urlscan.io logo urlscan.io
SecurityTrails logo

555305.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::237  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2f11r16.trk.elasticemail.com%2ftracking%2fclick%3fd%3dxQ3...
Effective URL: https://555305.selcdn.ru/564377/re.htm
Submission: On June 23 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 6 countries across 6 domains to perform 8 HTTP transactions. The main IP is 2a00:ab00:0:12::237, located in Russian Federation and belongs to SELECTEL, RU. The main domain is 555305.selcdn.ru.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on November 26th 2020. Valid for: a year.
This is the only time 555305.selcdn.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 44.241.252.80 16509 (AMAZON-02)
1 1 164.132.95.126 16276 (OVH)
1 168.119.10.103 24940 (HETZNER-AS)
2 95.156.8.108 6821 (MT-AS-OWN...)
2 2001:4de0:ac1... 20446 (HIGHWINDS3)
3 2a00:ab00:0:1... 49505 (SELECTEL)
8 5
1    44.241.252.80 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-252-80.us-west-2.compute.amazonaws.com
imss91-ctp.trendmicro.com
1    164.132.95.126 (Sotteville-lès-Rouen, France)

ASN16276 (OVH, FR)
PTR: api.elasticemail.com
11r16.trk.elasticemail.com
1    168.119.10.103 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: server4.webrserver.com
bangla21.tv
2    95.156.8.108 (Macedonia, The Former Yugoslav Republic Of)

ASN6821 (MT-AS-OWN bul. Orce Nikolov bb, MK)
PTR: cpanel.telekom.mk
semm.mk
2    2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
3    2a00:ab00:0:12::237 (Russian Federation)

ASN49505 (SELECTEL, RU)
555305.selcdn.ru
Domain Requested by
3 555305.selcdn.ru semm.mk
555305.selcdn.ru
2 code.jquery.com semm.mk
555305.selcdn.ru
2 semm.mk bangla21.tv
semm.mk
1 bangla21.tv
1 11r16.trk.elasticemail.com 1 redirects
1 imss91-ctp.trendmicro.com 1 redirects
8 6

This site contains links to these domains. Also see Links.

Domain
www.premierpawn.com
Subject Issuer Validity Valid
*.bangla21.tv
R3		 2021-05-31 -
2021-08-29		 3 months crt.sh
semm.mk
cPanel, Inc. Certification Authority		 2021-06-02 -
2021-08-31		 3 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh
*.selcdn.ru
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-11-26 -
2021-12-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://555305.selcdn.ru/564377/re.htm
Frame ID: B40E43A8E123524068B90827AEC106C8
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2f11r16.trk.elasticemail.com%2ftracki... HTTP 302
    https://11r16.trk.elasticemail.com/tracking/click?d=xQ3e7iG-m9CRf6aN714I-A-VMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3U... HTTP 302
    https://bangla21.tv/hello.html Page URL
  2. https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t Page URL
  3. https://semm.mk/index/zz/?use=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t Page URL
  4. https://555305.selcdn.ru/564377/redr.htm Page URL
  5. https://555305.selcdn.ru/564377/re.htm Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

5
IPs

6
Countries

214 kB
Transfer

466 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2f11r16.trk.elasticemail.com%2ftracking%2fclick%3fd%3dxQ3e7iG%2dm9CRf6aN714I%2dA%2dVMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJFu%5f0YkImH9jHW2iIVKKcRpqKa4Y8vLCqCV2f%2dzVjGMSQR%2dDtfBjucxBUMurXJDgf6bvddGrSfhDfPDYbHVFCBipU1%23ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t&umid=61102EFE-C56F-8505-A76A-53C9BAFD2E86&auth=19120be9529b25014b618505cb01789c5433dae7-8547a7b171477ec550b6671f700e5e131b52e044 HTTP 302
    https://11r16.trk.elasticemail.com/tracking/click?d=xQ3e7iG-m9CRf6aN714I-A-VMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJFu_0YkImH9jHW2iIVKKcRpqKa4Y8vLCqCV2f-zVjGMSQR-DtfBjucxBUMurXJDgf6bvddGrSfhDfPDYbHVFCBipU1 HTTP 302
    https://bangla21.tv/hello.html Page URL
  2. https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t Page URL
  3. https://semm.mk/index/zz/?use=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t Page URL
  4. https://555305.selcdn.ru/564377/redr.htm Page URL
  5. https://555305.selcdn.ru/564377/re.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2f11r16.trk.elasticemail.com%2ftracking%2fclick%3fd%3dxQ3e7iG%2dm9CRf6aN714I%2dA%2dVMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJFu%5f0YkImH9jHW2iIVKKcRpqKa4Y8vLCqCV2f%2dzVjGMSQR%2dDtfBjucxBUMurXJDgf6bvddGrSfhDfPDYbHVFCBipU1%23ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t&umid=61102EFE-C56F-8505-A76A-53C9BAFD2E86&auth=19120be9529b25014b618505cb01789c5433dae7-8547a7b171477ec550b6671f700e5e131b52e044 HTTP 302
  • https://11r16.trk.elasticemail.com/tracking/click?d=xQ3e7iG-m9CRf6aN714I-A-VMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJFu_0YkImH9jHW2iIVKKcRpqKa4Y8vLCqCV2f-zVjGMSQR-DtfBjucxBUMurXJDgf6bvddGrSfhDfPDYbHVFCBipU1 HTTP 302
  • https://bangla21.tv/hello.html

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
hello.html
bangla21.tv/
Redirect Chain
  • https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2f11r16.trk.elasticemail.com%2ftracking%2fclick%3fd%3dxQ3e7iG%2dm9CRf6aN714I%2dA%2dVMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJF...
  • https://11r16.trk.elasticemail.com/tracking/click?d=xQ3e7iG-m9CRf6aN714I-A-VMCQ1oRKTLKzkqVeyHkPHZDGeTNP9JbsJM3UG5uJFu_0YkImH9jHW2iIVKKcRpqKa4Y8vLCqCV2f-zVjGMSQR-DtfBjucxBUMurXJDgf6bvddGrSfhDfPDYbHV...
  • https://bangla21.tv/hello.html
1 KB
795 B 		Document
General
Check archive.org
Download Go to
Full URL
https://bangla21.tv/hello.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
168.119.10.103 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
server4.webrserver.com
Software
LiteSpeed /
Resource Hash
a8e7cfc45f2e03d83608b62c84991440ac4deea5bbd0579887775c4ca847b9fa

Request headers

:method
GET
:authority
bangla21.tv
:scheme
https
:path
/hello.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html
last-modified
Wed, 23 Jun 2021 13:37:49 GMT
accept-ranges
bytes
content-encoding
br
vary
Accept-Encoding
content-length
520
date
Wed, 23 Jun 2021 15:26:49 GMT
server
LiteSpeed
alt-svc
h3-34=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-27=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Redirect headers

cache-control
private
content-type
text/html; charset=utf-8
location
https://bangla21.tv/hello.html
server
Microsoft-IIS/10.0
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, X-ElasticEmail-ApiKey, X-ElasticEmail-BrowserToken, X-ElasticEmail-ImpersonateAs
access-control-expose-headers
X-ElasticEmail-BrowserToken, X-Total-Count, X-ElasticEmail-AccessToken
x-robots-tag
noindex, nofollow
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
date
Wed, 23 Jun 2021 15:26:49 GMT
content-length
147
/
semm.mk/index/ 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
Requested by
Host: bangla21.tv
URL: https://bangla21.tv/hello.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.156.8.108 , Macedonia, The Former Yugoslav Republic Of, ASN6821 (MT-AS-OWN bul. Orce Nikolov bb, MK),
Reverse DNS
cpanel.telekom.mk
Software
nginx /
Resource Hash
30237bf9b79f803c8261eeb1e92d538fde3d70e1758e25b5674729ea04bfcf54
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
semm.mk
:scheme
https
:path
/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://bangla21.tv/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://bangla21.tv/

Response headers

server
nginx
date
Wed, 23 Jun 2021 15:26:50 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
EXPIRED
x-server-powered-by
Engintron
content-encoding
gzip
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: semm.mk
URL: https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Referer
https://semm.mk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 23 Jun 2021 15:26:50 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1111d"
vary
Accept-Encoding
x-hw
1624462010.dop203.fr8.t,1624462010.cds290.fr8.hc,1624462010.cds274.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24038
/
semm.mk/index/zz/ 		349 B
510 B 		Document
General
Check archive.org
Download Go to
Full URL
https://semm.mk/index/zz/?use=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
Requested by
Host: semm.mk
URL: https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.156.8.108 , Macedonia, The Former Yugoslav Republic Of, ASN6821 (MT-AS-OWN bul. Orce Nikolov bb, MK),
Reverse DNS
cpanel.telekom.mk
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
semm.mk
:scheme
https
:path
/index/zz/?use=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://semm.mk/index/?und=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t

Response headers

server
nginx
date
Wed, 23 Jun 2021 15:26:56 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
MISS
x-server-powered-by
Engintron
content-encoding
gzip
redr.htm
555305.selcdn.ru/564377/ 		437 B
852 B 		Document
General
Check archive.org
Download Go to
Full URL
https://555305.selcdn.ru/564377/redr.htm
Requested by
Host: semm.mk
URL: https://semm.mk/index/zz/?use=ZHVzdGluLndpdGhlcnNAY2VudHVyeWxpbmsuY29t
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:ab00:0:12::237 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
555305.selcdn.ru
:scheme
https
:path
/564377/redr.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://semm.mk/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://semm.mk/

Response headers

accept-ranges
bytes
access-control-allow-origin
*
access-control-expose-headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
content-length
437
content-type
text/html
etag
"cd46c6354052eba66f5072dd3dfe35b0"
last-modified
Wed, 16 Jun 2021 15:08:21 GMT
x-timestamp
1623856100.92996
x-trans-id
168918852dedc35d
date
Tue, 22 Jun 2021 04:53:53 GMT
age
124383
Primary Request re.htm
555305.selcdn.ru/564377/ 		109 KB
109 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://555305.selcdn.ru/564377/re.htm
Requested by
Host: 555305.selcdn.ru
URL: https://555305.selcdn.ru/564377/redr.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:ab00:0:12::237 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
/
Resource Hash
716f8994415e2d50c2febc3bb333955d6e8f45f25bca8b6854b9cc8067c78770

Request headers

:method
GET
:authority
555305.selcdn.ru
:scheme
https
:path
/564377/re.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://555305.selcdn.ru/564377/redr.htm
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://555305.selcdn.ru/564377/redr.htm

Response headers

accept-ranges
bytes
access-control-allow-origin
*
access-control-expose-headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
content-length
111271
content-type
text/html
etag
"99183326ed4132b513008a105c194f2c"
last-modified
Wed, 16 Jun 2021 15:06:39 GMT
x-timestamp
1623855998.27880
x-trans-id
1689186d47b2b7e6
date
Wed, 23 Jun 2021 12:33:22 GMT
age
10414
myscr584876.js.download
555305.selcdn.ru/564377/index_files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://555305.selcdn.ru/564377/index_files/myscr584876.js.download
Requested by
Host: 555305.selcdn.ru
URL: https://555305.selcdn.ru/564377/re.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a00:ab00:0:12::237 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
/
Resource Hash

Request headers

:path
/564377/index_files/myscr584876.js.download
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
555305.selcdn.ru
referer
https://555305.selcdn.ru/564377/re.htm
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://555305.selcdn.ru/564377/re.htm
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 23 Jun 2021 15:26:40 GMT
age
16
content-type
text/html
access-control-allow-origin
*
access-control-expose-headers
X-Backend-Timestamp, Etag, Last-Modified, X-Object-Manifest, X-Timestamp
cache-control
no-cache, max-age=60
content-length
70
expires
Wed, 23 Jun 2021 15:27:40 GMT
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: 555305.selcdn.ru
URL: https://555305.selcdn.ru/564377/re.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer
https://555305.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 23 Jun 2021 15:26:56 GMT
content-encoding
gzip
last-modified
Fri, 24 Oct 2014 00:16:07 GMT
server
nginx
etag
W/"54499a47-4185d"
vary
Accept-Encoding
x-hw
1624462016.dop203.fr8.t,1624462016.cds290.fr8.hc,1624462016.cds250.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
79506
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		13 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| feedUpdateResponse object| feedUpdateSplit number| x string| che function| $ function| jQuery

0 Cookies