4sf.sq.ahkfoundation.org.bd Open in urlscan Pro
199.188.200.68  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 4sf.sq.ahkfoundation.org.bd/	1 KB 918 B	276ms 91ms	Document text/html	199.188.200.68 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://4sf.sq.ahkfoundation.org.bd/ Protocol HTTP/1.1 Server 199.188.200.68 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS host17-6.registrar-servers.com Software Apache / Resource Hash 986b428b078f677def796210f4598ca3851122c3989ba037b953bac0d7fad1af Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 685 content-type text/html date Sat, 11 Mar 2023 15:48:17 GMT last-modified Tue, 28 Feb 2023 14:52:40 GMT server Apache vary Accept-Encoding
GET H2	200	api.js Show response js.hcaptcha.com/1/	284 KB 80 KB	65ms 19ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hcaptcha.com/1/api.js Requested by Host: 4sf.sq.ahkfoundation.org.bd URL: http://4sf.sq.ahkfoundation.org.bd/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 49ae435515c2a95a7e63064d0a0a79d3041751bf3579d24eb0a1b2f9ff0acaa0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://4sf.sq.ahkfoundation.org.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 337c92db4f8666e0ac53ab530546daa6.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-content-type-options nosniff age 0 x-amz-cf-pop LHR62-C5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 20 Feb 2023 12:05:43 GMT server cloudflare etag W/"e1535a0d2a29d84a9f24f2c0b6a8bb3c" vary Accept-Encoding content-type application/javascript cache-control max-age=120 cf-ray 7a64f0d71b6d43f3-EWR x-amz-cf-id 1U8KYnmXUlh6RP2SdGh5Xb30IEkUR-A69xdsf5ww_4OxZpddzWYgKw==
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	107ms 8ms	Image image/svg+xml	2620:1ec:4f:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: 4sf.sq.ahkfoundation.org.bd URL: http://4sf.sq.ahkfoundation.org.bd/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language en-US,en;q=0.9 Referer http://4sf.sq.ahkfoundation.org.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 11 Mar 2023 15:48:16 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache TCP_HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373CB2849 x-azure-ref 0waIMZAAAAAA+LMC79l1tRZ1r9wpLfC1PRVdSMzBFREdFMDYwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 4335ea2f-301e-0024-57a1-520a48000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/ Frame 4EED	2 KB 930 B	37ms 12ms	Document text/html	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Requested by Host: js.hcaptcha.com URL: https://js.hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ed44f125fa65176b2ec9f2235ad506357a7152e467bf8c04f977f9ee8370645 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://4sf.sq.ahkfoundation.org.bd/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * age 249001 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 7a64f0d7ac3543f3-EWR content-encoding br content-type text/html cross-origin-resource-policy cross-origin date Sat, 11 Mar 2023 15:48:17 GMT last-modified Mon, 20 Feb 2023 12:05:43 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 83a9d954a0f6d2b7a4f6f30e8d8e3be0.cloudfront.net (CloudFront) x-amz-cf-id O25UBRaVT8Ww7qAxV5cyd6SmGE6EVOqL14d8Hvy5P_JcHnRHZ25bkA== x-amz-cf-pop LHR62-C5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/ Frame A898	2 KB 816 B	35ms 14ms	Document text/html	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Requested by Host: js.hcaptcha.com URL: https://js.hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ed44f125fa65176b2ec9f2235ad506357a7152e467bf8c04f977f9ee8370645 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://4sf.sq.ahkfoundation.org.bd/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * age 249001 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 7a64f0d7ac3643f3-EWR content-encoding br content-type text/html cross-origin-resource-policy cross-origin date Sat, 11 Mar 2023 15:48:17 GMT last-modified Mon, 20 Feb 2023 12:05:43 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 83a9d954a0f6d2b7a4f6f30e8d8e3be0.cloudfront.net (CloudFront) x-amz-cf-id O25UBRaVT8Ww7qAxV5cyd6SmGE6EVOqL14d8Hvy5P_JcHnRHZ25bkA== x-amz-cf-pop LHR62-C5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/a0e2c1c/ Frame 4EED	284 KB 80 KB	15ms 14ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2e8872a88091d881c12793573d56e806a7e70678b38e0493a489d15c38039a2e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 337c92db4f8666e0ac53ab530546daa6.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-content-type-options nosniff age 249003 x-amz-cf-pop LHR62-C5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 20 Feb 2023 12:05:43 GMT server cloudflare etag W/"e1535a0d2a29d84a9f24f2c0b6a8bb3c" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 cf-ray 7a64f0d80cbb43f3-EWR x-amz-cf-id 1U8KYnmXUlh6RP2SdGh5Xb30IEkUR-A69xdsf5ww_4OxZpddzWYgKw==
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/a0e2c1c/ Frame A898	284 KB 80 KB	15ms 15ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2e8872a88091d881c12793573d56e806a7e70678b38e0493a489d15c38039a2e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 337c92db4f8666e0ac53ab530546daa6.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-content-type-options nosniff age 249003 x-amz-cf-pop LHR62-C5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 20 Feb 2023 12:05:43 GMT server cloudflare etag W/"e1535a0d2a29d84a9f24f2c0b6a8bb3c" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 cf-ray 7a64f0d80cbc43f3-EWR x-amz-cf-id 1U8KYnmXUlh6RP2SdGh5Xb30IEkUR-A69xdsf5ww_4OxZpddzWYgKw==
GET DATA	200 OK	truncated / Frame A898	798 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png
POST H2	200	checksiteconfig Show response hcaptcha.com/ Frame A898	554 B 778 B	47ms 30ms	XHR application/json	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hcaptcha.com/checksiteconfig?v=a0e2c1c&host=4sf.sq.ahkfoundation.org.bd&sitekey=44c7bfed-9343-4950-9d6f-9d1e4b3cba3f&sc=1&swa=1 Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/hcaptcha.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e82c9fb3fc151fd36b0d870250fd407b8e9518005b53e930e8555bee781400a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json Referer https://newassets.hcaptcha.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Content-Type text/plain Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff content-encoding br server cloudflare vary Origin, Accept-Encoding access-control-allow-methods GET, HEAD, POST, OPTIONS content-type application/json access-control-allow-origin https://newassets.hcaptcha.com access-control-allow-credentials true cf-ray 7a64f0d91e1143f3-EWR access-control-allow-headers Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path cf-chl-bypass 2 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	hsw.js Show response newassets.hcaptcha.com/c/6fdd2f3/ Frame 4EED	438 KB 171 KB	23ms 23ms	Script application/javascript	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/c/6fdd2f3/hsw.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/hcaptcha.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 71359c72331dcb76539f8c4f02a6270367ae83779c1755f72edeebe4422bdb9d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 2bdf303ca8bff8095bc652af90ed892a.cloudfront.net (CloudFront) cf-cache-status HIT content-encoding br x-content-type-options nosniff age 151230 x-amz-cf-pop LHR62-C5 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 20 Feb 2023 14:29:23 GMT server cloudflare etag W/"fedf9cc937f2c25a9dbd297271ba2cb8" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 7a64f0d95f994239-EWR x-amz-cf-id RQhPEts-dadRLW-zvs8zB-4zAgKO4fX5VCoNgjoPBIQYewS48ph0bw==
GET H3	200	e Show response newassets.hcaptcha.com/i/6fdd2f3/ Frame 4EED	118 KB 119 KB	19ms 18ms	XHR application/octet-stream	104.16.168.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/i/6fdd2f3/e Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/hcaptcha.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b402d2371fa62944d88162cf2e1787a37fd5c71c168dd433e5c1e9a42f68dab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/a0e2c1c/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Sat, 11 Mar 2023 15:48:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload via 1.1 f5b36a6d650578e8cf7b1700c37caa00.cloudfront.net (CloudFront) cf-cache-status HIT x-content-type-options nosniff age 151230 x-amz-cf-pop JFK50-P1 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 121146 last-modified Mon, 20 Feb 2023 14:29:21 GMT server cloudflare etag "2405fefd341356bd5fc8e686e607be57" vary Accept-Encoding content-type application/octet-stream access-control-allow-origin * cache-control max-age=3024000 accept-ranges bytes cf-ray 7a64f0daf9224239-EWR x-amz-cf-id -BOCiRevaekTXyRvf8gO7qdIVtqDwQpCnMsF6YGg42hPY2Qo0Y5f7w==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless function| onSuccess object| Raven object| hcaptcha object| grecaptcha

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4sf.sq.ahkfoundation.org.bd
aadcdn.msauth.net
hcaptcha.com
js.hcaptcha.com
newassets.hcaptcha.com
104.16.168.131
199.188.200.68
2620:1ec:4f:1::40
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0b402d2371fa62944d88162cf2e1787a37fd5c71c168dd433e5c1e9a42f68dab
0ed44f125fa65176b2ec9f2235ad506357a7152e467bf8c04f977f9ee8370645
2e8872a88091d881c12793573d56e806a7e70678b38e0493a489d15c38039a2e
49ae435515c2a95a7e63064d0a0a79d3041751bf3579d24eb0a1b2f9ff0acaa0
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
71359c72331dcb76539f8c4f02a6270367ae83779c1755f72edeebe4422bdb9d
8e82c9fb3fc151fd36b0d870250fd407b8e9518005b53e930e8555bee781400a
986b428b078f677def796210f4598ca3851122c3989ba037b953bac0d7fad1af