cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net Open in urlscan Pro
20.209.226.68 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Submission: On August 01 via api (August 1st 2024, 7:54:31 pm UTC) from US — Scanned from DE

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 8 domains to perform 27 HTTP transactions. The main IP is 20.209.226.68, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 03 on April 5th 2024. Valid for: a year.

This is the only time cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	20.209.226.68 20.209.226.68	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
12	2a02:4780:84:... 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1 2	2a02:26f0:480... 2a02:26f0:480:bad::f03	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
27	10

2 20.209.226.68 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 (Cyprus)

ASN47583 (AS-HOSTINGER, CY)

nerdinthebrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:bad::f03 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

support.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	nerdinthebrain.com nerdinthebrain.com	314 KB
3	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4508 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832	89 KB
2	microsoft.com 1 redirects support.microsoft.com — Cisco Umbrella Rank: 12550	343 B
2	windows.net cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net	215 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3123
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	102 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	27 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	30 KB
27	8

	Domain	Requested by
12	nerdinthebrain.com	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
2	support.microsoft.com	1 redirects cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
2	maxcdn.bootstrapcdn.com	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net maxcdn.bootstrapcdn.com
2	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
1	region1.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
1	stackpath.bootstrapcdn.com	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
1	cdnjs.cloudflare.com	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
1	cdn.jsdelivr.net	cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
27	9

This site contains no links.

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 03	`2024-04-05` - `2025-03-31`	a year	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
nerdinthebrain.com R10	`2024-07-27` - `2024-10-25`	3 months	crt.sh
support.microsoft.com Microsoft Azure ECC TLS Issuing CA 04	`2024-05-01` - `2025-04-26`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Frame ID: 2759EFA2B44951A947F0D3B930FEC699
Requests: 26 HTTP requests in this frame

Frame: https://support.microsoft.com/de-DE
Frame ID: 9CBD72AFBE42F3625CBC3B7F6486B3E9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft Support Final Warning

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

27
Requests

81 %
HTTPS

89 %
IPv6

8
Domains

9
Subdomains

10
IPs

3
Countries

776 kB
Transfer

1279 kB
Size

17
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://support.microsoft.com/ HTTP 301
https://support.microsoft.com/de-DE

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/ 214 KB
214 KB 895ms
192ms Document
text/html 20.209.226.68
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.209.226.68 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f592af0da41f73df166b2a3ea9605c01559b690e579e1f51c9c3a3d9dc82cb63

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Content-Length: 219003
Content-MD5: qNsYxZ5SmKJjF0aH60STgQ==
Content-Type: text/html
Date: Thu, 01 Aug 2024 19:54:20 GMT
ETag: "0x8DCB2494063A081"
Last-Modified: Thu, 01 Aug 2024 16:44:46 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 475095c9-001e-003d-134c-e4e6e0000000
x-ms-version: 2018-03-28

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/ 216 KB
30 KB 62ms
22ms Stylesheet
text/css 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
Origin: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7612764
x-jsd-version: 5.3.0-alpha1
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 30148
x-served-by: cache-fra-etou8220074-FRA, cache-lga21927-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"35e6c-cZlWqlLbTIr9xcDPs8verWJYuKY"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zczn8AoJdjiQUmfzZlPLalqzfA%2Bxud5RpfCgvoNOkMPBfZLoSp2yiKuV%2B7swWmDz9GfROezeJlWBre%2BaJ%2FjH5sjEuWbK0jITX6VQ1IzzFn7ErC0oGHTbV1LEMAZojxG70CpbDQ3pPgCB6LkJsd4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ac8612ba9559fc3-AMS

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 82 KB
27 KB 53ms
27ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1235354
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 26660
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-14983"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XpUEbivfH7KFOpz5vGLAazEIJo0Tt%2FU6IgWOaXNKX%2FDiqcMoHpFk5Lwb5J%2Bb2QD7eBr1Y2N9PkB1pMFKWAEA%2FaoKWFsKbCE3SCqQVCtAcx66hIu%2FciqL32MwYoa8JkT6PtY7nko%2BrAwyDS9r2y1sFyBA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ac8612b9dc1b8ba-AMS
expires: Tue, 22 Jul 2025 19:54:21 GMT

GET
H3 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 59 KB
17 KB 86ms
50ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
Origin: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
cdn-edgestorageid: 1053
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-cachedat: 03/25/2024 22:48:44
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"02d223393e00c273efdcb1ade8f4f8b1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: fd261eb43e2493edc19e12992b7aea1e
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8ac8612ba9876647-AMS
cdn-requestpullsuccess: True

GET
H3 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ 27 KB
7 KB 50ms
23ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1075
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2516888
cdn-cachedat: 03/18/2024 12:51:16
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"4fbd15cb6047af93373f4f895639c8bf"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: ef9826f59a690902a542827ca03c713b
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8ac8612b9faa28af-AMS
cdn-requestpullsuccess: True

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
102 KB 96ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a038ad3e3ed3f8c9ef88625a0ea1b4c31e93bdeb8c847af58532c2e067685cc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103812
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 01 Aug 2024 19:54:21 GMT

GET
H2 200 mm.jpeg
nerdinthebrain.com/blue/mg/ 1 KB
1 KB 1549ms
1207ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/mm.jpeg
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 1bf2d147ce393f4dd577d7ce2f03ab5cc1005b84870b567002646977bbcdbb32

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:22 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: b0ffad742ac2a0636556b3179e619b87-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 1.174
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1178

GET kxFy-clip.png
nerdinthebrain.com/blue/mg/ 0
0

GET qsbs-firewall.png
nerdinthebrain.com/blue/mg/ 0
0

GET s-S4-acc.png
nerdinthebrain.com/blue/mg/ 0
0

GET Z5BR-network.png
nerdinthebrain.com/blue/mg/ 0
0

GET uZbx-si.png
nerdinthebrain.com/blue/mg/ 0
0

GET
H2 200 okPE-vs.png
nerdinthebrain.com/blue/mg/ 620 B
871 B 3222ms
3222ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/okPE-vs.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 87e1e97f8193d0c91c59f17dd99254819b70b31f606f7708553a2bb5c39c56e6

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 84151c24d536a15e7602e4d85eafbe29-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.780
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 620

GET
H2 200 mnt.png
nerdinthebrain.com/blue/mg/ 620 B
872 B 1191ms
1191ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/mnt.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 64717fb39bb1e506645bf1dcfaed16410737e89c5b8b102a6436bea0c2b18722

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:22 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 477d39a9198f51608c55705d661c7d17-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 1.155
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 620

GET
H2 200 ripo.png
nerdinthebrain.com/blue/mg/ 694 B
945 B 3222ms
3222ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/ripo.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 38966ad4737cccc1ba6d65402250dcc6a0ac3a742dafff6ba5d13455265f0c38

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 0ff4accf54e07bb6407b12861726c038-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.778
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 694

GET
H2

200

de-DE
support.microsoft.com/ Frame 9CBD
Redirect Chain

https://support.microsoft.com/
https://support.microsoft.com/de-DE

0
0

35ms
34ms

Document
text/html

2a02:26f0:480:bad::f03
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://support.microsoft.com/de-DE

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:bad::f03 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 26215
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
date: Thu, 01 Aug 2024 19:54:21 GMT
expires: Thu, 01 Aug 2024 19:54:21 GMT
pragma: no-cache
request-context: appId=
server: Kestrel
strict-transport-security: max-age=86400 ; includeSubDomains
vary: Accept-Encoding
x-correlationid: 0HN5HICQ1K0EO:000001AA
x-operationid: 3c565ee59b66c0130e32689f4cf85ed7

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: max-age=0, no-cache, no-store
content-length: 0
critical-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
date: Thu, 01 Aug 2024 19:54:21 GMT
expires: Thu, 01 Aug 2024 19:54:21 GMT
location: https://support.microsoft.com/de-DE
pragma: no-cache
request-context: appId=
server: Kestrel
strict-transport-security: max-age=86400 ; includeSubDomains
x-correlationid: 0HN5HICQ1K0EO:000001A9
x-operationid: 1ea36ce3139b041d0300456893e4cc23

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 76ms
24ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-F9ZFHN0DV3&gtm=45je47v0v9182508741za200&_p=1722542061479&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250753&cid=509361107.1722542062&ul=de-de&sr=1600x1200&lps=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722542061&sct=1&seg=0&dl=https%3A%2F%2Fcjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net%2F%3Fgclid%3DEAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE&dt=Microsoft%20Support%20Final%20Warning&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1355
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 19:54:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 taiyo.png
nerdinthebrain.com/blue/mg/ 3 KB
3 KB 2701ms
2700ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/taiyo.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 2857f63364af66a66a12d15d4bf9f536769f489e9080d7a0514b313a771fb161

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 5945b6cb0702f07cbdfa828eb44f1e84-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.265
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2680

GET
H2 200 def.png
nerdinthebrain.com/blue/mg/ 2 KB
2 KB 2700ms
2698ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/def.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: f674866044b3bb79ef21edd3ecd89bb0eb849ee2f1439d0ce7e6fc3d5cd9d626

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: daaedf92a73d828b07431e4917d6fda8-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.264
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1622

GET
H2 200 pudg_u.png
nerdinthebrain.com/blue/mg/ 88 KB
88 KB 2131ms
2130ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/pudg_u.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: ebf0674ce9dbac3587282b46bbfd7ce4340273ef6f02f5240ed2d1087a9700b2

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 88f1249f3b9057c0ac74af097cbe8ed4-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.055
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 89718

GET
H2 200 umpt.jpeg
nerdinthebrain.com/blue/mg/ 2 KB
2 KB 671ms
670ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/umpt.jpeg
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 2487850348dd29c6f7e190529a27dc1ea67a0085eac7a26f6837fe0012ce052e

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:22 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 04b156dda9fdcaec6f464fe775103c26-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 0.638
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2106

GET
H2 200 ms.png
nerdinthebrain.com/blue/mg/ 542 B
793 B 672ms
671ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/ms.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 9d5c5fd7edfe78091f468edaeee3fc8e0ac021e6099c96e7a833b4fee1502433

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:22 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 1c32a27aff69b78513fbf7c739f9400c-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 0.603
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 542

GET
H2 200 sud_t.png
nerdinthebrain.com/blue/mg/ 9 KB
9 KB 2698ms
2698ms Image
image/webp 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/blue/mg/sud_t.png
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 8f2acb7a211912e9312a0653a37f40de2ba9d817baf4d0e051b872c8a1e41abc

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
x-hcdn-cache-status: MISS
server: hcdn
x-hcdn-request-id: 0d92ce671cf12affcfa0d16b24abe23c-bnk-edge2
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
x-hcdn-upstream-rt: 2.438
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 8716

GET
H2 206 voice.mp3
nerdinthebrain.com/blue/mg/ 196 KB
197 KB 1032ms
1031ms Media
audio/mpeg 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/blue/mg/voice.mp3

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 01 Aug 2024 19:54:23 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: MISS
last-modified: Mon, 29 Jul 2024 07:44:11 GMT
server: hcdn
etag: "31080-66a7484b-e3d243e66877fa5a;;;"
x-hcdn-request-id: cc6d422a8090b2694841df90d4a98789-bnk-edge2
content-type: audio/mpeg
Content-Range: bytes 0-200831/200832
x-turbo-charged-by: LiteSpeed
x-hcdn-upstream-rt: 0.788
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 200832

GET
H2 206 click.mp3
nerdinthebrain.com/blue/mg/ 8 KB
9 KB 2693ms
2693ms Media
audio/mpeg 2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/blue/mg/click.mp3

Requested by

Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6 , Cyprus, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 01 Aug 2024 19:54:24 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: MISS
last-modified: Mon, 29 Jul 2024 07:44:11 GMT
server: hcdn
etag: "20d5-66a7484b-10373e14e2b902fb;;;"
x-hcdn-request-id: e68d48076d638eca51407f7614a69512-bnk-edge2
content-type: audio/mpeg
Content-Range: bytes 0-8404/8405
x-turbo-charged-by: LiteSpeed
x-hcdn-upstream-rt: 2.213
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 8405

GET
H/1.1 404
The requested content does not exist. stars2.html
cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/images/ 321 B
321 B 95ms
94ms Image
text/html 20.209.226.68
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/images/stars2.html
Requested by: Host: cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.209.226.68 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4fab366110af6eb5ea80772661c9c4f137d6b42a9bc4117f0386e0dc06e1239a

Request headers

Referer: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/?gclid=EAIaIQobChMIjoCJ86rUhwMViYIAAB180xFuEAEYASAAEgIiMfD_BwE
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-request-id: 4750a04f-001e-003d-414c-e4e6e0000000
Date: Thu, 01 Aug 2024 19:54:25 GMT
x-ms-version: 2018-03-28
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound
Content-Length: 321
Content-Type: text/html

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/ 65 KB
66 KB 56ms
38ms Font
font/woff2 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css
Origin: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 19:54:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723
cdn-cachedat: 10/31/2023 18:48:08
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 66624
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: "db812d8a70a4e88e888744c1c9a27e89"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 1f8ddb48d7e1d6848a850993970dc6d6
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8ac86167ac8f660a-AMS
cdn-requestpullsuccess: True

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/blue/mg/kxFy-clip.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/blue/mg/qsbs-firewall.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/blue/mg/s-S4-acc.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/blue/mg/Z5BR-network.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/blue/mg/uZbx-si.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
support.microsoft.com/signin-oidc	1970-01-20 22:29:02	Name: .AspNetCore.OpenIdConnect.Nonce.CfDJ8LWN6nmb9HBGpcIJvpEgkL1c6On7nRV16ruEjF31lcd5fPdSNmuIKsSREXj1xWIeHkli4xqBAx18neRKhNuYk0Mj0pCnRZ5Lis956kQky6KN68uWltr7KINHc_DdpwBrmTmfJt1VzuJ-8Z4uZKR5KBuqF79FdNTbKcopyiwl68B6B8TAL6vuAF9r7aUIwkq_wuof51CDXGqjaKtn0vC4gVvwQPzbGVh54N1rCsiKw3d_62mX_cUtuQuk3xZZv9WmouTSoy4ZnRamNghzI_SoJxs Value: N
support.microsoft.com/	1970-01-21 07:14:38	Name: EXPID Value: 6548f2a9-e5d2-4269-984a-7bab54a52a0e
.windows.net/	1970-01-21 08:05:02	Name: _ga_F9ZFHN0DV3 Value: GS1.1.1722542061.1.0.1722542061.0.0.0
.windows.net/	1970-01-21 08:05:02	Name: _ga Value: GA1.1.509361107.1722542062
support.microsoft.com/	1970-01-21 07:14:38	Name: MicrosoftApplicationsTelemetryDeviceId Value: db60ed58-1a96-46a5-bd13-edb6dba0a873
support.microsoft.com/	1970-01-20 22:29:03	Name: ai_session Value: Hu/+iOpHDssbWTMJQZXc6b\|1722542063419\|1722542063419
login.microsoftonline.com/	1970-01-20 23:12:14	Name: buid Value: 0.AQoAMe_N-B6jSkuT5F9XHpElWhkrJ-4RRD9DjyhcE8tv1AcBAAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMYPaEkzpdIazmvq5k9FG7rLNK_bCRv-fBKg4Dn_RqlkZIlzvpEYdb9RjXF_ZOsDBWLr20aU1HSL7YJz1z02rDM5udLh5TpnMik3OYzHpchnOcgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMYjhaQo6MvAQWD2sKhlM8L0UjojY3V6YbiO3QENlLvdVGqrgMkgYo1ywCgP6pseqKewmajRxSceAIAmrTyxC6Jho35hgcJhcicB5CTOoHSRkQ6C2kpL-8M5-3KCY0dRfLXRGJJcXXnW-a-kJuk1ruPrWGsg3CbmeyPk7-zYu3fflEgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-iTdUWM2bpA Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMY2zeXDnEDgLZUDvnyq1eBOCSkMdtwuvS_F4yuvefbVF3hKmfEq7mZCEWbyHuwV-YNzHjcpQgzOlJaJhlJqoAPdJGopc5cV2lx7Rza4rmoWbeyP-IsCxbFa7xdzPbjnDVRDvV6JF1zWM6HYSFJDEBnCyAA
login.microsoftonline.com/	1970-01-20 23:12:14	Name: fpc Value: Ako5R_URa01Cjl3u09beT_BqwEtIAQAAAO7ePd4OAAAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 3dba9f9648d146f8aa4cf80e71311bbc
.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1722542064&co=1
.microsoft.com/	1970-01-21 07:14:38	Name: MC1 Value: GUID=fac954ff45c04f84acf8a76b01b34db0&HASH=fac9&LV=202408&V=4&LU=1722542066030
.microsoft.com/	1970-01-20 22:29:03	Name: MS0 Value: a566db0fd8884c1fa916bed089322941
support.microsoft.com/	1970-01-21 07:14:38	Name: MSFPC Value: GUID=fac954ff45c04f84acf8a76b01b34db0&HASH=fac9&LV=202408&V=4&LU=1722542066030

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Refused to frame 'https://support.microsoft.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".
network	error	URL: https://cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net/images/stars2.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net
maxcdn.bootstrapcdn.com
nerdinthebrain.com
region1.google-analytics.com
stackpath.bootstrapcdn.com
support.microsoft.com
www.googletagmanager.com
nerdinthebrain.com
20.209.226.68
2001:4860:4802:34::36
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:bb1f
2606:4700::6812:bcf
2a00:1450:4001:831::2008
2a02:26f0:480:bad::f03
2a02:4780:84:6a6c:9cfd:e55a:8a3f:76a6
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
1bf2d147ce393f4dd577d7ce2f03ab5cc1005b84870b567002646977bbcdbb32
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
2487850348dd29c6f7e190529a27dc1ea67a0085eac7a26f6837fe0012ce052e
2857f63364af66a66a12d15d4bf9f536769f489e9080d7a0514b313a771fb161
38966ad4737cccc1ba6d65402250dcc6a0ac3a742dafff6ba5d13455265f0c38
4fab366110af6eb5ea80772661c9c4f137d6b42a9bc4117f0386e0dc06e1239a
64717fb39bb1e506645bf1dcfaed16410737e89c5b8b102a6436bea0c2b18722
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
87e1e97f8193d0c91c59f17dd99254819b70b31f606f7708553a2bb5c39c56e6
8f2acb7a211912e9312a0653a37f40de2ba9d817baf4d0e051b872c8a1e41abc
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
9d5c5fd7edfe78091f468edaeee3fc8e0ac021e6099c96e7a833b4fee1502433
a038ad3e3ed3f8c9ef88625a0ea1b4c31e93bdeb8c847af58532c2e067685cc6
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
ebf0674ce9dbac3587282b46bbfd7ce4340273ef6f02f5240ed2d1087a9700b2
f592af0da41f73df166b2a3ea9605c01559b690e579e1f51c9c3a3d9dc82cb63
f674866044b3bb79ef21edd3ecd89bb0eb849ee2f1439d0ce7e6fc3d5cd9d626
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net Open in urlscan Pro 20.209.226.68 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

27 Requests

81 %HTTPS

89 %IPv6

8 Domains

9 Subdomains

10 IPs

3 Countries

776 kBTransfer

1279 kBSize

17 Cookies

0 Outgoing links

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

31 JavaScript Global Variables

17 Cookies

2 Console Messages

Indicators

cjvu91ht5xm386ze0ld4p7a.z13.web.core.windows.net Open in urlscan Pro
20.209.226.68 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

81 %
HTTPS

89 %
IPv6

8
Domains

9
Subdomains

10
IPs

3
Countries

776 kB
Transfer

1279 kB
Size

17
Cookies

27 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!