ukrainehelp.xyz Open in urlscan Pro
2a0a:2b43:c:d344::  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request payment.php Show response ukrainehelp.xyz/	84 KB 33 KB	304ms 252ms	Document text/html	2a0a:2b43:c:d344:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://ukrainehelp.xyz/payment.php Protocol HTTP/1.1 Server 2a0a:2b43:c:d344:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash dacc2e71ebec4718126233f16d3712279797de64ee3b0847fafb204190fd931f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server openresty Date Thu, 17 Mar 2022 05:32:56 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 25 KB	39ms 19ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617, 617 age 4397870 cdn-cachedat 2021-06-08 14:34:23 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid d45111ebe65160a53e36d081c4a375ca cf-ray 6ed359d3eac69143-FRA cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	vue.min.js Show response cdnjs.cloudflare.com/ajax/libs/vue/2.6.10/	91 KB 31 KB	46ms 26ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/vue/2.6.10/vue.min.js Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72194d152571dd375c4365e5c3b4af9db2c06af0102ced18fcb062597d38be26 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 843271 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 30769 timing-allow-origin * last-modified Mon, 04 May 2020 16:17:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb0402c-16deb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fr8FOmCyrQxZJetkUbsh1pjx6zUclh7VzHaLGKxezMlMQRf%2B4EU3Ub6S%2Ff%2Bc6U7wSD5bJ0Bc7NDhn5Q%2BI4A70FguxRxzPtqJi5vhtwrV6fRqNU7nanc0u8cBrZx6gL9UQAPPbQmrWtMd1OECsD9ayO%2Be"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6ed359d3e95d90c1-FRA expires Tue, 07 Mar 2023 05:32:56 GMT
GET H2	200	vue-the-mask.js Show response unpkg.com/vue-the-mask@0.11.1/dist/	5 KB 2 KB	52ms 22ms	Script application/javascript	2606:4700::6810:7aaf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/vue-the-mask@0.11.1/dist/vue-the-mask.js Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ef6dd0c1dbd61b792f7791c989d68b3939263c502269643f8e96c28f7e49a15 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 17 Mar 2022 05:32:56 GMT via 1.1 fly.io x-content-type-options nosniff cf-cache-status HIT age 1451357 fly-request-id 01FWZXPT6DBK3QC7Q8CV1GP6NA-fra content-encoding br vary Accept-Encoding last-modified Tue, 10 Oct 2017 17:43:56 GMT server cloudflare etag W/"1281-ojkEKEJwDFSwzNnN7s8unltOATY" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6ed359d3fd1268fd-FRA
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	58ms 24ms	Script text/javascript	2a00:1450:4001:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 15:20:25 GMT content-encoding gzip x-content-type-options nosniff age 223951 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 14 Mar 2023 15:20:25 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 16 KB	36ms 18ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617, 617 age 4397870 cdn-cachedat 2021-06-03 21:35:35 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 2cb00a37491ee52b7f77e4c15001e1f8 cf-ray 6ed359d3eac79143-FRA cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	css fonts.googleapis.com/	16 KB 1 KB	58ms 21ms	Stylesheet text/css	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 54576498d5d389761af7c4250534c39ed4e43a2954d1767d6232942b26244d80 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 17 Mar 2022 05:32:56 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Thu, 17 Mar 2022 05:32:56 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 17 Mar 2022 05:32:56 GMT
GET H2	200	chip.png raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/	16 KB 16 KB	989ms 479ms	Image image/png	2606:50c0:8002::154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/chip.png Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 612d3c3f8efad0b9073b164950a2c3b5ed6d73e214fe539e6c21b4f18fed0ad8 Security Headers Name Value Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-fastly-request-id dbe31d8320a91b4b09153b81bc9e4eb2a1917c7d content-security-policy default-src 'none'; style-src 'unsafe-inline'; sandbox via 1.1 varnish x-content-type-options nosniff x-cache MISS x-cache-hits 0 vary Authorization,Accept-Encoding,Origin content-length 16470 x-xss-protection 1; mode=block x-served-by cache-icn1450028-ICN x-github-request-id 50E0:7061:1F59E:566F2:6232BCD3 x-timer S1647495177.968293,VS0,VE230 x-frame-options deny date Thu, 17 Mar 2022 05:32:57 GMT source-age 0 strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=300 etag W/"0eef0729fb842b647b8e55e6077eb705bfff46d0f861a866fe759566cb54d035" accept-ranges bytes expires Thu, 17 Mar 2022 05:37:57 GMT
GET H2	200	HI_SiYsKILxRpg3hIP6sJ7fM7PqlOevWjMY.woff2 fonts.gstatic.com/s/sourcecodepro/v20/	13 KB 13 KB	50ms 26ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcecodepro/v20/HI_SiYsKILxRpg3hIP6sJ7fM7PqlOevWjMY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 175ef860729a6f3aa7c0a7954152bddbed5446affa2fe2931be79ffed5e20f87 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://ukrainehelp.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 16 Mar 2022 01:07:12 GMT x-content-type-options nosniff age 102344 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13116 x-xss-protection 0 last-modified Thu, 03 Feb 2022 00:13:26 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 16 Mar 2023 01:07:12 GMT
GET H2	200	HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 fonts.gstatic.com/s/sourcecodepro/v20/	19 KB 19 KB	68ms 44ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcecodepro/v20/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash acce91c82cedc2cb341fba4bf9aae3096820fa28dc67b4cce8a86a575b11ef7d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://ukrainehelp.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Mon, 14 Mar 2022 16:00:00 GMT x-content-type-options nosniff age 221576 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19664 x-xss-protection 0 last-modified Thu, 03 Feb 2022 00:13:12 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Tue, 14 Mar 2023 16:00:00 GMT
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2 fonts.gstatic.com/s/sourcesanspro/v19/	7 KB 7 KB	67ms 43ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v19/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0acd59e18ef9ca4f55b04271a6121d58e6f7044ea91395054dd52d5caf2a7a55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://ukrainehelp.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 16 Mar 2022 18:14:47 GMT x-content-type-options nosniff age 40689 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7448 x-xss-protection 0 last-modified Wed, 23 Feb 2022 17:39:02 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 16 Mar 2023 18:14:47 GMT
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v19/	13 KB 13 KB	46ms 22ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v19/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin http://ukrainehelp.xyz Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 16 Mar 2022 18:02:06 GMT x-content-type-options nosniff age 41450 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13036 x-xss-protection 0 last-modified Wed, 23 Feb 2022 17:39:39 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 16 Mar 2023 18:02:06 GMT
GET H2	200	12.jpeg raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/	108 KB 109 KB	941ms 524ms	Image image/jpeg	2606:50c0:8002::154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/12.jpeg Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 329a0aadef859197ab3abdebc1bf0e4884c9c6753265cf032887ed7c9aeecc22 Security Headers Name Value Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-fastly-request-id ce2069dfc40e6627d7fb2343512307446d6314af content-security-policy default-src 'none'; style-src 'unsafe-inline'; sandbox via 1.1 varnish x-content-type-options nosniff x-cache MISS x-cache-hits 0 vary Authorization,Accept-Encoding,Origin content-length 110884 x-xss-protection 1; mode=block x-served-by cache-icn1450028-ICN x-github-request-id 4B28:7805:85D6B:CF134:6232C808 x-timer S1647495177.968347,VS0,VE250 x-frame-options deny date Thu, 17 Mar 2022 05:32:57 GMT source-age 0 strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=300 etag W/"61bfd4ab6100c2f39aad8df6d04f5e686df2ec8ccf4909148a28bc1c6aa7280e" accept-ranges bytes expires Thu, 17 Mar 2022 05:37:57 GMT
GET H2	200	visa.png raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/	6 KB 6 KB	841ms 425ms	Image image/png	2606:50c0:8002::154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://raw.githubusercontent.com/muhammederdem/credit-card-form/master/src/assets/images/visa.png Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1a9548347c9b338b3168bc5eb94c8206490a3462efc3c674632e9e9236785d54 Security Headers Name Value Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-fastly-request-id 07a790f8749b6da2a165f5df8c5a3136412b17e0 content-security-policy default-src 'none'; style-src 'unsafe-inline'; sandbox via 1.1 varnish x-content-type-options nosniff x-cache HIT x-cache-hits 1 vary Authorization,Accept-Encoding,Origin content-length 5927 x-xss-protection 1; mode=block x-served-by cache-icn1450028-ICN x-github-request-id 9418:7061:1F80D:56C76:6232BDEE x-timer S1647495177.968371,VS0,VE176 x-frame-options deny date Thu, 17 Mar 2022 05:32:57 GMT source-age 0 strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=300 etag W/"a85601928a11d6b5e6b530a1393acefc80f47d2fe589cadd27da82060323bd15" accept-ranges bytes expires Thu, 17 Mar 2022 05:37:57 GMT
GET H2	200	loader.js Show response www.smartsuppchat.com/	16 KB 5 KB	33ms 7ms	Script application/javascript	2a02:6ea0:c700::4 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://www.smartsuppchat.com/loader.js? Requested by Host: ukrainehelp.xyz URL: http://ukrainehelp.xyz/payment.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::4 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 995c24c0cfc6c4931df9a4300763dbaa0236a3ba483126c5dcf871027ede7ab5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://ukrainehelp.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-nzt AcO1rzURk4b/LgAAAA x-accel-expires @1647495190 date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br etag W/"620ac7c0-416d" last-modified Mon, 14 Feb 2022 21:21:04 GMT server CDN77-Turbo x-77-nzt-ray qFZT8dSQkHM x-77-cache HIT content-type application/javascript cache-control max-age=300, public, s-maxage=60 x-cache HIT x-age 46 x-77-pop frankfurtDE expires Mon, 14 Feb 2022 21:26:18 GMT
GET H2	200	9ed1699cd94ad9ca77f1154044fe27f1503a884f.json Show response bootstrap.smartsuppchat.com/widget/	6 KB 2 KB	76ms 31ms	XHR application/json	54.93.43.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bootstrap.smartsuppchat.com/widget/9ed1699cd94ad9ca77f1154044fe27f1503a884f.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.93.43.88 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-93-43-88.eu-central-1.compute.amazonaws.com Software / Resource Hash 1651ff5dd4a79947454b1aabe55933e6fa3d9a1b6bb1fdf311ef4583d4906ea4 Request headers Referer http://ukrainehelp.xyz/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Content-Type text/plain Response headers x-version d8c7f97f7f4102e8243000e7d13d3ebbe3617872 date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-hit redis etag "18f2-txx7ej0c22X4izqC5tuC14CPCVI" vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, max-age=0, must-revalidate
GET H2	200	asset-manifest.json Show response widget-v2.smartsuppcdn.com/	2 KB 702 B	37ms 7ms	XHR application/json	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/asset-manifest.json Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 0a55ebb4b56b089de0403d706ff7a358bc1bfc72bfba9c481c62423ec24d9ca7 Request headers Referer http://ukrainehelp.xyz/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Content-Type text/plain Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray E4b0dFZCTIg x-77-cache HIT x-cache HIT x-age 3 x-77-nzt AcO1ry+KLhf/AwAAAA x-accel-expires @1647495233 last-modified Mon, 14 Feb 2022 15:57:43 GMT server CDN77-Turbo etag W/"620a7bf7-6ce" content-type application/json access-control-allow-origin * cache-control max-age=300, public, s-maxage=60 expires Tue, 15 Feb 2022 08:55:43 GMT
GET H2	200	runtime-main.85108f03.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame 81CD	2 KB 2 KB	26ms 7ms	Script application/javascript	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/runtime-main.85108f03.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 9abb23e05bfb2d72a95d23597ad9d1b57dddc6433a0394da34fca4238b55ec2f Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray sXZgdO383zM x-77-cache HIT x-cache HIT x-age 2580169 x-77-nzt AcO1ry+orzX/yV4nAA x-accel-expires @1676451007 last-modified Mon, 14 Feb 2022 15:57:43 GMT server CDN77-Turbo etag W/"620a7bf7-9bd" content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Wed, 15 Feb 2023 08:50:07 GMT
GET H2	200	6.eec6845e.chunk.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame 81CD	509 KB 141 KB	67ms 48ms	Script application/javascript	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/6.eec6845e.chunk.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 272cb9098068d740c2d32aef874357a14601c1f519bba24986c4c661b223fdf2 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray cW0BAvx3ACk x-77-cache HIT x-cache HIT x-age 2580169 x-77-nzt AcO1ry+/SQ7/yV4nAA x-accel-expires @1676451007 last-modified Mon, 14 Feb 2022 15:57:43 GMT server CDN77-Turbo etag W/"620a7bf7-7f2a7" content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Wed, 15 Feb 2023 08:50:07 GMT
GET H2	200	main.8f5be6a4.chunk.js Show response widget-v2.smartsuppcdn.com/static/js/ Frame 81CD	111 KB 26 KB	83ms 64ms	Script application/javascript	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/static/js/main.8f5be6a4.chunk.js Requested by Host: www.smartsuppchat.com URL: https://www.smartsuppchat.com/loader.js? Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 758c42fab52686515289e03be11e33d83215428a6b2b79721b16013b77b410c8 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray zqUbpl6mfts x-77-cache HIT x-cache HIT x-age 2580169 x-77-nzt AcO1ry/+Re//yV4nAA x-accel-expires @1676451007 last-modified Mon, 14 Feb 2022 15:57:43 GMT server CDN77-Turbo etag W/"620a7bf7-1bcff" content-type application/javascript access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Wed, 15 Feb 2023 08:50:07 GMT
GET H2	200	ru.json Show response widget-v2.smartsuppcdn.com/translates/ Frame 81CD	6 KB 2 KB	8ms 8ms	Fetch application/json	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/translates/ru.json?v=8f2aa71ffaec8eca8f7a787c14b5d2213ab2127f Requested by Host: widget-v2.smartsuppcdn.com URL: https://widget-v2.smartsuppcdn.com/static/js/main.8f5be6a4.chunk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash 9a9c361f0b0325e795decbe98a5b2d177eb184db2bc85d047f16e7a2a9e23d49 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray x+s9zwVHyjo x-77-cache HIT x-cache HIT x-age 2580045 x-77-nzt AcO1ry/5W7T/TV4nAA x-accel-expires @1676451131 last-modified Mon, 14 Feb 2022 15:56:49 GMT server CDN77-Turbo etag W/"620a7bc1-165f" content-type application/json access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Wed, 15 Feb 2023 08:52:11 GMT
GET H2	200	en.json Show response widget-v2.smartsuppcdn.com/translates/ Frame 81CD	4 KB 2 KB	9ms 9ms	Fetch application/json	2a02:6ea0:c700::2 CDN77 ^_^
General Check archive.org Show headers Download Go to Full URL https://widget-v2.smartsuppcdn.com/translates/en.json?v=8f2aa71ffaec8eca8f7a787c14b5d2213ab2127f Requested by Host: widget-v2.smartsuppcdn.com URL: https://widget-v2.smartsuppcdn.com/static/js/main.8f5be6a4.chunk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:6ea0:c700::2 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB), Reverse DNS Software CDN77-Turbo / Resource Hash ea85a751f2df2b38b58d4687ebefcb0c3387559e861e34d75a7e63084868e517 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-77-pop frankfurtDE date Thu, 17 Mar 2022 05:32:56 GMT content-encoding br x-77-nzt-ray /588JS0G1DA x-77-cache HIT x-cache HIT x-age 2580133 x-77-nzt AcO1ry/1A8v/pV4nAA x-accel-expires @1676451043 last-modified Mon, 14 Feb 2022 15:56:49 GMT server CDN77-Turbo etag W/"620a7bc1-f8a" content-type application/json access-control-allow-origin * cache-control max-age=31536000, public, immutable expires Wed, 15 Feb 2023 08:50:43 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Visa (Financial)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored function| Vue object| VueTheMask function| $ function| jQuery object| bootstrap object| _smartsupp function| smartsupp boolean| SMARTSUPP_LOADED object| $smartsupp

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ukrainehelp.xyz/	1970-01-20 06:00:19	Name: ssupp.vid Value: viXsTUbTbeDxm
			ukrainehelp.xyz/	1970-01-20 06:00:19	Name: ssupp.visits Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bootstrap.smartsuppchat.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
raw.githubusercontent.com
ukrainehelp.xyz
unpkg.com
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
2606:4700::6810:125e
2606:4700::6810:7aaf
2606:4700::6812:bcf
2606:50c0:8002::154
2a00:1450:4001:809::200a
2a00:1450:4001:810::2003
2a00:1450:4001:82a::200a
2a02:6ea0:c700::2
2a02:6ea0:c700::4
2a0a:2b43:c:d344::
54.93.43.88
0a55ebb4b56b089de0403d706ff7a358bc1bfc72bfba9c481c62423ec24d9ca7
0acd59e18ef9ca4f55b04271a6121d58e6f7044ea91395054dd52d5caf2a7a55
1651ff5dd4a79947454b1aabe55933e6fa3d9a1b6bb1fdf311ef4583d4906ea4
175ef860729a6f3aa7c0a7954152bddbed5446affa2fe2931be79ffed5e20f87
1a9548347c9b338b3168bc5eb94c8206490a3462efc3c674632e9e9236785d54
272cb9098068d740c2d32aef874357a14601c1f519bba24986c4c661b223fdf2
329a0aadef859197ab3abdebc1bf0e4884c9c6753265cf032887ed7c9aeecc22
54576498d5d389761af7c4250534c39ed4e43a2954d1767d6232942b26244d80
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
612d3c3f8efad0b9073b164950a2c3b5ed6d73e214fe539e6c21b4f18fed0ad8
72194d152571dd375c4365e5c3b4af9db2c06af0102ced18fcb062597d38be26
758c42fab52686515289e03be11e33d83215428a6b2b79721b16013b77b410c8
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
995c24c0cfc6c4931df9a4300763dbaa0236a3ba483126c5dcf871027ede7ab5
9a9c361f0b0325e795decbe98a5b2d177eb184db2bc85d047f16e7a2a9e23d49
9abb23e05bfb2d72a95d23597ad9d1b57dddc6433a0394da34fca4238b55ec2f
9ef6dd0c1dbd61b792f7791c989d68b3939263c502269643f8e96c28f7e49a15
acce91c82cedc2cb341fba4bf9aae3096820fa28dc67b4cce8a86a575b11ef7d
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
dacc2e71ebec4718126233f16d3712279797de64ee3b0847fafb204190fd931f
ea85a751f2df2b38b58d4687ebefcb0c3387559e861e34d75a7e63084868e517
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d