Scan report · about 2 months agoPublic

www.theguardian.com

199.232.173.111AS54113 · US

Submittedhttps://www.theguardian.com/international

Verdict

1 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 2.5 s · 107 requests

01 · Visitor openswww.theguardian.com/international

02 · Page shown

Latest news, sport and opinion from the Guardian

03 · File delivered · maliciousfbab248c-7fbb-4759-abac-49522095472b.html

Dangerous — confirmed threat

Automated

Its form submits what you type to a different website than the one you are on. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

fbab248c-7fbb-4759-abac-49522095472b.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it as a real payload — it matched known malware. Do not open or run this file.

Success

SHA-256 b10de6feef94051c184396589cd28ae0772dd8a10b53624573dedfc051b41cc7

InfoCross-domain scripts injected at runtime

39 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 199.232.173.111FASTLY - Fastly, Inc., US · AS54113US
TLS: CN=GlobalSign Atlas R3 DV TLS CA 2025 Q3, O=GlobalSign nv-sa, C=BE · expires Nov 8, 2026

WHOIS

Registrar: GoDaddy.com, LLC
Created: Jul 6, 1994
Expires: Jul 5, 2027
Nameservers: dns1.p04.nsone.netdns2.p04.nsone.netdns3.p04.nsone.netdns4.p04.nsone.netns01.theguardiandns.comns02.theguardiandns.comns03.theguardiandns.comns04.theguardiandns.com

3 malicious7 suspicious

Hashes & fingerprints

Page Hashf0f1fed55299f0299ed65a19d44180bef345acfa47ca8404dd897bf75b823c41 Favicon Hashe03a5d0d004dff0145e9c39d2b6ff99a115669b71c27eed2f9b335fd64a489ca DOM Hasha59034365fc2378dfa71d3798447be4ac5f108007ba24daae7997baecaf3458c Screenshot pHash85ff8000fc2aff07 JARM29d29d00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c JA4Xa373a9f83c6b_7022c563de38_7f9b00b58042 Cert ThumbprintA18373B5364F00900EA1FAFD4FC66235FBE7CED2 Cert IssuerCN=GlobalSign Atlas R3 DV TLS CA 2025 Q3, O=GlobalSign nv-sa, C=BE

Page capture

Live

Title “Latest news, sport and opinion from the Guardian”

Visit Site

Engines

7 · time to verdict