u1033915nvh.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::23  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/ptwGo0V3SO?amp=1 Page URL
2. http://gymfoodnutrition.in/fonts/-/front/-/1/ Page URL
3. http://u1033915nvh.ha004.t.justns.ru/polpol/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	ptwGo0V3SO Show response t.co/	334 B 575 B	216ms 150ms	Document text/html	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/ptwGo0V3SO?amp=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 9649aa3396c10ad963d6cb71757d5fe626509679ef8f0bfe710ca765fefda93c Security Headers Name Value Content-Security-Policy referrer always; Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /ptwGo0V3SO?amp=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control private,max-age=300 content-encoding gzip content-length 214 content-security-policy referrer always; content-type text/html; charset=utf-8 date Sun, 28 Feb 2021 03:41:41 GMT expires Sun, 28 Feb 2021 03:46:40 GMT referrer-policy unsafe-url server tsa_o set-cookie muc=fb92ea68-67ac-432a-9b18-0f94bb200e40; Max-Age=63072000; Expires=Tue, 28 Feb 2023 03:41:40 GMT; Domain=t.co; Secure; SameSite=None strict-transport-security max-age=0 vary Origin x-connection-hash 980d680e5062ec96bb6d332ea31ade17 x-response-time 118 x-xss-protection 0
GET H/1.1	200 OK	/ Show response gymfoodnutrition.in/fonts/-/front/-/1/	89 B 464 B	521ms 320ms	Document text/html	103.133.215.33 EWEBGURU-AS EWEBGURU
General Check archive.org Show headers Download Go to Full URL http://gymfoodnutrition.in/fonts/-/front/-/1/ Requested by Host: t.co URL: https://t.co/ptwGo0V3SO?amp=1 Protocol HTTP/1.1 Server 103.133.215.33 , India, ASN133643 (EWEBGURU-AS EWEBGURU, IN), Reverse DNS Software Apache/2 / Resource Hash bd36495676c536e17ea406c7e48c13a5fa2f8cb056e4f4bba1aeb997b155802e Request headers Host gymfoodnutrition.in Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer https://t.co/ptwGo0V3SO?amp=1 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://t.co/ptwGo0V3SO?amp=1 Response headers Date Sun, 28 Feb 2021 03:41:41 GMT Server Apache/2 Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Sun, 28 Feb 2021 03:17:21 GMT ETag "59-5bc5cf0789240-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 105 Keep-Alive timeout=2, max=100 Content-Type text/html
GET H/1.1	200 OK	Primary Request / Show response u1033915nvh.ha004.t.justns.ru/polpol/	8 KB 4 KB	172ms 41ms	Document text/html	2a00:b700::23 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u1033915nvh.ha004.t.justns.ru/polpol/ Protocol HTTP/1.1 Server 2a00:b700::23 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash 6bdfc5e8aca91bb197bfa82ffd924487232bc4d70e54b6c80a13d4401ac63aa0 Request headers Host u1033915nvh.ha004.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://gymfoodnutrition.in/fonts/-/front/-/1/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://gymfoodnutrition.in/fonts/-/front/-/1/ Response headers Connection Keep-Alive Content-Type text/html Last-Modified Fri, 12 Feb 2021 00:21:28 GMT Etag "1fbc-6025ca08-b2c7b3ff8f29f110;gz" Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding,User-Agent Content-Length 3538 Date Sun, 28 Feb 2021 03:41:41 GMT Server LiteSpeed
GET H2	200	app.css www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/css/	45 KB 9 KB	122ms 37ms	Stylesheet text/css	104.108.64.37 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/css/app.css Requested by Host: u1033915nvh.ha004.t.justns.ru URL: http://u1033915nvh.ha004.t.justns.ru/polpol/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.64.37 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-64-37.deploy.static.akamaitechnologies.com Software / Resource Hash 7d4386d4e203636fe5b75b7f8a11b94f2f3ddae94b92593c1d26cd66b8b90634 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://u1033915nvh.ha004.t.justns.ru/polpol/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 28 Feb 2021 03:41:41 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 92157fbbf7880 dc ccg11-origin-www-1.paypal.com vary Accept-Encoding content-length 9117 last-modified Thu, 18 May 2017 21:40:06 GMT etag W/"591e14b6-b469" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-headers x-csrf-token expires Mon, 28 Feb 2022 03:41:41 GMT
GET H2	200	modernizr-2.6.1.js Show response www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/js/lib/	4 KB 2 KB	125ms 40ms	Script application/javascript	104.108.64.37 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/js/lib/modernizr-2.6.1.js Requested by Host: u1033915nvh.ha004.t.justns.ru URL: http://u1033915nvh.ha004.t.justns.ru/polpol/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.64.37 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-64-37.deploy.static.akamaitechnologies.com Software / Resource Hash a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer http://u1033915nvh.ha004.t.justns.ru/polpol/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 28 Feb 2021 03:41:41 GMT content-encoding gzip x-content-type-options nosniff surrogate-control max-age=31536000 paypal-debug-id 1248d045dfa67 dc phx-origin-www-2.paypal.com vary Accept-Encoding content-length 1788 last-modified Thu, 18 May 2017 21:40:08 GMT etag W/"591e14b8-edf" strict-transport-security max-age=31536000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 access-control-allow-headers x-csrf-token expires Mon, 28 Feb 2022 03:41:41 GMT
GET H2	200	paypal-logo-129x32.svg www.paypalobjects.com/images/shared/	5 KB 2 KB	34ms 33ms	Image image/svg+xml	104.108.64.37 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg Requested by Host: www.paypalobjects.com URL: https://www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/css/app.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.108.64.37 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-108-64-37.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://www.paypalobjects.com/web/res/ef6/fe8b042a5ffcf562320eaa6f392a6/css/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 28 Feb 2021 03:41:41 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 24 Oct 2014 22:52:57 GMT server Apache vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=3600 strict-transport-security max-age=31536000 accept-ranges bytes content-length 1929 expires Sun, 28 Feb 2021 04:41:41 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| html5 object| Modernizr object| antiClickjack object| require object| PAYPAL

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gymfoodnutrition.in
t.co
u1033915nvh.ha004.t.justns.ru
www.paypalobjects.com
103.133.215.33
104.108.64.37
104.244.42.133
2a00:b700::23
6bdfc5e8aca91bb197bfa82ffd924487232bc4d70e54b6c80a13d4401ac63aa0
7d4386d4e203636fe5b75b7f8a11b94f2f3ddae94b92593c1d26cd66b8b90634
9649aa3396c10ad963d6cb71757d5fe626509679ef8f0bfe710ca765fefda93c
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
bd36495676c536e17ea406c7e48c13a5fa2f8cb056e4f4bba1aeb997b155802e