gshjdj.cf Open in urlscan Pro
142.11.226.175  Malicious Activity! Public Scan

6 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response gshjdj.cf/dfd/A/	126 KB 39 KB	511ms 243ms	Document text/html	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 1d4c15f3c21111725a75f8b3984868f03cc91d6ffd0d39f16a6e18d1fde6dcc4 Request headers :method GET :authority gshjdj.cf :scheme https :path /dfd/A/index.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding date Fri, 21 Jun 2019 06:05:38 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	boot.js Show response gshjdj.cf/dfd/A/index_files/	7 KB 4 KB	122ms 122ms	Script application/javascript	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/boot.js Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 5108703ee487d641d773753d8ca94669f718c08a88a22206f6fa5a545c7ac80f Request headers Referer https://gshjdj.cf/dfd/A/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT content-encoding br last-modified Fri, 24 May 2019 00:48:34 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 3480 expires Fri, 28 Jun 2019 06:05:39 GMT
GET H2	200	g-r-min.js Show response gshjdj.cf/dfd/A/index_files/	205 KB 83 KB	123ms 122ms	Script application/javascript	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/g-r-min.js Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 760d156341359ebe1bcb20bb535b52e9827c016954053b15bcefecd8bcebcbfa Request headers Referer https://gshjdj.cf/dfd/A/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT content-encoding br last-modified Fri, 24 May 2019 00:48:34 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 85221 expires Fri, 28 Jun 2019 06:05:39 GMT
GET H2	200	aol-logo-black-v.png gshjdj.cf/dfd/A/index_files/	16 KB 16 KB	243ms 243ms	Image image/png	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Show image Full URL https://gshjdj.cf/dfd/A/index_files/aol-logo-black-v.png Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690 Request headers Referer https://gshjdj.cf/dfd/A/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT last-modified Fri, 24 May 2019 00:48:34 GMT server LiteSpeed content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 16340 expires Fri, 28 Jun 2019 06:05:39 GMT
GET H2	200	client.php Show response gshjdj.cf/dfd/A/index_files/	14 KB 8 KB	138ms 136ms	Script text/html	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/client.php Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 9b845780113584b06ce87e42a8066ccad4c2fa7461473fc95a5efe40003f894d Request headers Referer https://gshjdj.cf/dfd/A/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Fri, 21 Jun 2019 06:05:39 GMT content-encoding br server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44" vary Accept-Encoding content-type text/html; charset=UTF-8
GET		g-r-min.js l.yimg.com/rq/darla/3-11-2/js/	0 0
GET H2	200	r-sf.htm Show response gshjdj.cf/dfd/A/index_files/ Frame 2E7D	4 KB 1 KB	121ms 121ms	Document text/html	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/r-sf.htm Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 77157d4617552f31fbdf8660075975ea439cddf7c179f397632316f7252396f1 Request headers :method GET :authority gshjdj.cf :scheme https :path /dfd/A/index_files/r-sf.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 referer https://gshjdj.cf/dfd/A/index.php accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://gshjdj.cf/dfd/A/index.php Response headers status 200 last-modified Fri, 24 May 2019 00:48:34 GMT content-type text/html content-length 1255 accept-ranges bytes content-encoding br vary Accept-Encoding date Fri, 21 Jun 2019 06:05:39 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET DATA	200 OK	truncated /	181 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3439c6811bb7e4afdef051434b36bf650eb42915ca52df41624f598cd3dbb3c7 Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	478 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a8f5c5ea6f77446204eaceba741604eb56ea17fe0282ba98fa4d97673e2b1de7 Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 94ce309471555238fde53af4bd8b3a23f4402ebed4b975e0788b565126b156af Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	782 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cb07120b6de3fef86b33ef7acdef185f558485c5da3a317c945393cce3689cb0 Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	boot.js Show response s.yimg.com/rq/darla/	7 KB 4 KB	103ms 27ms	Script application/javascript	2a00:1288:7c:800::4001 YAHOO-ULS
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/boot.js Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index_files/client.php Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:7c:800::4001 , United Kingdom, ASN43428 (YAHOO-ULS, GB), Reverse DNS Software ATS / Resource Hash ba5948fddde509e03b04c5c6a9efe60019518f6ff9dc5785c29e74f1dbf14df8 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers ats-carp-promotion 1 date Fri, 21 Jun 2019 02:42:39 GMT content-encoding gzip x-content-type-options nosniff age 12181 x-amz-server-side-encryption AES256 status 200 strict-transport-security max-age=15552000 content-length 3609 x-amz-id-2 cs+1kaMYmgzQWDP5a6QBmYigF/OzxHmtxbfVeUL354+JSaKnwpUucZTT5bxDKrWR/n7CH0HsWK4= referrer-policy no-referrer-when-downgrade last-modified Tue, 18 Jun 2019 17:42:55 GMT server ATS etag "ba64d4936b90e9e230b62b2baae205d8-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Accept-Encoding x-amz-request-id 4542D4E38BEEE38A x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	r-csc.htm Show response gshjdj.cf/dfd/A/index_files/ Frame CF63	2 KB 1 KB	124ms 121ms	Document text/html	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/r-csc.htm Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash c6cb6d2fe53d0e75362dce9556cc5d311ac4c46dc15f1a29c36ff1742ce7fa2c Request headers :method GET :authority gshjdj.cf :scheme https :path /dfd/A/index_files/r-csc.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 referer https://gshjdj.cf/dfd/A/index.php accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://gshjdj.cf/dfd/A/index.php Response headers status 200 last-modified Fri, 24 May 2019 00:48:34 GMT content-type text/html content-length 1059 accept-ranges bytes content-encoding br vary Accept-Encoding date Fri, 21 Jun 2019 06:05:39 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	client.php Show response fc.yahoo.com/sdarla/php/	10 KB 6 KB	253ms 196ms	Script text/javascript	2a00:1288:84:800::1002 YAHOO-AMA
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200033&ref=https%3A%2F%2Flogin.aol.com%2F%3Fsrc%3Dfp-us%26redirect_uri%3Dhttps%253A%252F%252Fwww.aol.com%252Fcallback%26intl%3Dus%26client_id%3Ddj0yJmk9N3dWZW1TTWNhY0o0JmQ9WVdrOWMxbDVlVEo2TmpRbWNHbzlNQS0tJnM9Y29uc3VtZXJzZWNyZXQmeD1lMA--%26lang%3Den-us Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:84:800::1002 , United Kingdom, ASN203219 (YAHOO-AMA, NL), Reverse DNS Software ATS / Resource Hash f4ab5a7e806d20d154169929088b4ba6d7ac2c073b6699d51877498f82fe9333 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT content-encoding gzip x-content-type-options nosniff age 0 x-dns-prefetch-control off p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 200 strict-transport-security max-age=15552000 content-length 5352 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding content-type text/javascript;charset=UTF-8 cache-control private,no-cache,no-store x-robots-tag noindex, noarchive, nosnippet, nofollow
GET H2	200	fdb1.gif s.yimg.com/rq/darla/i/	1 KB 2 KB	747ms 675ms	Image image/gif	2a00:1288:7c:800::4001 YAHOO-ULS
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/rq/darla/i/fdb1.gif Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index.php Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:7c:800::4001 , United Kingdom, ASN43428 (YAHOO-ULS, GB), Reverse DNS Software ATS / Resource Hash ba2d3c58ace4879814bc755ef5bfa3506672b7ce1c5dfa5c9a7efc301b21f36b Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://gshjdj.cf/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:41 GMT x-content-type-options nosniff age 1 x-amz-server-side-encryption AES256 status 200 strict-transport-security max-age=15552000 content-length 1407 x-amz-id-2 2i+HRaFUNCa1zlwOzUkR4Lg44bWmStvO2tITUD6wWaSARxSKSisd2pEMUVUQp3yIS61jWVR42TU= referrer-policy no-referrer-when-downgrade last-modified Tue, 12 Jun 2018 06:38:42 GMT server ATS etag "73c99944b40daf4ff518cbf59f9af1de" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin x-amz-request-id B166DDD806A9EFFD x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes content-type image/gif
GET H2	200	sfext-min.js Show response gshjdj.cf/dfd/A/index_files/r-sf_data/ Frame 2E7D	63 KB 26 KB	121ms 121ms	Script application/javascript	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL https://gshjdj.cf/dfd/A/index_files/r-sf_data/sfext-min.js Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index_files/r-sf.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash f3ec09f530d809b06029982fa87662105d6b49760cf4990e54b585fc02b7f37c Request headers Referer https://gshjdj.cf/dfd/A/index_files/r-sf.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT content-encoding br last-modified Fri, 24 May 2019 00:48:34 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 26740 expires Fri, 28 Jun 2019 06:05:39 GMT
GET H2	200	ATCollapse.gif gshjdj.cf/dfd/A/index_files/r-sf_data/ Frame 2E7D	43 B 91 B	122ms 121ms	Image image/gif	142.11.226.175 Hostwinds LLC.
General Check archive.org Show headers Download Go to Show image Full URL https://gshjdj.cf/dfd/A/index_files/r-sf_data/ATCollapse.gif Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index_files/r-sf.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.11.226.175 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS client-142-11-226-175.hostwindsdns.com Software LiteSpeed / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Referer https://gshjdj.cf/dfd/A/index_files/r-sf.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT last-modified Fri, 24 May 2019 00:48:34 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 43 expires Fri, 28 Jun 2019 06:05:39 GMT
GET H2	200	ATCollapse.gif aka-cdn.adtechus.com/images/ Frame 2E7D	43 B 194 B	27ms 6ms	Image image/gif	2606:2800:234:13d4:25ff:664:671:13a5 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://aka-cdn.adtechus.com/images/ATCollapse.gif Requested by Host: gshjdj.cf URL: https://gshjdj.cf/dfd/A/index_files/r-sf.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:13d4:25ff:664:671:13a5 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECS (fcn/40F7) / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Referer https://gshjdj.cf/dfd/A/index_files/r-sf.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 21 Jun 2019 06:05:39 GMT last-modified Thu, 20 Jun 2019 06:54:15 GMT server ECS (fcn/40F7) x-cache HIT content-type image/gif status 200 cache-control max-age=608400 accept-ranges bytes content-length 43 expires Fri, 28 Jun 2019 07:05:39 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

l.yimg.com

URL

http://l.yimg.com/rq/darla/3-11-2/js/g-r-min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask number| pageStartTime object| DARLA object| $sf undefined| $yac boolean| sf_auto_5-21-5-2019 undefined| Y object| _Y object| I13N_config object| COUNTRY_CODES_MAP object| mbrConfig object| darlaConfig string| bucket string| currentURL boolean| isASDK undefined| comscoreBeaconUrl object| DARLA_CONFIG

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://gshjdj.cf/dfd/A/index_files/r-csc.htm(Line 21) Message: darla csc writer, invalid host (1)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aka-cdn.adtechus.com
fc.yahoo.com
gshjdj.cf
l.yimg.com
s.yimg.com
l.yimg.com
142.11.226.175
2606:2800:234:13d4:25ff:664:671:13a5
2a00:1288:7c:800::4001
2a00:1288:84:800::1002
1d4c15f3c21111725a75f8b3984868f03cc91d6ffd0d39f16a6e18d1fde6dcc4
3439c6811bb7e4afdef051434b36bf650eb42915ca52df41624f598cd3dbb3c7
5108703ee487d641d773753d8ca94669f718c08a88a22206f6fa5a545c7ac80f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
760d156341359ebe1bcb20bb535b52e9827c016954053b15bcefecd8bcebcbfa
77157d4617552f31fbdf8660075975ea439cddf7c179f397632316f7252396f1
94ce309471555238fde53af4bd8b3a23f4402ebed4b975e0788b565126b156af
9b845780113584b06ce87e42a8066ccad4c2fa7461473fc95a5efe40003f894d
a8f5c5ea6f77446204eaceba741604eb56ea17fe0282ba98fa4d97673e2b1de7
ba2d3c58ace4879814bc755ef5bfa3506672b7ce1c5dfa5c9a7efc301b21f36b
ba5948fddde509e03b04c5c6a9efe60019518f6ff9dc5785c29e74f1dbf14df8
c6cb6d2fe53d0e75362dce9556cc5d311ac4c46dc15f1a29c36ff1742ce7fa2c
cb07120b6de3fef86b33ef7acdef185f558485c5da3a317c945393cce3689cb0
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690
f3ec09f530d809b06029982fa87662105d6b49760cf4990e54b585fc02b7f37c
f4ab5a7e806d20d154169929088b4ba6d7ac2c073b6699d51877498f82fe9333