urlscan.io logo urlscan.io
SecurityTrails logo

proton-mail.fr Open in urlscan Pro
2606:4700:3037::6815:6031  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://proton-mail.fr/
Effective URL: http://proton-mail.fr/login.html
Submission Tags: 7143466
Submission: On May 29 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3037::6815:6031, located in United States and belongs to CLOUDFLARENET, US. The main domain is proton-mail.fr.
This is the only time proton-mail.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Protonmail (Online)

Domain & IP information

IP Address AS Autonomous System
1 15 2606:4700:303... 13335 (CLOUDFLAR...)
1 185.70.41.130 62371 (PROTON)
15 2
Apex Domain
Subdomains		 Transfer
15 proton-mail.fr
proton-mail.fr
2 MB
1 protonmail.com
mail.protonmail.com
1 KB
15 2
Domain Requested by
15 proton-mail.fr 1 redirects proton-mail.fr
1 mail.protonmail.com proton-mail.fr
15 2

This site contains links to these domains. Also see Links.

Domain
protonmail.com
mail.protonmail.com
old.protonmail.com
Subject Issuer Validity Valid
protonmail.com
SwissSign EV Gold CA 2014 - G22		 2019-10-25 -
2021-10-25		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://proton-mail.fr/login.html
Frame ID: 2B8FCD85B491DDF9C3815E6F99658797
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://proton-mail.fr/ HTTP 302
    http://proton-mail.fr/login.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

15
Requests

7 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1789 kB
Transfer

6231 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://proton-mail.fr/ HTTP 302
    http://proton-mail.fr/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.html
proton-mail.fr/
Redirect Chain
  • http://proton-mail.fr/
  • http://proton-mail.fr/login.html
13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1e50bfc8ec30266edd48f784636ec23ec7d8a7b28b53bb0be5f568ec32d0fed

Request headers

Host
proton-mail.fr
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Fri, 28 May 2021 14:59:10 GMT
Vary
Accept-Encoding,User-Agent
CF-Cache-Status
DYNAMIC
cf-request-id
0a58cc79da0000640189a47000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zQ38RMIpq68iv37euVlcneU8CkDdWU1c4Vfpdr61oxAvBAZT2%2FMaafB%2BW5PCnVwZf%2BJVkdIJERgEiaM9eRDYbqCApjUgYhWy1Rphj51QYHbJbPa%2B5JY64Lb7pVOv0b5Fdz2yaXufSF4%3D"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
656e49d62c066401-FRA
Content-Encoding
gzip
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.3.23
Location
login.html
Vary
User-Agent
CF-Cache-Status
DYNAMIC
cf-request-id
0a58cc7998000064017e267000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=t0%2F8MLWrvoca4nx30XSeSu986BEnBkM3%2FagZI3d%2Bp45n9jzquUCK1hnihzF3UM9O3Z4XFpYX4q4B3uOqzAHvQR%2Bl9x62T6cmO8R2PwEYk50YPduqHJ8VUongLmgV396B4YF8fDAfKQk%3D"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
656e49d5cbf26401-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
vendorLazy.js
proton-mail.fr/index_files/ 		2 MB
544 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/vendorLazy.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5116ac40c95e0eb9323155ea893fc5a8599e6ba61b69d3f93ae0d774ee0fbb3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
2025
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a18000064019a857000000001
Last-Modified
Fri, 28 May 2021 14:59:12 GMT
Server
cloudflare
ETag
"621686-196a22-5c3651e617909-gzip"
Vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jdBJn7SwDcnscN30vNwx87H8xFV%2FqwCn%2FxylA41HkUkQv8FnDXNr4bmPUUNp2MIfuUq71Q8U%2Fk8RwmoyixK8%2BInqJhsVytSvz5s2f81QVvp184rjdy8HUjVmwcZWve%2BgswKrhjJguv0%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Cache-Control
max-age=14400
CF-RAY
656e49d68c116401-FRA
styles.css
proton-mail.fr/index_files/ 		489 KB
93 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/styles.css
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
630b3915915397ab0cdf051b3f656cb3e63155dccc076147ede7ee38c127e715

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
130
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a1d00001f41e8278000000001
Last-Modified
Fri, 28 May 2021 14:59:14 GMT
Server
cloudflare
ETag
"621688-7a467-5c3651e7a5850-gzip"
Vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iAbtjov4SVbGwfjdioTQE%2Bmimculms%2BhsWGxsHHs%2FQqS2i7xTTO9ufMaYkEQxkcMWqc6%2BrSfkKN%2FmgXf77FjG8V4%2FWpnNl8haXkmNr364rwlHNR02L1tZIMNuSEfzlQe430bwVo%2Bm4I%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/css
Cache-Control
max-age=14400
CF-RAY
656e49d6992a1f41-FRA
appLazy.js
proton-mail.fr/index_files/ 		1 MB
238 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/appLazy.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d67b2ac2b4b8cc7d7b03fc67cb806b7b95b63aa75d88b41f55dd6577b5bf750

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
2025
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a1f0000dfa9abba8000000001
Last-Modified
Fri, 28 May 2021 14:59:15 GMT
Server
cloudflare
ETag
"62168b-1042ea-5c3651e97564a-gzip"
Vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=XXY59Ts7jED3FQZfNnDbb2VMxE6OPNjjuNRfHOnr1nE2avNhdqvI6oQK9a1EVFhZqHVbEk2QwU1uINbtTVUXAELQ1VQ1SezJWlpDv6LhC85unxjgEAQiQed0IDMfRo7ah65W%2Fep0pzQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Cache-Control
max-age=14400
CF-RAY
656e49d69906dfa9-FRA
logo.png
proton-mail.fr/index_files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://proton-mail.fr/index_files/logo.png
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b8c2f95bd9c3634cba8e86053f73649fbfd1e8ef3c2889089300b1dfc4310ea

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
126
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
1698
cf-request-id
0a58cc7a44000064018628f000000001
Last-Modified
Fri, 28 May 2021 14:59:15 GMT
Server
cloudflare
ETag
"62168a-6a2-5c3651e8acb4f"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=PKLFKcO9F0jSvLDg5fkHoIoQhlj5ThRaqxs6wPl2jz9r2ERMkigJRFe1GIKlMLBnJt6laCYXgRq3B22XL139S26VGd19ymUnEqSyDrIDpMUUW4hQTTURK0YwHEAZENFjNHIe%2BUyqstc%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
Accept-Ranges
bytes
CF-RAY
656e49d6dc1c6401-FRA
openpgp.js
proton-mail.fr/index_files/ 		323 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/openpgp.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
13a10ffca8099758903b4ff42f7ebe5333497302982ee98f4896b766631dea68

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
2025
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a1e000031286c885000000001
Last-Modified
Fri, 28 May 2021 14:59:14 GMT
Server
cloudflare
ETag
"621689-50bf6-5c3651e841c58-gzip"
Vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=20nxpnveQR1FKhw7PyDmzAMnWmtsd7mnAk3qy8qEvhUzQkQ%2F97guvK9HBykrCOkeqCyzqWun7%2F%2FRRki5KThrLfy4ikfwpmz7LUXNcC6MOkHFJBQcvBfdCzoTNxi0NOERHrQHrExu0t0%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Cache-Control
max-age=14400
CF-RAY
656e49d69f1b3128-FRA
vendor.js
proton-mail.fr/index_files/ 		2 MB
566 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/vendor.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aeee08d7ec3cce3d059c0767083f9b8c50b6f5d1171c73b56d4f0422bd8da422

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
2025
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a1e0000973cd31ef000000001
Last-Modified
Fri, 28 May 2021 14:59:13 GMT
Server
cloudflare
ETag
"621687-188f3a-5c3651e6fc53e-gzip"
Vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Mg8X1R4b6V8LhqqsaJa7SlAToBLEKuKzOy39RnU6o81GXytqo5uvK%2FAw7wbj6SyYADonVIzt7tfRklWWphIpXOzbEnWScRC578bp61P8S9LSc6aC2rCv5vusJxHN76mpeOGc6mor%2BWc%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Cache-Control
max-age=14400
CF-RAY
656e49d69ce0973c-FRA
app.js
proton-mail.fr/index_files/ 		1 MB
233 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/app.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8c3129156bb0158e04633174c761bf8cac2e497cf83716fea64339ded5a2dac

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
content-encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Age
2025
Transfer-Encoding
chunked
Connection
keep-alive
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a1f000064a9aa826000000001
last-modified
Fri, 28 May 2021 14:59:16 GMT
Server
cloudflare
etag
"62168c-122547-5c3651ea4a87e-gzip"
vary
Accept-Encoding,User-Agent
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=KQqSj3DhfwZ496VPMnKbIyAehMNEjPLq9aCDp%2BZwO7Jlg0lR1GOoL2CX7vKa1QI%2BZmeUSi4zWHiJW9ELUlI57S9KTIVZLVH3c37kV9dQvGL2u32Vf86rJVUJC5jrpq4%2Bcw7S3w27lvg%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Cache-Control
max-age=14400
CF-RAY
656e49d69c5864a9-FRA
login.jpg
proton-mail.fr/index_files/assets/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://proton-mail.fr/index_files/assets/img/login.jpg
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/index_files/styles.css
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea326ec63e954a963b0df60dcc0a8bb706cf34a6dd933cdf5da91fb6f4097a1b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://proton-mail.fr/index_files/styles.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/index_files/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
126
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=etYWIFjqZkJLeE3J0KSXNcVSMv9uVGA9hSt5IzLaTYCDSjjnGCHFvzFkbO6IUTb9VOj%2Br5boPipU2XVCpnv2WxSokg084DZz73aM6mchwKgVcaYC%2F%2BqEu9nw7amI874XuTf60mViydU%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d6fd0c973c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a570000973cd31f1000000001
host.png
mail.protonmail.com/assets/ 		42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mail.protonmail.com/assets/host.png
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.70.41.130 , Switzerland, ASN62371 (PROTON, CH),
Reverse DNS
185-70-41-130.protonmail.ch
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src 'self' blob: https://secure.protonmail.com; script-src 'self' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: https://secure.protonmail.com https://mail-api.protonmail.com; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.protonmail.ch/reports/csp; frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block; report=https://reports.protonmail.ch/reports/csp

Request headers

Referer
http://proton-mail.fr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 29 May 2021 08:17:49 GMT
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-length
42
x-xss-protection
1; mode=block; report=https://reports.protonmail.ch/reports/csp
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 27 May 2021 10:59:14 GMT
x-frame-options
deny
etag
"2a-5c34da6546480"
expect-ct
max-age=2592000, enforce, report-uri="https://reports.protonmail.ch/reports/tls"
strict-transport-security
max-age=31536000; includeSubDomains; preload
onion-location
https://protonirockerxow.onion
content-type
image/png
cache-control
max-age=604800
public-key-pins-report-only
pin-sha256="8joiNBdqaYiQpKskgtkJsqRxF7zN0C0aqfi8DacknnI="; pin-sha256="drtmcR2kFkM8qJClsuWgUzxgBkePfRCkRpqUesyDmeE="; report-uri="https://reports.protonmail.ch/reports/tls"
content-security-policy
default-src 'self'; connect-src 'self' blob: https://secure.protonmail.com; script-src 'self' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: https://secure.protonmail.com https://mail-api.protonmail.com; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.protonmail.ch/reports/csp; frame-ancestors 'none';
accept-ranges
bytes
expires
Sat, 05 Jun 2021 08:17:49 GMT
logo.svg
proton-mail.fr/index_files/assets/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://proton-mail.fr/index_files/assets/img/logo.svg
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/index_files/styles.css
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e20edc62373dbe3e0cf9b639548749c516a2494ecc899635c712bfdce031672a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://proton-mail.fr/index_files/styles.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/index_files/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
126
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fmMo1K4GSeuDVc2SVaCyrO5KXJLLOz0vF651BDKMt5eT6%2B739TrNPJoy%2BVznFgmaOyPNZuAWjahb9f4RDu8v5JE2kYd0akkDAaZU15%2FaVYQXmJZaL%2FglopMcobcbfuLL%2FCyI7GhH7%2FI%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d6fc236401-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a5d00006401a29f0000000001
fontawesome-webfont.woff2
proton-mail.fr/index_files/assets/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/assets/fonts/fontawesome-webfont.woff2
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/index_files/styles.css
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://proton-mail.fr
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/index_files/styles.css
Connection
keep-alive
Cache-Control
no-cache
Origin
http://proton-mail.fr
Referer
http://proton-mail.fr/index_files/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
121
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wi%2BOMIpL8nJAZjq3QNJiT15XcgOpO3fHFXzjMi1DX8f%2FnyJdANy7cbVf0OLa5nIJLk0MA4FexTYwvo5UpTyRhj5qGphG7PpWHtCDbcnY5vv37vC9wPZfIHHqpikzlkrjxcj%2BBwWhTnQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d6f9cddfa9-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7a5d0000dfa9d5217000000001
fontawesome-webfont.woff
proton-mail.fr/index_files/assets/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/assets/fonts/fontawesome-webfont.woff
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/index_files/styles.css
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://proton-mail.fr
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/index_files/styles.css
Connection
keep-alive
Cache-Control
no-cache
Origin
http://proton-mail.fr
Referer
http://proton-mail.fr/index_files/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:48 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
121
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xZZ4LQhipOVUD5%2BzvCqUlK3m6R4Y1e2nwIdDUPbrFMLk0mrAwaIHM%2FyQfsiJq7c8Wijyvvs3hvz%2Fu0jg0fv7v5uoMdhbLlzByJ77W2SmnWB6hnTfIhh6KsxbM0HewKnvPRXm0C61THk%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d89c45dfa9-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7b5d0000dfa90e8f8000000001
openpgp.worker.min.js
proton-mail.fr/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/openpgp.worker.min.js
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/login.html
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a180aa012bc23d8030dec58d10a8a0591f149818419dff37b7dd4af46fec12a0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/login.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://proton-mail.fr/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:49 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
121
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vUuhARwg02Gx3LyhPU95n7hb26qJZkpnSmWd%2FKsOF%2Bx6V46k8fbDyFijSG8jng9MqZmo5XPOro9yUIPfwOQXVx94y6XlcO59SDNiQFhQBvWkA6%2BXOc40WivM24nFk6IsLoB3P5SNd%2Fo%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d93d4fdfa9-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7bc10000dfa9851b7000000001
fontawesome-webfont.ttf
proton-mail.fr/index_files/assets/fonts/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://proton-mail.fr/index_files/assets/fonts/fontawesome-webfont.ttf
Requested by
Host: proton-mail.fr
URL: http://proton-mail.fr/index_files/styles.css
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:6031 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Pragma
no-cache
Origin
http://proton-mail.fr
Accept-Encoding
gzip, deflate
Host
proton-mail.fr
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://proton-mail.fr/index_files/styles.css
Connection
keep-alive
Cache-Control
no-cache
Origin
http://proton-mail.fr
Referer
http://proton-mail.fr/index_files/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 29 May 2021 08:17:49 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Age
122
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zqbIQtks6cvRSUaQF8KI2aGrXGLdYGKetH5NxI9cR5bsW5bk8OgyxfTKXfnOJQrwj8359LMvNYmx4cUwaQPlG8v3YQOy33EXB6ZpFI3YqD9KbJ99VIgz2kGkZGHqrIrQnzbrRYG6vEg%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
656e49d93c8b6401-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a58cc7bc200006401933d0000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Protonmail (Online)

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| isGoodPrngAvailable function| IllegalStateError function| IllegalArgumentError function| SecurityError object| openpgp object| cssua function| $ function| jQuery function| FastClick object| angular function| svg4everybody function| Mousetrap function| Fingerprint2 object| dcodeIO object| noUiSlider function| UAParser object| intlTelInputUtils object| base32 object| asmCrypto object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| pmcrypto function| DOMPurify function| MailParser function| _rAF boolean| __twitterIntentHandler function| _createClass function| _possibleConstructorReturn function| _inherits function| _classCallCheck function| Emitter function| Dropzone function| without function| camelize function| detectVerticalSquash function| drawImageIOSFix function| ExifRestore function| contentLoaded function| __guard__ function| __guardMethod__ object| Sieve function| saveAs function| QRCode function| _toConsumableArray function| _extends function| _defineProperty function| _sliceIterator function| _slicedToArray function| moment object| Papa function| Pikaday undefined| returnExports function| Squire object| ICAL object| Push function| Awesomplete boolean| mCustomScrollbar function| markdownit function| Clipboard function| vCard function| JSZip

0 Cookies

1 Console Messages

Source Level URL
Text
console-api warning URL: http://proton-mail.fr/index_files/vendor.js(Line 1)
Message:
asmCrypto seems to be load from an insecure origin; this may cause to MitM-attack vulnerability. Consider using secure transport protocol.