URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 03 via api from IT — Scanned from NL

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is hugo-blog-odt.pages.dev.
TLS certificate: Issued by WE1 on October 3rd 2024. Valid for: 3 months.
This is the only time hugo-blog-odt.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 188.114.96.3 13335 (CLOUDFLAR...)
3 151.101.65.229 54113 (FASTLY)
2 104.243.17.131 25820 (IT7NET)
2 202.79.161.106 64050 (BGNL-HK B...)
17 5
Apex Domain
Subdomains
Transfer
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 311
142 KB
2 bootcss.com
cdn.bootcss.com — Cisco Umbrella Rank: 107583
101 KB
2 ibruce.info
busuanzi.ibruce.info — Cisco Umbrella Rank: 572072
2 KB
2 pages.dev
hugo-blog-odt.pages.dev
4 KB
0 eu.org Failed
bull.eu.org Failed
17 5
Domain Requested by
3 cdn.jsdelivr.net hugo-blog-odt.pages.dev
cdn.jsdelivr.net
2 cdn.bootcss.com hugo-blog-odt.pages.dev
cdn.bootcss.com
2 busuanzi.ibruce.info hugo-blog-odt.pages.dev
busuanzi.ibruce.info
2 hugo-blog-odt.pages.dev
0 bull.eu.org Failed hugo-blog-odt.pages.dev
17 5
Subject Issuer Validity Valid
hugo-blog-odt.pages.dev
WE1
2024-10-03 -
2025-01-01
3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2024 Q3
2024-07-30 -
2025-08-31
a year crt.sh
busuanzi.ibruce.info
R11
2024-08-25 -
2024-11-23
3 months crt.sh
cdn.bootcss.com
ZeroSSL RSA Domain Secure Site CA
2024-08-31 -
2024-11-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Frame ID: 390763F5873836E7B9E737A73538638C
Requests: 17 HTTP requests in this frame

Screenshot

Page Title

Cloudflare配置域名301重定向 | 江畔晚風

Detected technologies

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/mathjax\.js

Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

17
Requests

53 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

249 kB
Transfer

611 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
7 KB
3 KB
Document
General
Full URL
https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaad4ee14b402683f598a83fd889355b0e0a4eeada6ae2058a33522047bee23a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8cc9f1cbc8d9dcad-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 03 Oct 2024 03:46:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=34blVR0RSbnFTxqm5%2BHbAkconBCz0cL4L17eY5cpcg71DHyGY2Ni2Hz3cAyT5SvwEmv9otMi31JIx1zn9%2FWPYe1omuulhpGOMMuxjmkE6nG%2FOivsVudyR%2FYcYYbxWPcI2UGvc93hjwUGFw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
vary
Accept-Encoding
x-content-type-options
nosniff
speculation
hugo-blog-odt.pages.dev/cdn-cgi/
2 B
400 B
Other
General
Full URL
https://hugo-blog-odt.pages.dev/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://hugo-blog-odt.pages.dev
Referer
https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CdbqLYNwBQWCWGN9FiD%2FbvGqbgVl28CEuh%2BHz110SfMV5BSl5CBAzgYaApEs6pLi%2B09ds9gDUzYPSx3PtnaErIrkutEMkfxd1VKb%2FOP5WfzpJcHV5BsasIpPD%2B%2F9pNCoduMyNAREFqEPoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8cc9f1cc7a0ddcad-FRA
content-length
2
date
Thu, 03 Oct 2024 03:46:20 GMT
content-type
application/speculationrules+json
vary
Accept-Encoding
server
cloudflare
animate.min.css
cdn.jsdelivr.net/npm/animate.css@4.1.0/
70 KB
6 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/animate.css@4.1.0/animate.min.css
Requested by
Host: hugo-blog-odt.pages.dev
URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ea1a8732a5d354476cd51f0780a8ac2e6de5fdda27790b3ead2d5ae4d2e6c30a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"11848-nEgzYuvNJ0DmZllbcK9XmtCWuPU"
age
3718983
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Thu, 03 Oct 2024 03:46:20 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230156-FRA, cache-mad2200136-MAD
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
5672
x-jsd-version
4.1.0
remixicon.css
cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/
108 KB
14 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.css
Requested by
Host: hugo-blog-odt.pages.dev
URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
13e29a29baade86f4e7a88d8e076d6a6f3ac8950757b50a0f8bbea1c33658d5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"1af66-MA7aTWKCoG0FYjklj9PTw0TfSFM"
age
3114682
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Thu, 03 Oct 2024 03:46:20 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230041-FRA, cache-mad2200136-MAD
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
13745
x-jsd-version
2.5.0
busuanzi.pure.mini.js
busuanzi.ibruce.info/busuanzi/2.3/
2 KB
2 KB
Script
General
Full URL
https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js
Requested by
Host: hugo-blog-odt.pages.dev
URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.243.17.131 Los Angeles, United States, ASN25820 (IT7NET, CA),
Reverse DNS
104.243.17.131.16clouds.com
Software
nginx/1.14.1 /
Resource Hash
0471fe90ad450f642e15aa79134b7bb6a2b2fd7e88349948fbe60747062ab25e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/

Response headers

accept-ranges
bytes
content-length
1939
date
Thu, 03 Oct 2024 03:46:21 GMT
etag
"5fbb4b90-793"
content-type
application/javascript
last-modified
Mon, 23 Nov 2020 05:41:36 GMT
server
nginx/1.14.1
MathJax.js
cdn.bootcss.com/mathjax/2.7.5/
62 KB
22 KB
Script
General
Full URL
https://cdn.bootcss.com/mathjax/2.7.5/MathJax.js?config=TeX-AMS-MML_HTMLorMML
Requested by
Host: hugo-blog-odt.pages.dev
URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.79.161.106 , Singapore, ASN64050 (BGNL-HK BGP Network Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
9ef249bfdc162849bcf2abe8425f5e90bd89fa4fd1588b1a492731c65b2bbfc9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
expires
0
access-control-allow-origin
*
x-cache
BYPASS, Cache-Control: no-cache, no-store, must-revalidate
date
Thu, 03 Oct 2024 03:46:21 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
server
nginx
access-control-allow-headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
normalize.css
bull.eu.org/css/
0
0

zozo.css
bull.eu.org/css/
0
0

highlight.css
bull.eu.org/css/
0
0

jquery-3.5.1.min.js
bull.eu.org/js/
0
0

remixicon.woff2
cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/
122 KB
123 KB
Font
General
Full URL
https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.woff2?t=1590207869815
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.css
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e61f0d10c8cac8cd0ecb36790d6cce883380c0b185ff3c9bf849ed336ba8285c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://hugo-blog-odt.pages.dev
Referer
https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.css

Response headers

access-control-expose-headers
*
etag
W/"1e954-TTdav0PtGKpUJkwbWXFLClnFk6Q"
age
2066203
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Thu, 03 Oct 2024 03:46:20 GMT
content-type
font/woff2
x-served-by
cache-fra-eddf8230122-FRA, cache-mad22082-MAD
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
125268
x-jsd-version
2.5.0
fancybox.min.css
bull.eu.org/css/
0
0

fancybox.min.js
bull.eu.org/js/
0
0

zozo.js
bull.eu.org/js/
0
0

busuanzi
busuanzi.ibruce.info/
100 B
273 B
Script
General
Full URL
https://busuanzi.ibruce.info/busuanzi?jsonpCallback=BusuanziCallback_978827100775
Requested by
Host: busuanzi.ibruce.info
URL: https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.243.17.131 Los Angeles, United States, ASN25820 (IT7NET, CA),
Reverse DNS
104.243.17.131.16clouds.com
Software
nginx/1.14.1 /
Resource Hash
68145daac60ceb2b126c3cb9864846294c02fa1e62e0066f0f9c04b43ffa8c90

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/

Response headers

content-length
100
date
Thu, 03 Oct 2024 03:46:21 GMT
content-type
application/json
server
nginx/1.14.1
TeX-AMS-MML_HTMLorMML.js
cdn.bootcss.com/mathjax/2.7.5/config/
239 KB
79 KB
Script
General
Full URL
https://cdn.bootcss.com/mathjax/2.7.5/config/TeX-AMS-MML_HTMLorMML.js?V=2.7.5
Requested by
Host: cdn.bootcss.com
URL: https://cdn.bootcss.com/mathjax/2.7.5/MathJax.js?config=TeX-AMS-MML_HTMLorMML
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.79.161.106 , Singapore, ASN64050 (BGNL-HK BGP Network Limited, HK),
Reverse DNS
Software
nginx /
Resource Hash
f380ca5d5257b34fc5f0e4cccd7e1447dd3dfa3b65e06ed23f2a4f6af17e19f0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://hugo-blog-odt.pages.dev/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
expires
0
access-control-allow-origin
*
x-cache
BYPASS, Cache-Control: no-cache, no-store, must-revalidate
date
Thu, 03 Oct 2024 03:46:22 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
server
nginx
access-control-allow-headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
favicon.ico
bull.eu.org/images/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bull.eu.org
URL
http://bull.eu.org/css/normalize.css
Domain
bull.eu.org
URL
http://bull.eu.org/css/zozo.css
Domain
bull.eu.org
URL
http://bull.eu.org/css/highlight.css
Domain
bull.eu.org
URL
http://bull.eu.org/js/jquery-3.5.1.min.js
Domain
bull.eu.org
URL
http://bull.eu.org/css/fancybox.min.css
Domain
bull.eu.org
URL
http://bull.eu.org/js/fancybox.min.js
Domain
bull.eu.org
URL
http://bull.eu.org/js/zozo.js
Domain
bull.eu.org
URL
http://bull.eu.org/images/favicon.ico

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| bszCaller object| bszTag function| ready function| BusuanziCallback_978827100775 object| scriptTag object| MathJax

1 Cookies

Domain/Path Name / Value
.busuanzi.ibruce.info/ Name: busuanziId
Value: 307C4AD95C574EC585A3337D9A2E3EBC

8 Console Messages

Source Level URL
Text
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/(Line 26)
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure stylesheet 'http://bull.eu.org/css/normalize.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/(Line 28)
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure stylesheet 'http://bull.eu.org/css/zozo.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/(Line 30)
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure stylesheet 'http://bull.eu.org/css/highlight.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure script 'http://bull.eu.org/js/jquery-3.5.1.min.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/(Line 169)
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure stylesheet 'http://bull.eu.org/css/fancybox.min.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure script 'http://bull.eu.org/js/fancybox.min.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure script 'http://bull.eu.org/js/zozo.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/
Message:
Mixed Content: The page at 'https://hugo-blog-odt.pages.dev/posts/cloudflare_301_redirect/' was loaded over HTTPS, but requested an insecure favicon 'http://bull.eu.org/images/favicon.ico'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff