urlscan.io logo urlscan.io
SecurityTrails logo

document-file.secure-autth.workers.dev Open in urlscan Pro
172.67.171.89  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://document-file.secure-autth.workers.dev/
Effective URL: https://document-file.secure-autth.workers.dev/
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On October 29 via api from IT — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 3 countries across 10 domains to perform 21 HTTP transactions. The main IP is 172.67.171.89, located in United States and belongs to CLOUDFLARENET, US. The main domain is document-file.secure-autth.workers.dev.
TLS certificate: Issued by WE1 on October 18th 2024. Valid for: 3 months.
This is the only time document-file.secure-autth.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer) Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
1 7 172.67.171.89 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a04:4e42:400... 54113 (FASTLY)
2 104.18.10.207 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 205.153.158.10 6492 (PCCD)
1 104.17.25.14 13335 (CLOUDFLAR...)
2 172.67.139.119 13335 (CLOUDFLAR...)
21 11
7    172.67.171.89 (United States)

ASN13335 (CLOUDFLARENET, US)
document-file.secure-autth.workers.dev
1    2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com
2    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
encrypted-tbn0.gstatic.com
1    205.153.158.10 (Poway, United States)

ASN6492 (PCCD, US)
PTR: www.palomar.edu
www.palomar.edu
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    172.67.139.119 (United States)

ASN13335 (CLOUDFLARENET, US)
ka-f.fontawesome.com
Apex Domain
Subdomains		 Transfer
7 workers.dev
document-file.secure-autth.workers.dev
1 MB
3 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1955
ka-f.fontawesome.com — Cisco Umbrella Rank: 5838
24 KB
2 gstatic.com
encrypted-tbn0.gstatic.com
11 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1113
39 KB
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 791
53 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412
fonts.googleapis.com — Cisco Umbrella Rank: 30
31 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
7 KB
1 palomar.edu
www.palomar.edu — Cisco Umbrella Rank: 435131
6 KB
0 arizona.edu Failed
uara.arizona.edu Failed
0 web.app Failed
runn1rnl8xzmqeh0kvov.web.app Failed
21 10
Domain Requested by
7 document-file.secure-autth.workers.dev 1 redirects document-file.secure-autth.workers.dev
2 ka-f.fontawesome.com kit.fontawesome.com
2 encrypted-tbn0.gstatic.com document-file.secure-autth.workers.dev
2 maxcdn.bootstrapcdn.com document-file.secure-autth.workers.dev
2 code.jquery.com document-file.secure-autth.workers.dev
1 cdnjs.cloudflare.com document-file.secure-autth.workers.dev
1 www.palomar.edu document-file.secure-autth.workers.dev
1 kit.fontawesome.com document-file.secure-autth.workers.dev
1 fonts.googleapis.com document-file.secure-autth.workers.dev
1 ajax.googleapis.com document-file.secure-autth.workers.dev
0 uara.arizona.edu Failed document-file.secure-autth.workers.dev
0 runn1rnl8xzmqeh0kvov.web.app Failed document-file.secure-autth.workers.dev
21 12

This site contains no links.

Subject Issuer Validity Valid
secure-autth.workers.dev
WE1		 2024-10-18 -
2025-01-16		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
*.fontawesome.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-07-30 -
2025-01-27		 6 months crt.sh
*.gstatic.com
WR2		 2024-10-07 -
2024-12-30		 3 months crt.sh
www.palomar.edu
InCommon RSA Server CA 2		 2024-07-22 -
2025-08-22		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
ka-f.fontawesome.com
WE1		 2024-10-27 -
2025-01-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://document-file.secure-autth.workers.dev/
Frame ID: 9DC99A53CD98FF2E25B8E0EC11BF71AC
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Share Point Online

Page URL History Show full URLs

  1. http://document-file.secure-autth.workers.dev/ HTTP 307
    https://document-file.secure-autth.workers.dev/ Page URL
  2. https://document-file.secure-autth.workers.dev/cdn-cgi/phish-bypass?atok=E9BxERx.QBM8qghNfI6r8Q7u5oPU1FKGdJUNeNVOTRE-173021... HTTP 301
    https://document-file.secure-autth.workers.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

90 %
HTTPS

50 %
IPv6

10
Domains

12
Subdomains

11
IPs

3
Countries

1595 kB
Transfer

4611 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://document-file.secure-autth.workers.dev/ HTTP 307
    https://document-file.secure-autth.workers.dev/ Page URL
  2. https://document-file.secure-autth.workers.dev/cdn-cgi/phish-bypass?atok=E9BxERx.QBM8qghNfI6r8Q7u5oPU1FKGdJUNeNVOTRE-1730211243-0.0.1.1-%2F HTTP 301
    https://document-file.secure-autth.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://document-file.secure-autth.workers.dev/ HTTP 307
  • https://document-file.secure-autth.workers.dev/

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
document-file.secure-autth.workers.dev/
Redirect Chain
  • http://document-file.secure-autth.workers.dev/
  • https://document-file.secure-autth.workers.dev/
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5e9428829ef896fc695fac76770129ca9ad35314317ad97bcc44c2a013e7ef2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray
8da3c50f88e7e1d4-MRS
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 29 Oct 2024 14:14:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JdQLkmhM4wQfIwcFwfhLwwsfO86w2nOliKQp7%2F7Loq0931kH6DQEZOSu8rkc1NkULMaaSh23A6dNI03hEHOf95MWMhXQSYuvY52QEjfj75GbGUYfrPkbMzAmE9suScA55f2NEtgzRZLIoqLtW7j1WsgLSuW3uRFB%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://document-file.secure-autth.workers.dev/
Non-Authoritative-Reason
HSTS
cf.errors.css
document-file.secure-autth.workers.dev/cdn-cgi/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://document-file.secure-autth.workers.dev/cdn-cgi/styles/cf.errors.css
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
content-encoding
gzip
etag
W/"67180f5f-5df3"
x-content-type-options
nosniff
cf-ray
8da3c50fda30e1d4-MRS
expires
Tue, 29 Oct 2024 16:14:03 GMT
date
Tue, 29 Oct 2024 14:14:03 GMT
content-type
text/css
last-modified
Tue, 22 Oct 2024 20:47:27 GMT
server
cloudflare
x-frame-options
DENY
icon-exclamation.png
document-file.secure-autth.workers.dev/cdn-cgi/images/ 		452 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://document-file.secure-autth.workers.dev/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/cdn-cgi/styles/cf.errors.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
etag
"67180f5f-1c4"
x-content-type-options
nosniff
cf-ray
8da3c5101b27e1d4-MRS
expires
Tue, 29 Oct 2024 16:14:03 GMT
accept-ranges
bytes
content-length
452
date
Tue, 29 Oct 2024 14:14:03 GMT
content-type
image/png
last-modified
Tue, 22 Oct 2024 20:47:27 GMT
server
cloudflare
x-frame-options
DENY
favicon.ico
document-file.secure-autth.workers.dev/ 		1 MB
472 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://document-file.secure-autth.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7a714b32bf10eebe9f9d39530a838eed4a2921f1e144f189c9d06ee9b0ac405

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sbVK0dahdfzWnAOaIp7vNZHnYwoOrmrQ16KkxrxJRhkGE5OdKsMD%2FBJWQBCP1%2FCgAS7sPwlqHN7gPC3Ih0SWBLwCBarLC0epatGmj8O0gjxFXVeiyNnmyPsRJE4%2FBf2lIYVwdMRzusbJGZhqv%2FJGHgfGTRKeckPcKg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8da3c5104c1ce1d4-MRS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=36997&sent=21&recv=15&lost=0&retrans=0&sent_bytes=11955&recv_bytes=5734&delivery_rate=18621&cwnd=12000&unsent_bytes=0&cid=2c90323a9a29046c&ts=231&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 29 Oct 2024 14:14:03 GMT
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
Primary Request /
document-file.secure-autth.workers.dev/
Redirect Chain
  • https://document-file.secure-autth.workers.dev/cdn-cgi/phish-bypass?atok=E9BxERx.QBM8qghNfI6r8Q7u5oPU1FKGdJUNeNVOTRE-1730211243-0.0.1.1-%2F
  • https://document-file.secure-autth.workers.dev/
1 MB
472 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7a714b32bf10eebe9f9d39530a838eed4a2921f1e144f189c9d06ee9b0ac405

Request headers

Referer
https://document-file.secure-autth.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
8da3c52f9e7fe1d4-MRS
content-encoding
br
content-type
text/html;charset=UTF-8
date
Tue, 29 Oct 2024 14:14:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=55lwRSau4g6Q%2FgMpjIsDVIBTos94Kr53RRttZoGzTIyGY%2Bwf0dKckFaqcr6xCA%2BJvyVYph%2B9D6y%2Bf7Fi8gUCfckRBAzJBcb%2Bg2WT5vc0By8XeZUAChgIRkJi%2B%2Bbh%2FxbOCp0gd54g6UGfu4dpaWIHAG8d5LJQWN918Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=29882&sent=438&recv=95&lost=0&retrans=0&sent_bytes=507006&recv_bytes=10187&delivery_rate=13604&cwnd=314400&unsent_bytes=0&cid=2c90323a9a29046c&ts=5180&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding

Redirect headers

cache-control
private, no-cache
cf-ray
8da3c52f5d90e1d4-MRS
content-length
167
content-type
text/html
date
Tue, 29 Oct 2024 14:14:08 GMT
location
https://document-file.secure-autth.workers.dev/
server
cloudflare
x-content-type-options
nosniff
x-frame-options
DENY
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://document-file.secure-autth.workers.dev/

Response headers

content-encoding
gzip
age
25497
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 29 Oct 2025 07:09:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 29 Oct 2024 07:09:15 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://document-file.secure-autth.workers.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-152b5"
age
4330968
x-cache
HIT, HIT
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
3256, 34271
x-served-by
cache-lga21947-LGA, cache-mxp6950-MXP
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1730211252.411443,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30070
server
nginx
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ 		141 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://document-file.secure-autth.workers.dev
Referer
https://document-file.secure-autth.workers.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
MISS
etag
W/"450fc463b8b1a349df717056fbb3e078"
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Tue, 29 Oct 2024 14:14:12 GMT
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
03/18/2024 12:51:41
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8d6b18cdfaa6c423d949c26531a19e0a
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8da3c5476ff0374d-MXP
access-control-allow-origin
*
cdn-edgestorageid
1048
server
cloudflare
cdn-requestcountrycode
US
css
fonts.googleapis.com/ 		414 B
764 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
99cf92a13d4084fd8068b07cc5a30b5edb47294825027bfb41ae10a57539bfa5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Tue, 29 Oct 2024 14:14:12 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Tue, 29 Oct 2024 14:14:12 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
585b051251.js
kit.fontawesome.com/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/585b051251.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4af9396941a1b0beff198e0476f96364688a97b639e19f7ed7af883c54a4b22c

Request headers

Origin
https://document-file.secure-autth.workers.dev
Referer
https://document-file.secure-autth.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

access-control-max-age
3000
x-request-id
GALx95PoTEWen6wzgzvi
cache-control
max-age=60, public, stale-while-revalidate=30
content-encoding
gzip
cf-cache-status
MISS
access-control-allow-methods
GET, OPTIONS
cf-ray
8da3c547984b4bf1-MXP
access-control-allow-origin
*
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
text/javascript
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
server
cloudflare
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
hover.css
runn1rnl8xzmqeh0kvov.web.app/ucspqsuf8bxoiymvvdy5p6pp9uzvyqj/ 		0
0
images
encrypted-tbn0.gstatic.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRXEBTuV-waHkBgBSkV12zVhE71l3puQyga-XRFk7tshkCnN_t2Bc8FJzFUMzSggMH3I5g&usqp=CAU
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fe409b82972ac111723679bdd7560825e09ecc9f2cebb762062f0debd6ccd0b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

age
82281
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options
nosniff
expires
Tue, 28 Oct 2025 15:22:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 28 Oct 2024 15:22:51 GMT
last-modified
Thu, 29 Aug 2019 20:21:35 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
content-length
6409
x-xss-protection
0
server
sffe
office-365_256x256.png
www.palomar.edu/atrc/wp-content/uploads/sites/3/2015/01/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.palomar.edu/atrc/wp-content/uploads/sites/3/2015/01/office-365_256x256.png
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.153.158.10 Poway, United States, ASN6492 (PCCD, US),
Reverse DNS
www.palomar.edu
Software
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips /
Resource Hash
2428dc59e50ba1275855df40a0e2c94180fc16cfd9780e2da324977fc0269ddf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

ETag
"1707-5c5e8b04ac762"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5895
Keep-Alive
timeout=5, max=100
Date
Tue, 29 Oct 2024 14:14:13 GMT
Last-Modified
Tue, 29 Jun 2021 14:47:44 GMT
Content-Type
image/png
Server
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips
Email%20icon.png
uara.arizona.edu/sites/default/files/styles/az_card_image/public/2021-12/ 		0
0
images
encrypted-tbn0.gstatic.com/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSYoaTYJflBPn6wW0hkuPHtzLBmsq-IrqYUjjJb-3CkzQahkDGOQgjvktbm8falSL3Pxy8&usqp=CAU
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d731f0696eb6b81aed66210f7b2caf1cd18e888386a0bfaa3168dfb87f958855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

age
47236
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options
nosniff
expires
Wed, 29 Oct 2025 01:06:56 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 29 Oct 2024 01:06:56 GMT
last-modified
Wed, 14 Aug 2019 11:48:03 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
content-length
4242
x-xss-protection
0
server
sffe
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Origin
https://document-file.secure-autth.workers.dev
Referer
https://document-file.secure-autth.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-10fdd"
age
3482523
x-cache
HIT, HIT
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
159189, 17672
x-served-by
cache-lga21984-LGA, cache-mxp6976-MXP
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1730211252.416327,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
23856
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://document-file.secure-autth.workers.dev
Referer
https://document-file.secure-autth.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-4af4"
age
424731
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ADWJ8QFFiE6y26qEWSsQSo3uKdgIhvrWAxLxfC4Fiw2i7e6yUyG0obOqpphV8I1hUVQMgjeRbgNkYMO1YMiH7kbADOwLaNYphCEEznryHhmwNXInUcoPiFDQzcFkNC3DGMtk%2BzN%2B"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sun, 19 Oct 2025 14:14:12 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8da3c547699d0e41-MXP
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: document-file.secure-autth.workers.dev
URL: https://document-file.secure-autth.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://document-file.secure-autth.workers.dev
Referer
https://document-file.secure-autth.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
MISS
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
date
Tue, 29 Oct 2024 14:14:12 GMT
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
03/18/2024 12:46:36
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
2b2ee1601f55cfa4b6fec58ea1284a14
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8da3c5476fec374d-MXP
access-control-allow-origin
*
cdn-edgestorageid
1048
server
cloudflare
cdn-requestcountrycode
US
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		59 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/585b051251.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

access-control-max-age
3000
content-encoding
gzip
cf-cache-status
MISS
etag
W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JirWesI16qe2j9CW3UYyqyzYRGtS1KBGlP1qLKJ35geoqm%2F1xazxqPSsxkNrZa12U8Jc5%2FdHs%2FmrEFFQdiSCFilunyivxdW00dY9jLiaI7IpwDNFhMA8%2BbxuOqQzbOpa3MEZwo6hYw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
QdQ6Q9r2ev1Sg-RDh6c-2xkC8xLgX7TfptKfOsU-6ZTn_RarOvOORA==
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
text/css
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
vary
Accept-Encoding
priority
u=1,i
access-control-allow-headers
fa-kit-token
server-timing
cfL4;desc="?proto=QUIC&rtt=60275&sent=16&recv=8&lost=0&retrans=0&sent_bytes=9436&recv_bytes=4721&delivery_rate=55356&cwnd=12000&unsent_bytes=0&cid=f8a62a42d6656ae9&ts=118&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control
max-age=31556926
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 4eac31fa332b238427dad87ea3716264.cloudfront.net (CloudFront)
cf-ray
8da3c5496f6e3cbd-CDG
access-control-allow-origin
*
x-amz-cf-pop
CDG52-P2
server
cloudflare
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		26 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/585b051251.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.139.119 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

access-control-max-age
3000
content-encoding
gzip
cf-cache-status
MISS
etag
W/"76f34b71fc9fb641507ff6a822cc07f5"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cr%2BzjtBu%2FhXA%2FRWxVwC5qqMwVkpny%2FzptT8KTBNUVOWvlHY3Sgc7bpweUh8nrqSRmSmCcPTDZyhz2rOhhsIuvlVzWsu13DFVCNqbn98Sj56D%2BJzDgwe6XxUuIJmDyR3dbZqFqdyiag%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
Oanyr33S050Pkz7KKcDqa0SlYaBRRf4ufeeUOtuABcu97rbgegjunA==
date
Tue, 29 Oct 2024 14:14:12 GMT
content-type
text/css
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
vary
Accept-Encoding
priority
u=1,i
access-control-allow-headers
fa-kit-token
server-timing
cfL4;desc="?proto=QUIC&rtt=60275&sent=11&recv=8&lost=0&retrans=0&sent_bytes=4186&recv_bytes=4721&delivery_rate=55356&cwnd=12000&unsent_bytes=0&cid=f8a62a42d6656ae9&ts=117&x=1", cfExtPri, cfHdrFlush;dur=0
cache-control
max-age=31556926
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
via
1.1 d9724ab1ffbd159e13ec0a9fda972d3e.cloudfront.net (CloudFront)
cf-ray
8da3c5496f703cbd-CDG
access-control-allow-origin
*
x-amz-cf-pop
LHR5-P6
server
cloudflare
truncated
/ 		26 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6ac743e9cf0f854b6a5cf7ba8b60ff336e77b612975bf1692163b7ec738e0600

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/jpg
truncated
/ 		144 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1515bc37b1739d942f9e3f99dd14d5021910b1b061ba3b3169ee88246d4f8cf6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/jpg
favicon.ico
document-file.secure-autth.workers.dev/ 		1 MB
472 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://document-file.secure-autth.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.171.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7a714b32bf10eebe9f9d39530a838eed4a2921f1e144f189c9d06ee9b0ac405

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://document-file.secure-autth.workers.dev/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YE2Qe5fJVkhxZrkeGUh%2F9SQQT2uvOYUunMsGNaF2BZOJLZLzP1LRkMf%2BNHOTZwr7QYxkR2sXkgYTQ9RGwMLCBUfjyp6Wkh8BOPd8PREQLgBkL3hIz3b7P842PasbzKHoNlAyqwhkSiVAsZZSoMVftoTqwAhYIPrT1w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8da3c54c4e19e1d4-MRS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=36368&sent=863&recv=140&lost=0&retrans=0&sent_bytes=1001848&recv_bytes=12611&delivery_rate=5157374&cwnd=406800&unsent_bytes=0&cid=2c90323a9a29046c&ts=9785&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 29 Oct 2024 14:14:13 GMT
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
runn1rnl8xzmqeh0kvov.web.app
URL
https://runn1rnl8xzmqeh0kvov.web.app/ucspqsuf8bxoiymvvdy5p6pp9uzvyqj/hover.css
Domain
uara.arizona.edu
URL
https://uara.arizona.edu/sites/default/files/styles/az_card_image/public/2021-12/Email%20icon.png?itok=VCLPpCj8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer) Generic Cloudflare (Online)

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| a0_0x1cf0 function| a0_0x54bcbf object| a0_0x4a90 function| a0_0x48ed function| a0_0x2bb1cf function| a0_0x375a5f function| a0_0x283e function| a0_0x410f66 function| a0_0x45972f function| a0_0x183715 function| _0xc5f7cf function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap string| G57qvU object| xOVwzv function| grfPzlN object| _6Objt0 object| nW0WgW number| wU6jHg object| K4Rj1R string| bAhgUFC string| M7GRSCR string| mIh_7u string| AgzeSX string| R8_5uox string| AVz9au string| UjMrPuu string| xaoAnA string| rhJESSV string| u1ZAd5 string| f8Wfj7 string| vXXvGJ string| uyEvUW string| Vz0U3u string| epj0hP string| MSz52tM string| Pr485Qe string| QCty_hj string| GJIEk0V string| JbjTdY string| S8C83lf string| lI2fAGb string| ifmz17x string| qDNszN string| D2GFhD string| Bboldz string| HUW5fPB string| vnzQh9V string| O91BVg string| o8mKyeq string| rfyAANA string| juqs0UN string| xxKyD38 string| LBqQJrF string| x6xSe4 string| usfVnIp string| _gDQqVl string| tiLpHyO string| A59GQF string| qxpGuRF string| bSyQq_ string| O3iNYo string| c6ZqiB string| sHWog8m string| YVe7jA string| zVQtqD string| YsFSX8K string| CrK4pVF string| sNgXNc string| PKCaA2 string| cUmPhll string| gSt21B string| mbezbn string| V_tXgV object| ktIOLQH object| ItoWu3 object| KcWavVz object| H_boWL function| AI27Mo function| NedwPi object| aIbvgO number| _68eJq number| BRk4LU number| _eqmJdP number| LSd8_l number| KMa0Pm6 string| ZQu3Pt string| EN6dx9 string| VIV2Qzw string| Md9u6t string| oFtFQS string| g7yx44Z string| LJ0Wdt5 string| xif3PWm string| UC4yvFR number| PQj78v function| Q7LRuG function| La0RjGd function| ucTiiC function| NweNrX function| LjSwKt function| xqSPGJ function| mbMmdkM function| Amg7IS function| Cu7_AB function| o5sbTl function| i03PYu

1 Cookies

Domain/Path Name / Value
.document-file.secure-autth.workers.dev/ Name: __cf_mw_byp
Value: E9BxERx.QBM8qghNfI6r8Q7u5oPU1FKGdJUNeNVOTRE-1730211243-0.0.1.1-/

11 Console Messages

Source Level URL
Text
network error URL: https://document-file.secure-autth.workers.dev/
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://kit.fontawesome.com/585b051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://document-file.secure-autth.workers.dev/(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://document-file.secure-autth.workers.dev/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://uara.arizona.edu/sites/default/files/styles/az_card_image/public/2021-12/Email%20icon.png?itok=VCLPpCj8
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
document-file.secure-autth.workers.dev
encrypted-tbn0.gstatic.com
fonts.googleapis.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
runn1rnl8xzmqeh0kvov.web.app
uara.arizona.edu
www.palomar.edu
runn1rnl8xzmqeh0kvov.web.app
uara.arizona.edu
104.17.25.14
104.18.10.207
172.67.139.119
172.67.171.89
205.153.158.10
2606:4700:4400::ac40:93bc
2a00:1450:4001:802::200a
2a00:1450:4001:811::200e
2a00:1450:4001:831::200a
2a04:4e42:400::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1515bc37b1739d942f9e3f99dd14d5021910b1b061ba3b3169ee88246d4f8cf6
2428dc59e50ba1275855df40a0e2c94180fc16cfd9780e2da324977fc0269ddf
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
4af9396941a1b0beff198e0476f96364688a97b639e19f7ed7af883c54a4b22c
6ac743e9cf0f854b6a5cf7ba8b60ff336e77b612975bf1692163b7ec738e0600
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
99cf92a13d4084fd8068b07cc5a30b5edb47294825027bfb41ae10a57539bfa5
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7a714b32bf10eebe9f9d39530a838eed4a2921f1e144f189c9d06ee9b0ac405
d5e9428829ef896fc695fac76770129ca9ad35314317ad97bcc44c2a013e7ef2
d731f0696eb6b81aed66210f7b2caf1cd18e888386a0bfaa3168dfb87f958855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
fe409b82972ac111723679bdd7560825e09ecc9f2cebb762062f0debd6ccd0b5