usrops.com Open in urlscan Pro
194.116.214.43  Malicious Activity! Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response usrops.com/	68 KB 8 KB	1125ms 189ms	Document text/html	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 2461f95b9338572ff78b842a9375fc45b7178cc1052e17c5c8c47728377dfa6e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 24 Oct 2023 10:12:41 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	238 KB 83 KB	147ms 57ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-E69511BB7E Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f2cab1eca5717f887dea82142a86baa3da3dcb1f45c61a3346c51a97ff07da79 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 84827 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 24 Oct 2023 10:12:42 GMT
GET H2	200	css2 fonts.googleapis.com/	25 KB 2 KB	143ms 50ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Tinos:wght@400;700&family=Archivo&family=Lora&family=Maven+Pro&family=Merriweather&family=Montserrat&family=Nunito:wght@600&family=Pacifico&family=Poppins:wght@400;500;600&family=Raleway&family=Kite+One&family=Mitr:wght@300&family=Sriracha&display=swap Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 58585842ae6888dce49a43c2150504bc2bfd6bc8648ef88aa15db256c5ec95b9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 24 Oct 2023 10:12:42 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 24 Oct 2023 10:12:42 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 24 Oct 2023 10:12:42 GMT
GET H2	200	share-common.css fly.linkcdn.to/v2.5/theme/	47 KB 8 KB	145ms 52ms	Stylesheet text/css	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fly.linkcdn.to/v2.5/theme/share-common.css?t=1658885907447 Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e448238639792210d43bde27374200528b632a1b2b84ba343b360ec5a35aa8d Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront) strict-transport-security max-age= 63072000; includeSubdomains; preload cf-cache-status HIT x-content-type-options nosniff age 81 x-amz-cf-pop FRA60-P2 cf-polished origSize=55416 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block referrer-policy same-origin cf-bgj minify last-modified Wed, 29 Mar 2023 10:26:43 GMT server cloudflare etag W/"4180f589edeef825d162fffbc61008d9" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ewkBolf2CaBGT%2Bb0V1ZrBn3H0w5fytmCzSeqw73vn9IBCPSLj0NaOiIF1TDyzw2dH6AsyjRndpHCYmSWKMxD30IeMJ%2Fqha4%2BKvS7DAOld6%2FZCqrzVvzOERmkHOQWuPaCE5XLPCiEwXbPKPijZQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control max-age=16070400 cf-ray 81b171636c621c01-FRA x-amz-cf-id OpDYVL-XODUVFFcrRrhMH5skM9AhS_W0nscUEXEWZ0jjPziqJSXiAg==
GET H2	200	default.css usrops.com/css/	93 KB 16 KB	181ms 180ms	Stylesheet text/css	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://usrops.com/css/default.css?t=1680569519815 Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 5fe6b42ae13a161663373634245e6e2119bccf7f1da46bddc378098447db5226 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Wed, 27 Sep 2023 14:12:24 GMT server nginx etag W/"65143848-175bc" vary Accept-Encoding content-type text/css cache-control max-age=43200 expires Tue, 24 Oct 2023 22:12:42 GMT
GET H2	200	defaultWhite.css usrops.com/css/	4 KB 1 KB	182ms 181ms	Stylesheet text/css	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://usrops.com/css/defaultWhite.css Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 44845579f305286f8684821c30a52f815f10a351d00baad5c92c8502426474fa Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Fri, 08 Sep 2023 03:40:44 GMT server nginx etag W/"64fa97bc-f34" vary Accept-Encoding content-type text/css cache-control max-age=43200 expires Tue, 24 Oct 2023 22:12:42 GMT
GET H2	200	theme.css.v2.3.js Show response usrops.com/js/	73 KB 9 KB	211ms 211ms	Script application/javascript	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Full URL https://usrops.com/js/theme.css.v2.3.js Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 25eb5dc261305b44acc8788710f15bf97a1761926bd34496fcaa72422bb13efc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Fri, 08 Sep 2023 03:43:58 GMT server nginx etag W/"64fa987e-1243c" vary Accept-Encoding content-type application/javascript cache-control max-age=43200 expires Tue, 24 Oct 2023 22:12:42 GMT
GET H2	200	loading.jpg usrops.com/	80 KB 80 KB	212ms 211ms	Image image/jpeg	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Show image Full URL https://usrops.com/loading.jpg Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT strict-transport-security max-age=31536000 last-modified Wed, 21 Sep 2022 07:47:06 GMT server nginx etag "632ac17a-13ea4" content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes content-length 81572 expires Thu, 23 Nov 2023 10:12:42 GMT
GET H2	200	jquery-3.7.1.min.js Show response code.jquery.com/	85 KB 30 KB	197ms 57ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.7.1.min.js Requested by Host: usrops.com URL: https://usrops.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Request headers Referer https://usrops.com/ Origin https://usrops.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:42 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3341698 x-cache HIT, HIT content-length 30336 x-served-by cache-lga21978-LGA, cache-sof1510034-SOF last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1698142362.202010,VS0,VE0 etag W/"28feccc0-155ed" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 16, 38059
GET H2	200	7Auup_AqnyWWAxW2Wk3swUz56MS91Eww8Rf21nejpBh8CvRBOA.woff fonts.gstatic.com/s/mavenpro/v25/	12 KB 13 KB	130ms 42ms	Font font/woff	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/mavenpro/v25/7Auup_AqnyWWAxW2Wk3swUz56MS91Eww8Rf21nejpBh8CvRBOA.woff Requested by Host: fly.linkcdn.to URL: https://fly.linkcdn.to/v2.5/theme/share-common.css?t=1658885907447 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fc9e259669117b3e2c814392798e23871961db27b54ef88731aae886f5c4f58d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer Origin https://usrops.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Sat, 21 Oct 2023 08:29:00 GMT x-content-type-options nosniff age 265422 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 12580 x-xss-protection 0 last-modified Wed, 03 Nov 2021 17:05:24 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 20 Oct 2024 08:29:00 GMT
GET H2	200	logo_mobile.svg usrops.com/	2 KB 2 KB	182ms 180ms	Image image/svg+xml	194.116.214.43 CLOUDBACKBONE
General Check archive.org Show headers Download Go to Show image Full URL https://usrops.com/logo_mobile.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 194.116.214.43 San Jose, United States, ASN56971 (CLOUDBACKBONE, HK), Reverse DNS Software nginx / Resource Hash 9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age=31536000 last-modified Wed, 27 Sep 2023 13:10:46 GMT server nginx etag "651429d6-80c" content-type image/svg+xml accept-ranges bytes content-length 2060
GET H2	200	verified_sprite.png fly.linkcdn.to/images/	3 KB 4 KB	53ms 51ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/images/verified_sprite.png Requested by Host: usrops.com URL: https://usrops.com/css/default.css?t=1680569519815 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d11f37fae309c522c4c45d9f75cb48f0651a09a9d278cddbd19a1a8e31aa9a3 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 90bb130ecccb71953b38a1c0e3b5721a.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 5254 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 3460 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Tue, 19 Sep 2023 08:47:05 GMT server cloudflare etag "8302f6a83bd1aec82c83d2830f210470" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B2R4afqhmvRkxj55kHdDzlf8OZgHUv1NH1%2Bkmltz3eqJyw39ndKXriVS5ZVElCNOFev%2F7wlHq9nQYXYzPaqXxEgQYtMW6%2FOAtpRth65a5MpMSZ1TIPe1cc5vtSPhUfVxQFoR7fnyn7OVZ%2BV04A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b241c01-FRA x-amz-cf-id A0laN5mq5V5W1Lu2JPeU9HNAfl_755vuLMHdE6BkpxWvT5VyP01bnQ==
GET H2	200	blank.png fly.linkcdn.to/images/	14 KB 15 KB	57ms 56ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/images/blank.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 087f602507c9fcadc519196919f1a5b223cf9f2c0b7e3316906301fe6766e7d0 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 16aa5c15345b1c0756b83a5ae8ee765e.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 81 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 14543 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Mon, 25 Jan 2021 08:23:50 GMT server cloudflare etag "7bd3f643b47e3cf4fa880988f4cf47a1" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OW4EWOdVgu%2B9IrTVE8xH8PYHI5kLtYMTd8M7xiIenxrsr81dApd4mskBlv2cjKF4CKY8iZxd7EMVH2J%2Fim2KLTw0oEMgwfD3nhNRYXAhybg55dBDIDIbJG8c2eQFexHLowgws5OB8KWJbQHhVQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b251c01-FRA x-amz-cf-id kTH84ZpJq3aw9pzmsXliY7jF89rNC0ao1YdkY9wC8SfYvQeOrk1DQA==
GET H2	200	1.png fly.linkcdn.to/statics/links/icons-socials/spirit/	5 KB 5 KB	55ms 55ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/statics/links/icons-socials/spirit/1.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc8abacb97d2e71cafbfdd4705d6f914e189d7825edff03d7a95acaca7f98ef1 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 1b3f5dc0b3c577dc5e7394bf12aed238.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 81 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 4949 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Thu, 10 Sep 2020 13:28:40 GMT server cloudflare etag "8139cee41cfe4201b9021936e39de717" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w8lSRM8uytU8vFfyfnbQhwgLgYkzlZu6VQ8%2BISCmM79l%2BtzE0%2FwTuFlDmjK0tlonPS0CKW27ynV4Nf8RI4wOD5QAvFVf5wjpxDdjxV%2Bb7a2OsJx6z9rXNyBXXdkeooTc7cQS8GdDVk0f6wRQLA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b261c01-FRA x-amz-cf-id pOJXPnyGpcZkETPdYVTFo94f4DEbg1niqnZkTNxgEWQ4Wf-3Sqgpog==
GET H2	200	3.png fly.linkcdn.to/statics/links/icons-socials/spirit/	7 KB 8 KB	55ms 54ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/statics/links/icons-socials/spirit/3.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aa2a82bbec6afb10324988b2003e61d47a09708b25ac0e2ce3b64950aa2b7a35 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 81 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 7538 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Thu, 10 Sep 2020 13:28:40 GMT server cloudflare etag "229b5dca08997b920118bf7231011cf2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GfBxwrv92c7yH6YDjREnvVQdLD%2BLYtIDKebKRaBGNF7cQG9JmkT1B206d0FgoGjsIwhasS7sb5LSM%2FDyHVgZfGX9Q%2Bx7A%2B1x0SA15INsh3926y1n%2BBtERJ816QAoOy8hrfWFJZ7y1Ee5DLfCxQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b271c01-FRA x-amz-cf-id DjC3fNjpbLZX0sollk_JGal13MMUYdFV-LwqhMLwsWwq8WbfsGa5og==
GET H2	200	6.png fly.linkcdn.to/statics/links/icons-socials/spirit/	9 KB 9 KB	56ms 55ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/statics/links/icons-socials/spirit/6.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b106acf20bd4b5ff01ddb53be3c6f3173682ea42b893f31a1400e09de0be9e49 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 da4de4427d18bee1d3254f1bbdad25f2.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 81 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 8759 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Thu, 10 Sep 2020 13:28:42 GMT server cloudflare etag "cd115f6d3642f90c79b0af1ae9a93c2f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ct6zULZxWPOUUvDKUWGJUNeXbpl0G4XOM1cWZs7kfmUiSOvLTR4GteWnuSCGYarpEf5Y8YiQkmIiCDDU4cMacbGelTPU3JZh0kQRTYKIdeiexTPcBW3ws65JsgsymAP3OThBmGTvpkB86ZHDQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b281c01-FRA x-amz-cf-id CZcZsDoywsgWDFLBH1CBZNGa-Rzo9dsOZTRmg9CXnCM7omsaWqcp-w==
GET H2	200	32.png fly.linkcdn.to/statics/links/icons-socials/spirit/	7 KB 7 KB	53ms 53ms	Image image/png	2606:4700:3037::ac43:c1e2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fly.linkcdn.to/statics/links/icons-socials/spirit/32.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c1e2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e36eaeb05ac9e38a5e6ee0fea36ded8da7707532912f061ef6d445603fb5bfa9 Security Headers Name Value Content-Security-Policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' Strict-Transport-Security max-age= 63072000; includeSubdomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://usrops.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 10:12:43 GMT strict-transport-security max-age= 63072000; includeSubdomains; preload x-content-type-options nosniff content-security-policy default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none' via 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront) nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT x-amz-cf-pop FRA60-P2 age 81 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400 content-length 6743 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Thu, 10 Sep 2020 13:28:55 GMT server cloudflare etag "78fd36b0d6c14772a8b46b88817087b3" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VEeas7312pU368OT0wMXJ4ZpamzTf5QkelsVSzlSMIP58d2PWO%2B4KmCGJFneFfDLs8bOIpiw6OmO2uOJeed697ZTeekenPuhU22aBdnZEuGDzMn%2FkoTI3e3Mu2HQNF1fe13h4zORorYRV5F16A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=16070400 accept-ranges bytes cf-ray 81b1716a0b2a1c01-FRA x-amz-cf-id otB388GSrhCHPBKSdAMBydRJ17nk1vEyaOzlR4k0W5JOEyFYgHGpBA==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __theme function| cbgeo object| __ipgeo undefined| js object| fjs object| __animate object| __path string| mediapath function| $ function| jQuery object| google_tag_manager object| google_tag_data object| dataLayer function| onYouTubeIframeAPIReady

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			usrops.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: abb2no5t6ecv3kcb43ihg3dovf

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fly.linkcdn.to
fonts.googleapis.com
fonts.gstatic.com
usrops.com
www.googletagmanager.com
194.116.214.43
2606:4700:3037::ac43:c1e2
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2008
2a00:1450:4001:831::2003
2a04:4e42:200::649
05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668
087f602507c9fcadc519196919f1a5b223cf9f2c0b7e3316906301fe6766e7d0
2461f95b9338572ff78b842a9375fc45b7178cc1052e17c5c8c47728377dfa6e
25eb5dc261305b44acc8788710f15bf97a1761926bd34496fcaa72422bb13efc
44845579f305286f8684821c30a52f815f10a351d00baad5c92c8502426474fa
4d11f37fae309c522c4c45d9f75cb48f0651a09a9d278cddbd19a1a8e31aa9a3
58585842ae6888dce49a43c2150504bc2bfd6bc8648ef88aa15db256c5ec95b9
5fe6b42ae13a161663373634245e6e2119bccf7f1da46bddc378098447db5226
9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2
9e448238639792210d43bde27374200528b632a1b2b84ba343b360ec5a35aa8d
aa2a82bbec6afb10324988b2003e61d47a09708b25ac0e2ce3b64950aa2b7a35
b106acf20bd4b5ff01ddb53be3c6f3173682ea42b893f31a1400e09de0be9e49
e36eaeb05ac9e38a5e6ee0fea36ded8da7707532912f061ef6d445603fb5bfa9
f2cab1eca5717f887dea82142a86baa3da3dcb1f45c61a3346c51a97ff07da79
fc8abacb97d2e71cafbfdd4705d6f914e189d7825edff03d7a95acaca7f98ef1
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fc9e259669117b3e2c814392798e23871961db27b54ef88731aae886f5c4f58d