urlscan.io logo urlscan.io
SecurityTrails logo

pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3...
Effective URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/de...
Submission: On December 14 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 1 countries across 10 domains to perform 9 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev.
TLS certificate: Issued by E1 on December 9th 2023. Valid for: 3 months.
This is the only time pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
1 1 54.89.171.108 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:600... 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
1 23.48.224.146 20940 (AKAMAI-ASN1)
1 1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
9 8
1    167.89.115.54 (Herndon, United States)

ASN11377 (SENDGRID, US)
PTR: o16789115x54.outbound-mail.sendgrid.net
u39913023.ct.sendgrid.net
1    54.89.171.108 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-89-171-108.compute-1.amazonaws.com
splendidedwin142413.lt.emlnk.com
2    2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
1    2607:f8b0:4006:821::200a (United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    23.48.224.146 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-48-224-146.deploy.static.akamaitechnologies.com
www.firelands.com
1    2607:f8b0:4006:80f::2004 (United States)

ASN15169 (GOOGLE, US)
www.google.com
1    2607:f8b0:4006:81f::2004 (United States)

ASN15169 (GOOGLE, US)
t2.gstatic.com
Apex Domain
Subdomains		 Transfer
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 988
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2842
29 KB
2 r2.dev
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
125 KB
1 gstatic.com
t2.gstatic.com
766 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
289 B
1 firelands.com
www.firelands.com
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 340
30 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 204
7 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 735
24 KB
1 emlnk.com
splendidedwin142413.lt.emlnk.com
298 B
1 sendgrid.net
u39913023.ct.sendgrid.net
831 B
9 10
Domain Requested by
2 pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 t2.gstatic.com
1 www.google.com 1 redirects
1 www.firelands.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 stackpath.bootstrapcdn.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 ajax.googleapis.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 maxcdn.bootstrapcdn.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 cdnjs.cloudflare.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 code.jquery.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 splendidedwin142413.lt.emlnk.com 1 redirects
1 u39913023.ct.sendgrid.net 1 redirects
9 11

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2023-12-09 -
2024-03-08		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
bootstrapcdn.com
GTS CA 1P5		 2023-11-30 -
2024-02-28		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
www.firelands.com
R3		 2023-12-01 -
2024-02-29		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Frame ID: 15894A6BE8BA8A816E7C05D9E9164287
Requests: 11 HTTP requests in this frame

Frame: https://www.firelands.com/
Frame ID: CBD15F128F4D762EC87F49825B8BC691
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Documents Portal Login - firelands.com

Page URL History Show full URLs

  1. https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUN... HTTP 302
    https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1... HTTP 302
    https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/ob... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

70 %
IPv6

10
Domains

11
Subdomains

8
IPs

1
Countries

215 kB
Transfer

557 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3zXzTFPBUN54hyR2TZyjeopdyDH7Tr1yIb4MhTOLOYs2uhmtplKWXgd5hK1Tj8fTlQuCIUnbvPO3RMRWDjA2rAsfZFOuHU-2FpURWaRM8AVPjxl0N7-2B4khXQgvxtudq9FyGrq55mEsjiX51r1PtQZ-2BbSu-2FxVqrovZWvkQkrfQk-2Frr-2FbzgcYpTTBnFHk8QZWd0BiFtW4gbDXAwPA4-2FrINws-2F6hVo0MSjAGNhwT1f-2FY-2B4wUPphO3-2Fp16W5uFaRRsNk634ksu2kffw6mYs-2BjkzzMww41tEh6kcpWsMNbnwDvpdV-2FaHbrv4ou5Rp2DKYAeAFsAEhc0WsNm27buQJPrW8nhphalIDOBF9ygTYSVc16-2FKyjf6P9bgSQbqkIRf6ez6H-2FDpV2n7JbHyXoJFJp0AnGcWRKeyUtta3TK-2BnRwZ2IkCHjMDdSgsnFn2s-2FlCU992SMfDc8aAibHrWYUljjuOMV7NSpm8wToRLkptAM5lWS6RYz7WNN2SQ-2BJ7-2FZSp9AoR8-2Fj-2B8c2RRvULzRc0CemDJ-2BafBXngm88-2FQXQgHWUP-2F1RupsPFOtMRK0LAEGzTq5L7UDWFbLXjXM8psEJQMqAPW-2F3UHym5Y0WieOEsljNabcMX3oeOHRTVjxfQAilvgXqYXrfVmOFR-2BToZ64Mnm9OaimhAfr3ncj5v15QR0dPntPoY90QzlD3T8J1LjoTOl1HDPPnmrmrs5p9-2BdVDZKAfejW-2FHekX-2BybsRqu6gp-2FrBAoaZ9xmWWQw932ht34gmd76GxpZu0TDNg-3D-3DimDX_SFG8lCmBUlFAtM1Lpty-2BBvYEKjEe9AnPBoi0wE9Vqt9MOR6F8d-2FN4-2FVC-2FqYK8BIjUxnEh4h1LMw5J1DGGyrdSFgiseQ1v3deIm9jKOXOQs2uyzugEDuvabyoQED04La9G5-2B1Em-2BUUp5qUHAQ0dseUW4xckxnDz9iDuDmdp7KCG2wqb8LnaakEjiPfWlHFRkDhFOW8ohj-2BBgin2lB08kzuMd-2FJDJ-2F8RvSOKXn4GewSM7l4DiceSVFHxTuzCmKulm3QKiSbEt-2BOW9s6kt7N1gqbIVrqe9Pz3JiN7cD8ztyQMrYjHHFeLZ6-2BAcMqpsgfvKyWyauc1BTOj-2FeL1aMLn-2FeagM2u5bxjIYoV7jjp9o3J28DCKwHPLvY3XslpiZFj5gvN-2F1W6gPrMnfRsV0hlk9l-2BwhzTW1lPYavn0-2FRWKE-2FNua1Ly1sLFxnWyJR0sCH0dymkmXc23OfPwYgKu-2FAIUOAjD4OJoY-2BgZpN9ZRT7dRH94RV0wfjYPjKSMoBmwGLmTmn7XduDhxkpbC3fABK6Y-2BLG4-2BB-2FRiy2DuYnqGGPFdsnrYBTw-2FrW0JidaRCfKmDd-2FY7hMsfaCTzktAg-2FR7wrPBJbiDsfSPd9t-2FWx8VQ01GXHNbTOsHAKVJ9DCJBP4HbMZWnJS0RL1dFubwGzimwz-2F-2F7qt1OfeA4f68TzjRzSqX0S1wGxfgRUtDRmowmWjJfmrIWYOS-2F7yW31N6VYfFwJ-2BOfRCJqm0417RazXeQDoHQICduCCKzv0MMe26kxr9r2T6E2ENFh2rBnyn6S0-2FLHJUiwcsoHFZrT4cxwqS4tFLmuNZjz3grPk8CbtU-2FoRi46AWard5ugNodA1pwdO-2BCjfkFAbMxqlYyozjuy6yzlERnN7DJdTDed4wqRMFGDVFt-2FE-2F0twMy3lFsP94eN-2F8890rJW1QR3sZeJ18VMRTloS6ObnyWnAK2AbcQRdJ4DvYvvPFCpUOevdpccTFCp7p4gHk-2B76w-3D-3D HTTP 302
    https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1MmQyNDNiYWE2YjhlNTFmYmExZDgzZTUucjIuZGV2JTJGd2VibG9jay5odG0lM0YxOGM5ZGQzODlkOTc0NzkyNzJkYjkzNzk3Mzg1NzhhYiUyRnIyJTJGZGVmYXVsdCUyRmJ1Y2tldHMlMkZzc2tza3Nza3MlMkZvYmplY3RzJTJGd2VibG9jay5odG0lMkZkZXRhaWxz&sig=88B7MAw5ihn6A8yH8d54FKqx4VcRuMrNxyHCE7HdQEFp&iat=1702564065&a=%7C%7C226617553%7C%7C&account=splendidedwin142413%2Eactivehosted%2Ecom&email=7HwisZpC21uH0perTY1y8afxtssM%2FN8LSGrNnYNAtmsN%2BTPaUPPOHg%3D%3D%3AOvBzphT7JYDGhWPVOwJMIiBxwZ8B59IW&s=3834941fbb829496edc41ec58674ea4f&i=1A3A0A9 HTTP 302
    https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://www.google.com/s2/favicons?domain=firelands.com HTTP 301
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://firelands.com&size=16

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request weblock.htm
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Redirect Chain
  • https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3zXzTFPBUN54hyR2TZyjeopdyDH7Tr1yIb4MhTOLOYs2uhmtplKWXgd5hK1Tj8fTlQuC...
  • https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1MmQyNDNiYWE2YjhlNTFmYmExZDgzZTUucjIuZGV2JTJGd2VibG9jay5odG0lM0YxOGM5ZGQzODlkOTc0...
  • https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
207 KB
98 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
028a72d5208d928c85b3b43e7dbeddb309497a7b00f578919837f52bf5d426b7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

CF-RAY
83574c7b2fcf4bcc-BUF
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 14 Dec 2023 14:57:21 GMT
ETag
W/"23e9b4e5564492f4d875a25da07c9e40"
Last-Modified
Thu, 14 Dec 2023 14:16:31 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

content-length
0
content-type
application/json
date
Thu, 14 Dec 2023 14:57:20 GMT
location
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
x-amz-apigw-id
P8CosF_XIAMEPGw=
x-amzn-requestid
c33ccde9-f05c-4164-aabc-4f0021bce9ff
x-amzn-trace-id
Root=1-657b17d0-4ee5313c17b5ead063e3c7ee;Sampled=0;lineage=12ce62b2:0
favicons
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/favicons
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Thu, 14 Dec 2023 14:57:21 GMT
Content-Encoding
gzip
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html
Connection
keep-alive
CF-RAY
83574c7c68be4bcc-BUF
truncated
/ 		55 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		558 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		520 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Dec 2023 14:57:21 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
7662041
x-cache
HIT, HIT
content-length
23856
x-served-by
cache-lga21963-LGA, cache-nyc-kteb1890051-NYC
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1702565842.559405,VS0,VE0
etag
W/"28feccc0-10fdd"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
4, 654
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Dec 2023 14:57:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
148989
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6157
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-4af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Q45CppfX%2FEnFdxUbZbj9AVTd8LTUuWf4bCQjARt8nQHkrEtAWabVClvHgBNNYDr8RcFt7BhEqfniexKMVZIthBQhEaKO5iHu0z3blHhUUu5jlTql3X8t7aHFSpzuQU7YGIkLE5u9FZ0yPyUcc0Jyfdb"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
83574c7dacf44bc3-BUF
expires
Tue, 03 Dec 2024 14:57:21 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Dec 2023 14:57:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
845
cdn-cachedat
10/31/2023 18:51:41
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
425cea1df08e0979c9d7aaa79e6f30cc
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
83574c7da8304bc9-BUF
cdn-requestpullsuccess
True
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Dec 2023 06:16:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
31257
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 13 Dec 2024 06:16:24 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 14 Dec 2023 14:57:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
852
age
1927818
cdn-cachedat
10/31/2023 18:52:11
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"67176c242e1bdc20603c878dee836df3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
ed766c17cdf45213b1538ae406b7f7a1
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
83574c7dae1d4bd5-BUF
cdn-requestpullsuccess
True
/
www.firelands.com/ Frame CBD1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.firelands.com/
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.224.146 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-48-224-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
16300
content-type
text/html; charset=utf-8
date
Thu, 14 Dec 2023 14:57:22 GMT
expect-ct
max-age=86400
expires
Thu, 14 Dec 2023 14:57:22 GMT
permissions-policy
geolocation=(self), payment=(self "https://formulate.geonetric.com" "https://forms.geonetric.com"), sync-xhr=(self "https://formulate.geonetric.com" "https://forms.geonetric.com"), camera=(), accelerometer=(), gyroscope=(), magnetometer=(), microphone=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server-timing
cdn-cache; desc=MISS edge; dur=141 origin; dur=521 ak_p; desc="1702565841808_398664818_351514795_66100_5642_26_154_255";dur=1
strict-transport-security
max-age=63072000; includeSubDomains;
vary
Accept-Encoding
x-akamai-transformed
9 53957 0 pmb=mRUM,1
x-aspnet-version
4.0.30319
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=Edge,chrome=1
faviconV2
t2.gstatic.com/
Redirect Chain
  • https://www.google.com/s2/favicons?domain=firelands.com
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://firelands.com&size=16
215 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://firelands.com&size=16
Protocol
H2
Server
2607:f8b0:4006:81f::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dcb576ad01e653d8a1780983e3c26ee5a6e713f67540abaf9771e16e5e913c2b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Thu, 14 Dec 2023 14:57:21 GMT
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
215
x-xss-protection
0
last-modified
Wed, 19 Jan 2022 18:30:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="media-favicon"
report-to
{"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-location
https://www.firelands.com/imgs/favicon/apple-icon-57x57.png
expires
Thu, 21 Dec 2023 14:57:21 GMT

Redirect headers

date
Thu, 14 Dec 2023 14:57:21 GMT
x-content-type-options
nosniff
server
sffe
content-type
text/html; charset=UTF-8
location
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://firelands.com&size=16
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
333
x-xss-protection
0
expires
Thu, 14 Dec 2023 15:27:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery object| _0x29a3 function| _0x40b2 function| _0x2e20a0 string| hash number| n function| goNow function| _0x2861f7 function| _0x5b22 function| _0x7c5c function| Popper object| bootstrap

2 Cookies

Domain/Path Name / Value
www.firelands.com/ Name: ASP.NET_SessionId
Value: 1hqm5xr4bjnvgeyeddnbocot
www.firelands.com/ Name: mobileview
Value: web

8 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/favicons
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://www.firelands.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.