guyanaguardian.com Open in urlscan Pro
2606:4700:30::681f:4b3c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set Login.php Show response guyanaguardian.com/wp-content/themes/web-point/dropBox/	9 KB 3 KB	244ms 238ms	Document text/html	2606:4700:30::681f:4b3c Cloudflare
General Check archive.org Show headers Download Go to Full URL http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Server 2606:4700:30::681f:4b3c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/7.1.27 Resource Hash 8c4a54131a2acf0193ae3bb811e279e6707aa1ff3c69fbe6601e8272b7a271b9 Request headers Host guyanaguardian.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 13 Apr 2019 21:29:12 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=dda90a72e65fe6bb7cb63536ba24b72461555190952; expires=Sun, 12-Apr-20 21:29:12 GMT; path=/; domain=.guyanaguardian.com; HttpOnly PHPSESSID=caa45dc53400c75c73b9ef2d3b2f2887; path=/ X-Powered-By PHP/7.1.27 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding,User-Agent Server cloudflare CF-RAY 4c7088be0a7dc2fb-FRA Content-Encoding gzip
GET H/1.1	200 OK	converged.login.min.css guyanaguardian.com/wp-content/themes/web-point/dropBox/data_files/	84 KB 17 KB	13ms 12ms	Stylesheet text/css	2606:4700:30::681f:4b3c Cloudflare
General Check archive.org Show headers Download Go to Full URL http://guyanaguardian.com/wp-content/themes/web-point/dropBox/data_files/converged.login.min.css Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Server 2606:4700:30::681f:4b3c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f Request headers Pragma no-cache Accept-Encoding gzip, deflate Host guyanaguardian.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Cookie __cfduid=dda90a72e65fe6bb7cb63536ba24b72461555190952; PHPSESSID=caa45dc53400c75c73b9ef2d3b2f2887 Connection keep-alive Cache-Control no-cache Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 13 Apr 2019 21:29:12 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Fri, 08 Dec 2017 10:13:22 GMT Server cloudflare ETag "168322e-15199-55fd16f337480-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=86400 Connection keep-alive Accept-Ranges bytes CF-RAY 4c7088bf9eeac2fb-FRA Content-Length 16564 Expires Sun, 14 Apr 2019 21:29:12 GMT
GET H2	200	logo.png cfl.dropboxstatic.com/static/images/	5 KB 5 KB	46ms 12ms	Image image/png	2606:4700::6810:631d Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://cfl.dropboxstatic.com/static/images/logo.png Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6810:631d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 605a9cd2d96f6b1787a68041199fd9127885eb5ee658097f2491e3b3b3e9e37c Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 13 Apr 2019 21:29:12 GMT x-content-type-options nosniff cf-cache-status HIT cf-polished pngoptimizer, origSize=4994 cf-ray 4c7088bfcf469774-FRA status 200 cf-bgj imgq:100 content-length 4638 last-modified Wed, 10 Apr 2019 19:01:57 GMT server cloudflare etag "5cae3da5-1382" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control max-age=86400 x-dropbox-request-id 86cec91815b9a49e190946f910e8acbc accept-ranges bytes timing-allow-origin https://www.dropbox.com expires Sun, 14 Apr 2019 05:58:07 GMT
GET H/1.1	200 OK	picker_account_aad.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.6970.12/content/images/	756 B 866 B	53ms 8ms	Image image/svg+xml	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6970.12/content/images/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 13 Apr 2019 21:29:12 GMT Content-Encoding gzip Last-Modified Wed, 06 Dec 2017 18:07:11 GMT Content-MD5 Sm6wIsHj8wthIZkm/aQWhA== Vary Accept-Encoding Strict-Transport-Security max-age=31536000 Content-Type image/svg+xml Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=538423 Connection keep-alive Content-Length 394
GET H/1.1	404 Not Found	Prefetch.html Show response guyanaguardian.com/wp-content/themes/web-point/dropBox/data_files/ Frame A8F7	2 KB 1 KB	231ms 227ms	Document text/html	2606:4700:30::681f:4a3c Cloudflare
General Check archive.org Show headers Download Go to Full URL http://guyanaguardian.com/wp-content/themes/web-point/dropBox/data_files/Prefetch.html Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Server 2606:4700:30::681f:4a3c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed Request headers Host guyanaguardian.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Accept-Encoding gzip, deflate Cookie __cfduid=dda90a72e65fe6bb7cb63536ba24b72461555190952; PHPSESSID=caa45dc53400c75c73b9ef2d3b2f2887 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Response headers Date Sat, 13 Apr 2019 21:29:13 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding,User-Agent Server cloudflare CF-RAY 4c7088bf9e0597b6-FRA Content-Encoding gzip
GET H/1.1	200 OK	0-small.jpg secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/	1 KB 1 KB	53ms 9ms	Image image/jpeg	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 13 Apr 2019 21:29:12 GMT Last-Modified Thu, 27 Jul 2017 00:50:42 GMT Content-MD5 EvS4tUMSXMmGx5zYUyCBLw== Strict-Transport-Security max-age=31536000 Content-Type image/jpeg Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=538423 Connection keep-alive Content-Length 1029
GET H/1.1	200 OK	bg0015.jpg balanceyourledger.com/images/	141 KB 142 KB	232ms 95ms	Image image/jpeg	104.131.31.228 DigitalOcean
General Check archive.org Show headers Download Go to Show image Full URL http://balanceyourledger.com/images/bg0015.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5 Requested by Host: guyanaguardian.com URL: http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php Protocol HTTP/1.1 Server 104.131.31.228 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software Apache/2.4.18 (Ubuntu) / Resource Hash 0b891e5e3927c765f6631359309746644d608ebfc89e23125835a95b549fbfeb Request headers Referer http://guyanaguardian.com/wp-content/themes/web-point/dropBox/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 13 Apr 2019 21:29:13 GMT Last-Modified Sun, 07 Apr 2019 21:10:30 GMT Server Apache/2.4.18 (Ubuntu) ETag "235cc-585f7265d74a0" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 144844

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

balanceyourledger.com
cfl.dropboxstatic.com
guyanaguardian.com
secure.aadcdn.microsoftonline-p.com
104.131.31.228
2606:4700:30::681f:4a3c
2606:4700:30::681f:4b3c
2606:4700::6810:631d
2a02:26f0:6c00:283::35c1
0b891e5e3927c765f6631359309746644d608ebfc89e23125835a95b549fbfeb
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
605a9cd2d96f6b1787a68041199fd9127885eb5ee658097f2491e3b3b3e9e37c
8c4a54131a2acf0193ae3bb811e279e6707aa1ff3c69fbe6601e8272b7a271b9
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed