embarrassedturkey.build067.wpsandbox.app Open in urlscan Pro
2606:4700:10::6816:4386  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response embarrassedturkey.build067.wpsandbox.app/	41 KB 9 KB	2389ms 2332ms	Document text/html	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 20a0830656faf287ec1b9679d9365a4e479a1fa3364a90f70d8a95ff55196d6f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 781b20d6980d693d-FRA content-encoding br content-type text/html; charset=UTF-8 date Fri, 30 Dec 2022 13:30:10 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server cloudflare vary Accept-Encoding x-hostname gpc067-node4.us-midwest-1.nxcli.net x-robots-tag noindex x-served-by gpc067-node4
GET H2	200	base.min.css embarrassedturkey.build067.wpsandbox.app/index_files/	51 KB 7 KB	56ms 55ms	Stylesheet text/css	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/base.min.css Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57ff8cee5f79f79b415d76d23ecfb07914e0444e26a94ea235ba19877d52c39f Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 920 etag W/"cd3e-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 781b20e53933693d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H2	200	head.min.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	49 KB 17 KB	48ms 47ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/head.min.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 20635aa8cf207ac82070a520fdbf3f844ef9ae7c999c91db504fd803b7436033 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 920 etag W/"c5fd-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e5393c693d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	otBannerSdk.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	360 KB 83 KB	47ms 47ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/otBannerSdk.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d8132d45eef1f2500760399505fc221a79a3bbe60ed797bbc24599a650e69927 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"59e3a-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e63afb9bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	otTCF.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	68 KB 15 KB	39ms 39ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/otTCF.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1f94185bf320b088eb3c40b75de95ac8516680f4036bd287131b34f9c058146a Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"10f59-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e6dc209bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	12.min.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	7 KB 2 KB	39ms 39ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/12.min.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8f6027df76869bcf85757198a6bfc51eca661444397cdfcc253d1b42d9034df4 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"1c82-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e71c8b9bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	2.min.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	42 KB 13 KB	38ms 37ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/2.min.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d55afcb64e0394325da2c5012e194bcd0b811a93a2d8138fcbcd62c2bdd11eee Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 2563 etag W/"a6ab-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e75ce09bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	lux.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	18 KB 7 KB	48ms 48ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/lux.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1868c515b30fd94d465e6343ee752707dd9f294790a68e81d6aff0b740a13171 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Origin https://embarrassedturkey.build067.wpsandbox.app accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"47a5-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e77d0f9bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	gpt.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	82 KB 28 KB	45ms 45ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/gpt.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3987978932c757ba48c8f547b257786b5e6cf124813111da653e58c46dee7872 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"146b9-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e77d119bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H3	200	pubads_impl_2022071401.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	377 KB 127 KB	64ms 62ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/pubads_impl_2022071401.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe7bd8cacf9680625b7da9649a92bee8ab705909190040bad2396b2d6ca9436e Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare age 1126 etag W/"5e359-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e77d159bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H2	200	f.txt Show response embarrassedturkey.build067.wpsandbox.app/index_files/	107 B 206 B	158ms 158ms	Script text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/f.txt Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status DYNAMIC last-modified Sun, 17 Jul 2022 14:17:54 GMT server cloudflare etag W/"6b-5e400eacd2880" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/plain x-robots-tag noindex cf-ray 781b20e53943693d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H2	200	f(1).txt Show response embarrassedturkey.build067.wpsandbox.app/index_files/	210 B 246 B	361ms 360ms	Script text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/f(1).txt Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 442f8504927c54cdfd132124b08fe51c84bdf36ce82cf4c8b61c0e79b24ad138 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status DYNAMIC last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare etag W/"d2-5e400eaebad00" vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/plain x-robots-tag noindex cf-ray 781b20e53944693d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	0.min.js Show response embarrassedturkey.build067.wpsandbox.app/index_files/	66 KB 21 KB	46ms 44ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/0.min.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1f001a3c1cd0fd92c0c62af15c79070aab3182fe5de82ec17d80f04b6187b802 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare age 1126 etag W/"108ca-5e400eaebad00" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type application/javascript x-robots-tag noindex cf-ray 781b20e77d169bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H2	200	header.min.css embarrassedturkey.build067.wpsandbox.app/index_files/	62 KB 10 KB	58ms 58ms	Stylesheet text/css	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/header.min.css Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9716b689c64d0366f1a86573b15b50f25b5ed54e2eff6021bee345cb6f6f2e1e Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br cf-cache-status HIT last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare age 920 etag W/"f7c6-5e400eaebad00" vary Accept-Encoding x-hostname gpc067-node2.us-midwest-1.nxcli.net content-type text/css x-robots-tag noindex cf-ray 781b20e53937693d-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node2
GET H2	200	images encrypted-tbn0.gstatic.com/	2 KB 3 KB	76ms 21ms	Image image/png	2a00:1450:4001:806::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcScja8EW4PSt2ay-0oJAKt6aDQ00rVhyOxOTg&usqp=CAU Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d5a335190307402516082d0274bde12fa482d20ce04da3a36f79296b244509e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 03:23:50 GMT x-content-type-options nosniff age 36380 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2059 x-xss-protection 0 last-modified Sat, 17 Aug 2019 00:34:41 GMT server sffe report-to {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="images-tbn" expires Sat, 30 Dec 2023 03:23:50 GMT
GET H2	200	button-anmelden-mit-swisspass.png i.ibb.co/rvJSbmd/	4 KB 4 KB	87ms 27ms	Image image/png	162.19.58.161 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/rvJSbmd/button-anmelden-mit-swisspass.png Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.161 , France, ASN16276 (OVH, FR), Reverse DNS ns3096669.ip-162-19-58.eu Software nginx / Resource Hash 2935f6cbdebc3fdf2a3807e29d6cb7c47ae93ab1b509f9c8fec2f61bd524abd0 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT last-modified Sun, 17 Jul 2022 18:01:43 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 3957 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	button-anmelden-mit-swissid.png i.ibb.co/GFpD5vY/	4 KB 4 KB	87ms 27ms	Image image/png	162.19.58.161 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/GFpD5vY/button-anmelden-mit-swissid.png Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.161 , France, ASN16276 (OVH, FR), Reverse DNS ns3096669.ip-162-19-58.eu Software nginx / Resource Hash bd640fb21af72b1ef707112f2b83238f8a6bec2a585fdc40da41c9346eecb4bd Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT last-modified Sun, 17 Jul 2022 18:03:53 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 3803 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	197560.png cdn-icons-png.flaticon.com/512/197/	16 KB 16 KB	92ms 21ms	Image image/png	2a02:26f0:3500:28a::312e AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-icons-png.flaticon.com/512/197/197560.png Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:28a::312e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 0d075f82e2b4f4fa762101ae95488a425d2df9f40c5b7e120954509c635879bf Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT x-goog-metageneration 1 x-goog-stored-content-encoding identity content-length 16395 pragma public last-modified Mon, 14 Feb 2022 13:03:22 GMT etag "a7d33e1998b1eee77ff4bf6a742be232" vary Accept-Encoding x-goog-generation 1644843802225542 content-type image/png access-control-allow-origin * x-default-rule YES cache-control public, max-age=31536000 x-goog-stored-content-length 16395 accept-ranges bytes expires Fri, 30 Dec 2022 13:30:10 GMT
GET H2	200	197374.png cdn-icons-png.flaticon.com/512/197/	19 KB 19 KB	92ms 21ms	Image image/png	2a02:26f0:3500:28a::312e AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-icons-png.flaticon.com/512/197/197374.png Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:28a::312e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 16d2af8dfe6bff63fd76dc7434e09f1c98de85b1aa8d35ab98b473bae3c1f97d Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT x-goog-metageneration 1 x-goog-stored-content-encoding identity content-length 19575 pragma public last-modified Mon, 14 Feb 2022 12:57:10 GMT etag "aac0dfefc080856931658ea9c760534e" vary Accept-Encoding x-goog-generation 1644843430369436 content-type image/png access-control-allow-origin * x-default-rule YES cache-control public, max-age=31536000 x-goog-stored-content-length 19575 accept-ranges bytes expires Fri, 30 Dec 2022 13:30:10 GMT
GET H2	200	197571.png cdn-icons-png.flaticon.com/512/197/	11 KB 12 KB	89ms 18ms	Image image/png	2a02:26f0:3500:28a::312e AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://cdn-icons-png.flaticon.com/512/197/197571.png Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:28a::312e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 9ead1bc194a3a01035de7f65160c91b32604d2c788b35a914543c34ef451cd3a Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT x-goog-metageneration 1 x-goog-stored-content-encoding identity content-length 11636 pragma public last-modified Mon, 14 Feb 2022 13:04:10 GMT etag "85ca59c60c9179d7b3e9b6ab03b407c7" vary Accept-Encoding x-goog-generation 1644843850044869 content-type image/png access-control-allow-origin * x-default-rule YES cache-control public, max-age=31536000 x-goog-stored-content-length 11636 accept-ranges bytes expires Fri, 30 Dec 2022 13:30:10 GMT
GET H3	200	aframe.html Show response embarrassedturkey.build067.wpsandbox.app/index_files/ Frame 8ACD	2 KB 1 KB	354ms 354ms	Document text/html	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/aframe.html Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1e325c9818fb3e25e959b15fb63e7116f0e8f0ea5e89f93f7fa7e031dcf1ecf0 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 781b20e77d199bd7-FRA content-encoding br content-type text/html date Fri, 30 Dec 2022 13:30:10 GMT last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net x-robots-tag noindex x-served-by gpc067-node1
GET H3	200	saved_resource(1).html Show response embarrassedturkey.build067.wpsandbox.app/index_files/ Frame 277D	2 KB 1 KB	357ms 357ms	Document text/html	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/saved_resource(1).html Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c52c901cebf06a85cb3d58e3c83b0f3677f41073942125fe16d49f45d4a19256 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 781b20e77d1e9bd7-FRA content-encoding br content-type text/html date Fri, 30 Dec 2022 13:30:10 GMT last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare vary Accept-Encoding x-hostname gpc067-node1.us-midwest-1.nxcli.net x-robots-tag noindex x-served-by gpc067-node1
GET H2	200	SBBWeb-Thin.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 15 KB	111ms 44ms	Font application/font-woff2	18.193.62.132 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Thin.woff2 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/base.min.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.193.62.132 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-193-62-132.eu-central-1.compute.amazonaws.com Software nginx/1.23.2 / Resource Hash d54c676681d2c4e3b931e77908b1345441a0cf6e8f2339d4d3a56c1083aab7e6 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Origin https://embarrassedturkey.build067.wpsandbox.app accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br last-modified Fri, 17 Dec 2021 15:16:26 GMT server nginx/1.23.2 etag W/"61bca9ca-3900" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Sat, 30 Dec 2023 13:30:10 GMT
GET H2	200	SBBWeb-Roman.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 14 KB	129ms 63ms	Font application/font-woff2	18.193.62.132 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Roman.woff2 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/base.min.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.193.62.132 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-193-62-132.eu-central-1.compute.amazonaws.com Software nginx/1.23.2 / Resource Hash 966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Origin https://embarrassedturkey.build067.wpsandbox.app accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br last-modified Fri, 17 Dec 2021 15:16:26 GMT server nginx/1.23.2 etag W/"61bca9ca-3748" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Sat, 30 Dec 2023 13:30:10 GMT
GET H2	200	SBBWeb-Bold.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 15 KB	108ms 42ms	Font application/font-woff2	18.193.62.132 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Bold.woff2 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/base.min.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.193.62.132 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-193-62-132.eu-central-1.compute.amazonaws.com Software nginx/1.23.2 / Resource Hash f069a80a8f0838dc76f55359c8599ee04d3c66004c6513de7cbf382df4bb59e2 Request headers Referer https://embarrassedturkey.build067.wpsandbox.app/ Origin https://embarrassedturkey.build067.wpsandbox.app accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br last-modified Fri, 17 Dec 2021 15:16:26 GMT server nginx/1.23.2 etag W/"61bca9ca-37c0" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Sat, 30 Dec 2023 13:30:10 GMT
GET H3	200	invisible.js Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame F6EE	34 KB 14 KB	60ms 59ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79304637d1f577985d5617ae2d147fe711e1fac3d0869bd25182bce95791a841 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20e79d5c9bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	pubads_impl_2022071201.js Show response securepubads.g.doubleclick.net/gpt/	376 KB 129 KB	68ms 21ms	Script text/javascript	2a00:1450:4001:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022071201.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43e3aeb3dab72706d6e3a315dce4f4e3af17c85c35966aaa26ff8850ce4ddde9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sun, 25 Dec 2022 19:35:14 GMT content-encoding gzip x-content-type-options nosniff age 410096 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 131230 x-xss-protection 0 last-modified Tue, 12 Jul 2022 08:35:46 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control public, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 25 Dec 2023 19:35:14 GMT
GET H2	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	62 B 692 B	102ms 56ms	XHR application/json	2a00:1450:4001:802::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=embarrassedturkey.build067.wpsandbox.app Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 22e07c859873d96f57297df4491d4edb902ad09300f4bb97e80060b3d40246f0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br x-content-type-options nosniff server cafe content-type application/json; charset=UTF-8 access-control-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 57 x-xss-protection 0 expires Fri, 30 Dec 2022 13:30:10 GMT
GET H3	200	pica.js embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/ Frame F6EE	20 KB 8 KB	30ms 30ms	Other application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c90b18adcbc2c3323232fedf4b55393c64690966a2563112952b57fac6c8ec0e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20e82e319bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	781b20d6980d693d Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/ Frame F6EE	2 B 383 B	41ms 40ms	XHR text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/781b20d6980d693d Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/json Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare cf-ray 781b20e9f9659bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type text/plain; charset=UTF-8
GET H3	200	sodar embarrassedturkey.build067.wpsandbox.app/index_files/ Frame 8ACD	0 234 B	149ms 149ms	Image text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://embarrassedturkey.build067.wpsandbox.app/index_files/sodar Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/aframe.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://embarrassedturkey.build067.wpsandbox.app/index_files/aframe.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:11 GMT cf-cache-status DYNAMIC last-modified Sun, 17 Jul 2022 14:17:56 GMT server cloudflare etag "0-5e400eaebad00" x-hostname gpc067-node1.us-midwest-1.nxcli.net content-type text/plain accept-ranges bytes x-robots-tag noindex cf-ray 781b20ea097f9bd7-FRA content-length 0 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by gpc067-node1
GET H3	200	invisible.js Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 91F8	35 KB 14 KB	29ms 29ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff699aa30d7ea4b77fab61d6f459e7f601f3171ba2f8c2ba95d863a3cecab726 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20ea29c19bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	invisible.js Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame DA1F	35 KB 15 KB	28ms 28ms	Script application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4a9817cc78942ee41c00417aa8d16852562979f3dfe1ea5484f18d65f376ccc3 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20ea29c69bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	pica.js embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/ Frame 91F8	19 KB 8 KB	29ms 28ms	Other application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/index_files/aframe.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b280e5491d2e0c1ec3b29e619da6666f78703539c1edd5e89fad5f470a723171 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20ea6a3e9bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	pica.js embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/ Frame DA1F	22 KB 9 KB	33ms 32ms	Other application/javascript	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5441e4d6f77e590c74db48bd256a418ddb023946800daa41d1a2ffa22623ff7 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 30 Dec 2022 13:30:10 GMT content-encoding br server cloudflare vary accept-encoding content-type application/javascript; charset=UTF-8 cache-control max-age=14400, public x-control-type-options nosniff x-robots-tag noindex cf-ray 781b20ea6a419bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	781b20e77d1e9bd7 Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/ Frame DA1F	2 B 384 B	45ms 44ms	XHR text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/781b20e77d1e9bd7 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/json Response headers date Fri, 30 Dec 2022 13:30:11 GMT content-encoding br server cloudflare cf-ray 781b20ec4d409bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type text/plain; charset=UTF-8
POST H3	200	781b20e77d199bd7 Show response embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 91F8	2 B 383 B	48ms 48ms	XHR text/plain	2606:4700:10::6816:4386 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/cv/result/781b20e77d199bd7 Requested by Host: embarrassedturkey.build067.wpsandbox.app URL: https://embarrassedturkey.build067.wpsandbox.app/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1672401600 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:4386 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/json Response headers date Fri, 30 Dec 2022 13:30:11 GMT content-encoding br server cloudflare cf-ray 781b20ef0a779bd7-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type text/plain; charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| oncontentvisibilityautostatechange object| lazySizesConfig object| lazySizes object| Modernizr object| estatico function| sbbAdsInit object| otTCF object| otIabModule object| googletag object| ggeac object| google_tag_data object| google_js_reporting_queue object| LUX undefined| google_measure_js_timing

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			embarrassedturkey.build067.wpsandbox.app/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2e9daf69d9038aefc02b1653a364c35d
			embarrassedturkey.build067.wpsandbox.app/	1970-01-20 08:33:28	Name: lux_uid Value: 167240701053242331
			.wpsandbox.app/	1970-01-20 08:33:28	Name: __cf_bm Value: 7v.FAV3doeWdN00g0MU5qXDN.yn2mQdU45yzxdtUptY-1672407011-0-AQMO92SXH78RcAafrd4Jgmz/oG2lo5Qn4qDHLGZ7rFOhJcd5lghey0JwhthEkLS5fLBqzVD2MY3lCCt7CUzeDewP2tSmQosqkgz30LQXXYTvjOCeOlaaLU0Hxikm7CEWoYSabho0/j7io18XCfCCTMo=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-icons-png.flaticon.com
cdn.app.sbb.ch
embarrassedturkey.build067.wpsandbox.app
encrypted-tbn0.gstatic.com
i.ibb.co
securepubads.g.doubleclick.net
162.19.58.161
18.193.62.132
2606:4700:10::6816:4386
2a00:1450:4001:802::2002
2a00:1450:4001:806::200e
2a02:26f0:3500:28a::312e
0d075f82e2b4f4fa762101ae95488a425d2df9f40c5b7e120954509c635879bf
16d2af8dfe6bff63fd76dc7434e09f1c98de85b1aa8d35ab98b473bae3c1f97d
1868c515b30fd94d465e6343ee752707dd9f294790a68e81d6aff0b740a13171
1e325c9818fb3e25e959b15fb63e7116f0e8f0ea5e89f93f7fa7e031dcf1ecf0
1f001a3c1cd0fd92c0c62af15c79070aab3182fe5de82ec17d80f04b6187b802
1f94185bf320b088eb3c40b75de95ac8516680f4036bd287131b34f9c058146a
20635aa8cf207ac82070a520fdbf3f844ef9ae7c999c91db504fd803b7436033
20a0830656faf287ec1b9679d9365a4e479a1fa3364a90f70d8a95ff55196d6f
22e07c859873d96f57297df4491d4edb902ad09300f4bb97e80060b3d40246f0
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2935f6cbdebc3fdf2a3807e29d6cb7c47ae93ab1b509f9c8fec2f61bd524abd0
3987978932c757ba48c8f547b257786b5e6cf124813111da653e58c46dee7872
43e3aeb3dab72706d6e3a315dce4f4e3af17c85c35966aaa26ff8850ce4ddde9
442f8504927c54cdfd132124b08fe51c84bdf36ce82cf4c8b61c0e79b24ad138
4a9817cc78942ee41c00417aa8d16852562979f3dfe1ea5484f18d65f376ccc3
57ff8cee5f79f79b415d76d23ecfb07914e0444e26a94ea235ba19877d52c39f
79304637d1f577985d5617ae2d147fe711e1fac3d0869bd25182bce95791a841
8f6027df76869bcf85757198a6bfc51eca661444397cdfcc253d1b42d9034df4
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997
9716b689c64d0366f1a86573b15b50f25b5ed54e2eff6021bee345cb6f6f2e1e
9ead1bc194a3a01035de7f65160c91b32604d2c788b35a914543c34ef451cd3a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b280e5491d2e0c1ec3b29e619da6666f78703539c1edd5e89fad5f470a723171
bd640fb21af72b1ef707112f2b83238f8a6bec2a585fdc40da41c9346eecb4bd
c52c901cebf06a85cb3d58e3c83b0f3677f41073942125fe16d49f45d4a19256
c90b18adcbc2c3323232fedf4b55393c64690966a2563112952b57fac6c8ec0e
d5441e4d6f77e590c74db48bd256a418ddb023946800daa41d1a2ffa22623ff7
d54c676681d2c4e3b931e77908b1345441a0cf6e8f2339d4d3a56c1083aab7e6
d55afcb64e0394325da2c5012e194bcd0b811a93a2d8138fcbcd62c2bdd11eee
d5a335190307402516082d0274bde12fa482d20ce04da3a36f79296b244509e4
d8132d45eef1f2500760399505fc221a79a3bbe60ed797bbc24599a650e69927
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f069a80a8f0838dc76f55359c8599ee04d3c66004c6513de7cbf382df4bb59e2
fe7bd8cacf9680625b7da9649a92bee8ab705909190040bad2396b2d6ca9436e
ff699aa30d7ea4b77fab61d6f459e7f601f3171ba2f8c2ba95d863a3cecab726