urlscan.io logo urlscan.io
SecurityTrails logo

pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev Open in urlscan Pro
162.159.140.237  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Submission: On November 14 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 2 countries across 7 domains to perform 19 HTTP transactions. The main IP is 162.159.140.237, located in and belongs to CLOUDFLARENET, US. The main domain is pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev.
TLS certificate: Issued by E5 on September 29th 2024. Valid for: 3 months.
This is the only time pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

Domain & IP information

IP Address AS Autonomous System
3 162.159.140.237 13335 (CLOUDFLAR...)
1 172.253.115.113 15169 (GOOGLE)
3 151.101.2.137 54113 (FASTLY)
3 104.17.24.14 13335 (CLOUDFLAR...)
2 104.18.11.207 13335 (CLOUDFLAR...)
2 104.18.10.207 13335 (CLOUDFLAR...)
1 142.251.16.95 15169 (GOOGLE)
2 172.253.122.94 15169 (GOOGLE)
1 172.253.62.95 15169 (GOOGLE)
1 142.251.16.94 15169 (GOOGLE)
19 12
3    162.159.140.237 (None, )

ASN13335 (CLOUDFLARENET, US)
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1    172.253.115.113 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f113.1e100.net
translate.google.com
3    151.101.2.137 (San Francisco, United States)

ASN54113 (FASTLY, US)
code.jquery.com
3    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
2    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    142.251.16.95 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f95.1e100.net
ajax.googleapis.com
2    172.253.122.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f94.1e100.net
www.gstatic.com
1    172.253.62.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f95.1e100.net
translate.googleapis.com
1    142.251.16.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
4 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3697
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1436
54 KB
3 gstatic.com
www.gstatic.com
fonts.gstatic.com
10 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 275
14 KB
3 jquery.com
code.jquery.com — Cisco Umbrella Rank: 923
77 KB
3 r2.dev
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
177 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 478
translate.googleapis.com — Cisco Umbrella Rank: 1240
104 KB
1 google.com
translate.google.com — Cisco Umbrella Rank: 1491
29 KB
19 7
Domain Requested by
3 cdnjs.cloudflare.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
3 code.jquery.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
3 pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 www.gstatic.com www.gstatic.com
2 maxcdn.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 stackpath.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 fonts.gstatic.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.googleapis.com
1 ajax.googleapis.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.google.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
19 10

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E5		 2024-09-29 -
2024-12-28		 3 months crt.sh
*.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.gstatic.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Frame ID: 0348B76B16B0B09C11F465843A44D813
Requests: 25 HTTP requests in this frame

Frame: data://truncated
Frame ID: E78E81FA6B02AFCF757437E72A8FB77B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Credentials

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

7
Domains

10
Subdomains

12
IPs

2
Countries

465 kB
Transfer

1071 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request owasecure.htm
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		150 KB
151 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8e2a6a26b8bda1e6-YYZ
Connection
keep-alive
Content-Length
153823
Content-Type
text/html
Date
Thu, 14 Nov 2024 22:24:57 GMT
ETag
"09b3347f28753600d23d1d97dbf7db98"
Last-Modified
Tue, 15 Oct 2024 00:34:43 GMT
Server
cloudflare
Vary
Accept-Encoding
element.js
translate.google.com/translate_a/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f113.1e100.net
Software
ESF /
Resource Hash
a4ee50699c62238edb757234dddc3c1684f61178b08b993e4f58dccfcfd61e91
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin-allow-popups
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 22:24:57 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-1538f"
age
1235919
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 22:24:57 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
5491, 48033
x-served-by
cache-lga21927-LGA, cache-yyz4582-YYZ
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731623098.790358,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30288
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-500f"
age
11579
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFxvdeFn8U9DyOLYgg%2BBnUyC2Yd%2Fcr5HJVHM1zIKhyxHHtOtzHt0Vmb4SQ6WCsVVZ0d54JMmAu5bp2rViZqdP2zFFuXmBscZ5%2Fz27cViqpWcmLVJrG8%2FRPYVrcWmxxSuDeGq15ry"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 22:24:57 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 22:24:57 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2a6a28cc243705-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
6458
server
cloudflare
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"ce6e785579ae4cb555c9de311d1b9271"
age
97448
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
content-type
application/javascript; charset=utf-8
cdn-cachedat
09/24/2024 09:00:48
cdn-cache
HIT
priority
u=1,i=?0
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-pullzone
252412
cdn-proxyver
1.04
cdn-triggerededgerule
572817ab-2873-4760-8981-0132b6a2299e, cf31a005-2e3c-44f6-b953-b8e290a7a46a, c1a973b5-a84a-4683-8b33-9ecca22c4b68, a9841ad5-01f0-4e2a-8f0b-b2757cb10c8c, 3bfb2eee-3581-4a9c-8162-a4adf5fe8e3e, ae1df8d8-8ccd-4986-a814-6c70053e3c56, aa9d6962-b964-45ba-9961-53d19a1d79f9, fce06edf-465b-445b-839a-48b8ac604776
cdn-edgestorageid
1067
server
cloudflare
cdn-requestcountrycode
US
date
Thu, 14 Nov 2024 22:24:57 GMT
vary
Accept-Encoding
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cdn-requesttime
0
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
2b1740e13e81a249a5c956f6d9660919
cross-origin-resource-policy
cross-origin
cf-ray
8e2a6a28c845ac72-YYZ
access-control-allow-origin
*
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-1111d"
age
1586600
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 22:24:58 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
6089, 18581
x-served-by
cache-lga21982-LGA, cache-yyz4537-YYZ
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731623098.069884,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
24038
server
nginx
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"5869c96cc8f19086aee625d670d741f9"
age
91445
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
content-type
application/javascript; charset=utf-8
cdn-cachedat
09/24/2024 09:00:39
cdn-cache
HIT
priority
u=1,i=?0
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-pullzone
252412
cdn-proxyver
1.04
cdn-triggerededgerule
572817ab-2873-4760-8981-0132b6a2299e, cf31a005-2e3c-44f6-b953-b8e290a7a46a, c1a973b5-a84a-4683-8b33-9ecca22c4b68, a9841ad5-01f0-4e2a-8f0b-b2757cb10c8c, 3bfb2eee-3581-4a9c-8162-a4adf5fe8e3e, ae1df8d8-8ccd-4986-a814-6c70053e3c56, aa9d6962-b964-45ba-9961-53d19a1d79f9, fce06edf-465b-445b-839a-48b8ac604776
cdn-edgestorageid
1068
server
cloudflare
cdn-requestcountrycode
US
date
Thu, 14 Nov 2024 22:24:57 GMT
vary
Accept-Encoding
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cdn-requesttime
0
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
151d9733965c638590c204a11283ae6f
cross-origin-resource-policy
cross-origin
cf-ray
8e2a6a28ca86aba8-YYZ
access-control-allow-origin
*
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-10fdd"
age
1955120
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 22:24:58 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
32454, 27413
x-served-by
cache-lga21984-LGA, cache-yyz4537-YYZ
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731623098.069941,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
23856
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-4af4"
age
16457
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tyytQp6oUOrJEdSLBWaOG4Tt4o8jXKcfL0Ff4tLwlktRP%2F9QEi4y%2F3LaPI4dpBDX3gnwurX29Pi1LrSw1Nqjy5C4YmbBF0jQUzt955lv9SCTv5ml2Mt5CMqGYxi6%2Fqtav%2B29lLuX"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 22:24:57 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 22:24:57 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2a6a28bc203705-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"14d449eb8876fa55e1ef3c2cc52b0c17"
age
91445
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 14 Nov 2024 22:24:57 GMT
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
11/06/2024 23:22:44
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
38aeca0865e4872e98e473ecc05e8e40
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.06
cf-ray
8e2a6a28ca82aba8-YYZ
access-control-allow-origin
*
cdn-edgestorageid
1067
server
cloudflare
cdn-requestcountrycode
US
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.95 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f95.1e100.net
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
538312
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 16:53:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 08 Nov 2024 16:53:05 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"67176c242e1bdc20603c878dee836df3"
age
1094340
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 14 Nov 2024 22:24:57 GMT
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
10/04/2024 02:53:43
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
3103fbaec57f696fc9c2ffb078e0a058
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2a6a28cab9aa9b-YYZ
access-control-allow-origin
*
cdn-edgestorageid
1029
server
cloudflare
cdn-requestcountrycode
US
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=GAw/d=1/rs=AN8SPfperZTWc9db843A0DVCAAainhyX2Q/m=el_conf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
183268
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 19:30:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 12 Nov 2024 19:30:30 GMT
last-modified
Thu, 04 Apr 2024 07:26:25 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
4144
x-xss-protection
0
server
sffe
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfr_tCeR31cIgy2F0639_cakYeTY6A/ 		214 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfr_tCeR31cIgy2F0639_cakYeTY6A/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=GAw/d=1/rs=AN8SPfperZTWc9db843A0DVCAAainhyX2Q/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bc-in-f95.1e100.net
Software
sffe /
Resource Hash
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
15126
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Fri, 14 Nov 2025 18:12:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 18:12:52 GMT
last-modified
Wed, 13 Nov 2024 22:15:54 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
75181
x-xss-protection
0
server
sffe
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
segoeui-regular.ttf
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com

Response headers

CF-RAY
8e2a6a2a6da3a1e6-YYZ
Content-Length
27150
Date
Thu, 14 Nov 2024 22:24:58 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-500f"
age
11579
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VFxvdeFn8U9DyOLYgg%2BBnUyC2Yd%2Fcr5HJVHM1zIKhyxHHtOtzHt0Vmb4SQ6WCsVVZ0d54JMmAu5bp2rViZqdP2zFFuXmBscZ5%2Fz27cViqpWcmLVJrG8%2FRPYVrcWmxxSuDeGq15ry"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 22:24:57 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 22:24:57 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2a6a28cc243705-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
6458
server
cloudflare
truncated
/ Frame E78E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Content-Type
text/html;charset=UTF-8
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 		6 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f94.1e100.net
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
537125
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 17:12:53 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 08 Nov 2024 17:12:53 GMT
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
3340
x-xss-protection
0
server
sffe
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.122.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bh-in-f94.1e100.net
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css

Response headers

age
1108
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Fri, 14 Nov 2025 22:06:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 22:06:30 GMT
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
1842
x-xss-protection
0
server
sffe
favicon.ico
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		27 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com

Response headers

CF-RAY
8e2a6a300c45a1e6-YYZ
Content-Length
27150
Date
Thu, 14 Nov 2024 22:24:59 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| setCookie function| getLanguageCode function| googleTranslateElementInit function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| mainLogonDiv function| $ function| jQuery function| Popper object| bootstrap object| closure_lm_625652

1 Cookies

Domain/Path Name / Value
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ Name: googtrans
Value: /en/en

16 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
recommendation verbose URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=c%2a%2a%2a%2a%2a%2a%40s%2a%2a%2a%2a.com
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
stackpath.bootstrapcdn.com
translate.google.com
translate.googleapis.com
www.gstatic.com
104.17.24.14
104.18.10.207
104.18.11.207
142.251.16.94
142.251.16.95
151.101.2.137
162.159.140.237
172.253.115.113
172.253.122.94
172.253.62.95
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66
a4ee50699c62238edb757234dddc3c1684f61178b08b993e4f58dccfcfd61e91
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b