.4.29

Resource Hash

93d993d8e9407ff5b58ff00e23a1dd320170ce8d20887a1a3521ed7f8344b86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/index.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 06 Oct 2022 13:14:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx/1.14.1
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-power-supply-by: 220 Volt
x-powered-by: PHP/7.4.29

GET
H2 200 Converged_v21033.css
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/ 93 KB
18 KB 96ms
95ms Stylesheet
text/css 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/Converged_v21033.css

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

5d7ad9574510b3fc15e6fb9f67adad79d5c61a267ed642906960b1015fdc3854

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
content-encoding: gzip
last-modified: Tue, 28 Sep 2021 21:58:18 GMT
server: nginx/1.14.1
etag: W/"61538ffa-17512"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 microsoft_logo.svg
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/ 4 KB
4 KB 96ms
96ms Image
image/svg+xml 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/microsoft_logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:18 GMT
server: nginx/1.14.1
etag: "61538ffa-e43"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3651

GET
H2 200 prefetch.htm Show response
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/ Frame F42B 3 KB
1 KB 81ms
81ms Document
text/html 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

ecd065cc4f0704cc5321b78c868d0e31c1bbd4acd75f73d05e580feba221e627

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Thu, 06 Oct 2022 13:14:49 GMT
server: nginx/1.14.1
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-power-supply-by: 220 Volt

GET
H2 200 bg-small.jpg
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/ 3 KB
3 KB 48ms
47ms Image
image/jpeg 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/bg-small.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:18 GMT
server: nginx/1.14.1
etag: "61538ffa-bbe"
content-type: image/jpeg
accept-ranges: bytes
content-length: 3006

GET
H2 200 bg-large.jpg
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/ 277 KB
277 KB 48ms
48ms Image
image/jpeg 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/bg-large.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/Login.php?sslchannel=true&sessionid=f4dTC930tB5Ckn0ZIJV0jhlSM1MfJxWhAqdyg93TvSZJJSPfHnzWPsaNMVAJ1BxXyJGiTcfdaUnRSyQxxo10qFKPaBLJNO726XhCcpfqJ0iuTnh29QGA8H1pkXPk1YIOf8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:18 GMT
server: nginx/1.14.1
etag: "61538ffa-452d7"
content-type: image/jpeg
accept-ranges: bytes
content-length: 283351

GET
H2 200 boot.js
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 647 KB
648 KB 125ms
124ms Stylesheet
application/javascript 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/boot.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

c571376e8413c323196422ae495ca0ba01283a6906099a9a62cbde10d08e4ea8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:20 GMT
server: nginx/1.14.1
etag: "61538ffc-a1af7"
content-type: application/javascript
accept-ranges: bytes
content-length: 662263

GET
H2 200 boot_002.js
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 642 KB
643 KB 125ms
124ms Stylesheet
application/javascript 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/boot_002.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

bd14b7e95165f5346dd070d1ed77a4f433af14ae928220a5b7fdcf052f46770d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:22 GMT
server: nginx/1.14.1
etag: "61538ffe-a09ee"
content-type: application/javascript
accept-ranges: bytes
content-length: 657902

GET
H2 200 boot_003.js
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 645 KB
646 KB 125ms
124ms Stylesheet
application/javascript 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/boot_003.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

7fdedf3ae7b611434adad2aaf1a9e79c88c5e459c3787aaa20f878ba9a362ab8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:22 GMT
server: nginx/1.14.1
etag: "61538ffe-a13cb"
content-type: application/javascript
accept-ranges: bytes
content-length: 660427

GET
H2 200 boot_004.js
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 642 KB
643 KB 126ms
125ms Stylesheet
application/javascript 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/boot_004.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

35f0d5b26b7aef858ffa24fd0cffc0df1a2a712c29b03cc95480fcb0c37665c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:20 GMT
server: nginx/1.14.1
etag: "61538ffc-a09bf"
content-type: application/javascript
accept-ranges: bytes
content-length: 657855

GET
H2 200 sprite1.png
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 16 KB
16 KB 126ms
125ms Stylesheet
image/png 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/sprite1.png

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 28 Sep 2021 21:58:22 GMT
server: nginx/1.14.1
etag: "61538ffe-4118"
content-type: image/png
accept-ranges: bytes
content-length: 16664

GET
H2 200 sprite1.css
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 7 KB
1 KB 126ms
125ms Stylesheet
text/css 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/sprite1.css

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

461f87e55bba34c4d9248d1b45685ea832eba56c15ebf6cccf75d49f1547b502

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
content-encoding: gzip
last-modified: Tue, 28 Sep 2021 21:58:20 GMT
server: nginx/1.14.1
etag: W/"61538ffc-1db4"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 boot.css
santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/ Frame F42B 227 KB
45 KB 126ms
126ms Stylesheet
text/css 91.227.16.21
EXIMIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch_data/boot.css

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.227.16.21 , Russian Federation, ASN207027 (EXIMIUS-AS, RU),

Reverse DNS

srv21.host-food.ru

Software

nginx/1.14.1 /

Resource Hash

cd2ddb8b2f8ab2461222b1cb56431e615cdcf0d1f8491c31a4291a38d41f1229

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:49 GMT
strict-transport-security: max-age=31536000;
content-encoding: gzip
last-modified: Tue, 28 Sep 2021 21:58:22 GMT
server: nginx/1.14.1
etag: W/"61538ffe-38be1"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 boot.worldwide.0.mouse.js
r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/ Frame F42B 647 KB
176 KB 164ms
31ms Stylesheet
application/x-javascript 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/boot.worldwide.0.mouse.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

c571376e8413c323196422ae495ca0ba01283a6906099a9a62cbde10d08e4ea8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:30:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 boot.worldwide.1.mouse.js
r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/ Frame F42B 642 KB
159 KB 21ms
20ms Stylesheet
application/x-javascript 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/boot.worldwide.1.mouse.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

bd14b7e95165f5346dd070d1ed77a4f433af14ae928220a5b7fdcf052f46770d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:30:54 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 162380

GET
H2 200 boot.worldwide.2.mouse.js
r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/ Frame F42B 645 KB
166 KB 21ms
21ms Stylesheet
application/x-javascript 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/boot.worldwide.2.mouse.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

7fdedf3ae7b611434adad2aaf1a9e79c88c5e459c3787aaa20f878ba9a362ab8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:30:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 169418

GET
H2 200 boot.worldwide.3.mouse.js
r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/ Frame F42B 642 KB
142 KB 43ms
43ms Stylesheet
application/x-javascript 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/scripts/boot.worldwide.3.mouse.js

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

35f0d5b26b7aef858ffa24fd0cffc0df1a2a712c29b03cc95480fcb0c37665c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:30:55 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 145064

GET
H2 200 sprite1.mouse.png
r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/images/0/ Frame F42B 16 KB
17 KB 19ms
18ms Stylesheet
image/png 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/images/0/sprite1.mouse.png

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:21:16 GMT
server: AkamaiNetStorage
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 16664

GET
H2 200 sprite1.mouse.css
r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/images/0/ Frame F42B 7 KB
1 KB 26ms
25ms Stylesheet
text/css 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/images/0/sprite1.mouse.css

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

461f87e55bba34c4d9248d1b45685ea832eba56c15ebf6cccf75d49f1547b502

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:26:18 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 1124

GET
H2 200 boot.worldwide.mouse.css
r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/styles/0/ Frame F42B 227 KB
44 KB 23ms
23ms Stylesheet
text/css 2a02:26f0:10e:2a2::1e0f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://r4.res.office365.com/owa/prem/16.2500.10.2596764/resources/styles/0/boot.worldwide.mouse.css

Requested by

Host: santehraboti.by
URL: https://santehraboti.by/wp-includes/fileoffice/officework/officework/assets/files/prefetch.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:10e:2a2::1e0f Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

cd2ddb8b2f8ab2461222b1cb56431e615cdcf0d1f8491c31a4291a38d41f1229

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://santehraboti.by/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 13:14:50 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 16 Aug 2018 03:28:24 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-age=630720000, s-maxage=630720000
accept-ranges: bytes
timing-allow-origin: *
content-length: 44251

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			santehraboti.by/	1969-12-31 23:59:59	Name: PHPSESSID Value: a239b8ce6bc03e294dc6f623f12de1ea
			santehraboti.by/	1969-12-31 23:59:59	Name: OWAPF Value: p:undefined11111111&

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

r4.res.office365.com
santehraboti.by
2a02:26f0:10e:2a2::1e0f
91.227.16.21
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
35f0d5b26b7aef858ffa24fd0cffc0df1a2a712c29b03cc95480fcb0c37665c9
461f87e55bba34c4d9248d1b45685ea832eba56c15ebf6cccf75d49f1547b502
5d7ad9574510b3fc15e6fb9f67adad79d5c61a267ed642906960b1015fdc3854
7fdedf3ae7b611434adad2aaf1a9e79c88c5e459c3787aaa20f878ba9a362ab8
93d993d8e9407ff5b58ff00e23a1dd320170ce8d20887a1a3521ed7f8344b86a
99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194
bd14b7e95165f5346dd070d1ed77a4f433af14ae928220a5b7fdcf052f46770d
c571376e8413c323196422ae495ca0ba01283a6906099a9a62cbde10d08e4ea8
cd2ddb8b2f8ab2461222b1cb56431e615cdcf0d1f8491c31a4291a38d41f1229
ecd065cc4f0704cc5321b78c868d0e31c1bbd4acd75f73d05e580feba221e627
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

santehraboti.by Open in urlscan Pro 91.227.16.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

3656 kBTransfer

6057 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

santehraboti.by Open in urlscan Pro
91.227.16.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

3656 kB
Transfer

6057 kB
Size

2
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!