drittohub.com Open in urlscan Pro
2606:4700:3033::6815:21d3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response drittohub.com/dvd/privateinvestordeck/	22 KB 8 KB	541ms 396ms	Document text/html	2606:4700:3033::6815:21d3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:21d3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6b6b853b39844dc570392b91ff3b83d92777d6bfec2e4400df8da145f15738df Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7426f6275da68397-MXP content-encoding br content-type text/html date Mon, 29 Aug 2022 17:21:10 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" last-modified Wed, 16 Mar 2022 06:38:22 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uNpUFMpiq%2FK3mtM%2FKdICy%2BeRYl%2F2M5zUePt943byJPtI88MOQev77Dq5cWT6W38RhzWL0b2AWx2Sz%2BXejKfCXRLXjxoKm5bRO5BkwnyvJjrooM%2FTzRYJVhwTk0%2FOrJmAURukVEZNh36d5pnJ"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	1200px-Microsoft_logo_%282012%29.svg.png upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/	21 KB 23 KB	200ms 91ms	Image image/png	2620:0:862:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/1200px-Microsoft_logo_%282012%29.svg.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/8.0.8 / Resource Hash f2f4485ba9fceb2926c0a541344eaf5ecdba5be4dbf75f823a73036224beebfb Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 09:49:43 GMT nel { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0} age 27087 x-cache-status hit-front x-cache cp3053 hit, cp3053 hit/12 content-disposition inline;filename*=UTF-8''Microsoft_logo_%282012%29.svg.png server-timing cache;desc="hit-front", host;desc="cp3053" content-length 21995 x-client-ip 2001:ac8:21:e::13 accept-ranges bytes last-modified Sun, 08 May 2022 19:56:59 GMT server ATS/8.0.8 etag dd522f10e0735d7995b8d63f3cba2945 strict-transport-security max-age=106384710; includeSubDomains; preload report-to { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } content-type image/png access-control-allow-origin * access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache permissions-policy interest-cohort=(),ch-ua-arch=(self "intake-analytics.wikimedia.org"),ch-ua-bitness=(self "intake-analytics.wikimedia.org"),ch-ua-full-version-list=(self "intake-analytics.wikimedia.org"),ch-ua-model=(self "intake-analytics.wikimedia.org"),ch-ua-platform-version=(self "intake-analytics.wikimedia.org") accept-ch Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version timing-allow-origin *
GET H2	200	folder.png spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/	444 B 967 B	352ms 53ms	Image image/png	23.6.112.130 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/folder.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 23.6.112.130 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-6-112-130.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 29 Aug 2022 17:21:11 GMT content-md5 RLL5gHuYw8pCjo0/TAtEsg== alt-svc h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" content-length 444 x-ms-lease-status unlocked last-modified Fri, 15 Jan 2021 19:39:57 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D8B98D570EBC35 content-type image/png access-control-allow-origin * x-ms-request-id 226f83ce-101e-0040-4312-718115000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=27615042 x-ms-version 2009-09-19 timing-allow-origin *
GET H2	404	microsoft-logo.png drittohub.com/_layouts/15/images/	315 B 315 B	376ms 374ms	Image text/html	2606:4700:3033::6815:21d3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://drittohub.com/_layouts/15/images/microsoft-logo.png Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:21d3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/dvd/privateinvestordeck/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 17:21:11 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oHgvgfKLSDUhT7cFuVd%2FsiBvYULic8ULQ8etPSAKhC3HHUBd7aXOoMCUJFJrOV3tl5YQhzscy8c4WqHWEOyIR4ZRILXsatfgf5dJmSOtm0nOyowXneiJYSPCqTemBV99myOzXbr5ld6%2BbIdr"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 7426f62abc968397-MXP alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	email-decode.min.js Show response drittohub.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	67ms 67ms	Script application/javascript	2606:4700:3033::6815:21d3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://drittohub.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:21d3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/dvd/privateinvestordeck/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 17:21:10 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 23 Aug 2022 11:02:51 GMT server cloudflare etag W/"6304b3db-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-frame-options DENY report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUEOaIhzpG2tn5keiLrDdJshYFz3yTv91t3KggfKNKC4gxjc11BlRcy1QNmyvHmOb0XlgMyD%2FoIbnJ4hQYFi0XWhcHFmYxXIjcXGM4nlRm%2FJE%2BuQ2puXVmBLM9oM9%2FFj8H6Fxd6z2RK2U9rx"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 7426f62abc9a8397-MXP vary Accept-Encoding expires Wed, 31 Aug 2022 17:21:10 GMT
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	396ms 300ms	Script application/javascript	2001:4de0:ac18::1:a:2a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 17:21:11 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-15851" vary Accept-Encoding x-hw 1661793671.dop220.lo4.t,1661793671.cds041.lo4.hn,1661793671.cds320.lo4.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30638
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 85 KB	131ms 43ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: drittohub.com URL: https://drittohub.com/dvd/privateinvestordeck/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://drittohub.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers date Mon, 29 Aug 2022 16:15:54 GMT x-content-type-options nosniff age 3916 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 86659 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 29 Aug 2023 16:15:54 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://drittohub.com/_layouts/15/images/microsoft-logo.png Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
code.jquery.com
drittohub.com
spoprod-a.akamaihd.net
upload.wikimedia.org
2001:4de0:ac18::1:a:2a
23.6.112.130
2606:4700:3033::6815:21d3
2620:0:862:ed1a::2:b
2a00:1450:4001:80f::200a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
6b6b853b39844dc570392b91ff3b83d92777d6bfec2e4400df8da145f15738df
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa
f2f4485ba9fceb2926c0a541344eaf5ecdba5be4dbf75f823a73036224beebfb