pasteapp.com
Open in
urlscan Pro
18.173.219.86
Malicious Activity!
Public Scan
Submission: On August 23 via api from US — Scanned from US
Summary
TLS certificate: Issued by Amazon RSA 2048 M02 on March 1st 2023. Valid for: 8 months.
This is the only time pasteapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
ASN- ()
PTR: server-18-173-219-86.jfk52.r.cloudfront.net
pasteapp.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-164-115-7.jfk50.r.cloudfront.net
cdn.amplitude.com |
ASN54113 (FASTLY, US)
api.filestackapi.com | |
dialog.filestackapi.com | |
www.filestackapi.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN29990 (ASN-APPNEX, US)
PTR: 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-116-69.compute-1.amazonaws.com
pixel.mediaiqdigital.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-25-79.pit50.r.cloudfront.net
fonts.fiftythree.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-9-17.pit50.r.cloudfront.net
auth.wetransfer.com |
ASN32934 (FACEBOOK, US)
www.facebook.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-9-112.pit50.r.cloudfront.net
widget.intercom.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-240-175-230.us-west-2.compute.amazonaws.com
api.amplitude.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-25-51.pit50.r.cloudfront.net
js.intercomcdn.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-61-100.compute-1.amazonaws.com
api-iam.intercom.io |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-26-223.compute-1.amazonaws.com
paste-studio.wetransfer.net |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-25-83.pit50.r.cloudfront.net
studio-paste-cdn.fiftythree.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
fiftythree.com
fonts.fiftythree.com studio-paste-cdn.fiftythree.com |
420 KB |
6 |
pasteapp.com
pasteapp.com — Cisco Umbrella Rank: 395871 |
4 MB |
5 |
nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 246 |
2 KB |
5 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 48 |
366 KB |
4 |
wetransfer.net
paste-studio.wetransfer.net |
4 KB |
4 |
intercom.io
widget.intercom.io — Cisco Umbrella Rank: 2022 api-iam.intercom.io — Cisco Umbrella Rank: 1981 |
7 KB |
4 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37 |
21 KB |
3 |
wetransfer.com
auth.wetransfer.com — Cisco Umbrella Rank: 84325 |
5 KB |
3 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 93 |
430 B |
3 |
bing.com
bat.bing.com — Cisco Umbrella Rank: 356 |
13 KB |
3 |
filestackapi.com
api.filestackapi.com — Cisco Umbrella Rank: 88658 dialog.filestackapi.com — Cisco Umbrella Rank: 96404 www.filestackapi.com — Cisco Umbrella Rank: 70993 |
23 KB |
3 |
amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 3171 api.amplitude.com — Cisco Umbrella Rank: 1782 |
18 KB |
2 |
intercomcdn.com
js.intercomcdn.com — Cisco Umbrella Rank: 2586 |
213 KB |
2 |
google.com
www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 166 |
650 B |
2 |
adnxs.com
2 redirects
secure.adnxs.com — Cisco Umbrella Rank: 465 |
2 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 165 |
83 KB |
1 |
newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 401 |
26 KB |
1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 110 |
185 B |
1 |
mediaiqdigital.com
pixel.mediaiqdigital.com — Cisco Umbrella Rank: 12452 |
82 B |
1 |
embedly.com
cdn.embedly.com — Cisco Umbrella Rank: 12739 |
21 KB |
60 | 20 |
This site contains links to these domains. Also see Links.
Domain |
---|
paste.bywetransfer.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
pasteapp.com Amazon RSA 2048 M02 |
2023-03-01 - 2023-10-21 |
8 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
*.embedly.com Sectigo RSA Domain Validation Secure Server CA |
2022-09-15 - 2023-09-19 |
a year | crt.sh |
cdn.amplitude.com Amazon RSA 2048 M01 |
2023-01-12 - 2024-02-11 |
a year | crt.sh |
*.filestackapi.com R3 |
2023-08-05 - 2023-11-03 |
3 months | crt.sh |
www.bing.com Microsoft Azure TLS Issuing CA 05 |
2023-07-26 - 2024-01-22 |
6 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-06-02 - 2023-08-31 |
3 months | crt.sh |
fiftythree.com Amazon RSA 2048 M01 |
2023-02-28 - 2023-10-20 |
8 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
wetransfer.com Amazon RSA 2048 M02 |
2023-06-09 - 2024-07-07 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2 |
2023-04-13 - 2024-05-14 |
a year | crt.sh |
*.intercom.com Amazon RSA 2048 M02 |
2023-02-14 - 2024-03-14 |
a year | crt.sh |
*.amplitude.com COMODO RSA Domain Validation Secure Server CA |
2023-01-23 - 2024-02-14 |
a year | crt.sh |
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-18 - 2023-12-19 |
a year | crt.sh |
*.intercomcdn.com Amazon RSA 2048 M01 |
2023-02-21 - 2024-01-29 |
a year | crt.sh |
wetransfer.net Amazon RSA 2048 M01 |
2023-07-30 - 2024-08-28 |
a year | crt.sh |
This page contains 7 frames:
Primary Page:
https://pasteapp.com/p/zmJA6wuVNOO?view=g4gxFwvYLT0
Frame ID: D95BF9B0F9272C760F456FA0B842BE9C
Requests: 48 HTTP requests in this frame
Frame:
https://auth.wetransfer.com/authorize?client_id=g2cVmFDvQL6A6K390TM5XhaXta9Z8KQe&audience=aud%3A%2F%2Fpaste-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fpasteapp.com%2Fauth%2Fcallback&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=web_message&state=MDZkTE5Sa2lBVnZnazNuYU9vQk1%2BUGg2ajk3UHJ6TGJXR2k3M2dYQWR2bw%3D%3D&nonce=YjRpMWxVV3AzNU8wYzdaaGtMaTFTeXdIWGhNRkxUR01Lc042RW05ZzZWbg%3D%3D&code_challenge=S244GNR6Nn1L9BXckQAR57HSW2GMO-q0Sa-T4rXxQuY&code_challenge_method=S256&prompt=none&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMTUuMCJ9
Frame ID: FB951B958983A0E4DCB1B9373766EDEA
Requests: 1 HTTP requests in this frame
Frame:
https://dialog.filestackapi.com/dialog/comm_iframe/
Frame ID: 2CB4B30EFEC5587DAF7FADB108141E02
Requests: 1 HTTP requests in this frame
Frame:
https://www.filestackapi.com/dialog/comm_iframe/
Frame ID: B717E9885DA6561D8FF704F933C6E970
Requests: 1 HTTP requests in this frame
Frame:
https://auth.wetransfer.com/authorize?client_id=g2cVmFDvQL6A6K390TM5XhaXta9Z8KQe&audience=aud%3A%2F%2Fpaste-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fpasteapp.com%2Fauth%2Fcallback&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=web_message&state=UE0waDVSbTBGRlVzUzExLnl1aktrdEd1UkxSOEFvUDU3M3VYV0xPNXZaXw%3D%3D&nonce=eXY3RTlVOUcybGk3Sm9JNXdaUH5lTUY3cTVneTl1cEJkdjhzTjQ4WmNpUg%3D%3D&code_challenge=86tHOR2c83b7mKRUWPKxmyhXiSVo0bu8NE0jYBT0U1k&code_challenge_method=S256&prompt=none&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMTUuMCJ9
Frame ID: A147B1BC84831025F132241C1D75B838
Requests: 1 HTTP requests in this frame
Frame:
https://js.intercomcdn.com/frame-modern.668cbe03.js
Frame ID: 94272BE068FDF1CB5F1390FFB4F2C528
Requests: 5 HTTP requests in this frame
Frame:
https://auth.wetransfer.com/authorize?client_id=g2cVmFDvQL6A6K390TM5XhaXta9Z8KQe&audience=aud%3A%2F%2Fpaste-api-prod.wetransfer%2F&redirect_uri=https%3A%2F%2Fpasteapp.com%2Fauth%2Fcallback&scope=openid%20profile%20email%20offline_access&response_type=code&response_mode=web_message&state=U09tVlJkMlhnSWZEMGl6RGpBSlJ5U2gxVUQ0WnhvZnJzdTR2MDQ5ZjZ0bw%3D%3D&nonce=WFdqaUgtN1c5d0R4LXVBMTdjdUhYeUxzUWVQNkUzTjNxLS1CTWtkdzlzTA%3D%3D&code_challenge=a-8UzTdAAEqS2iZn69KWZFmlF9Gv_PePfoSSewnk4UI&code_challenge_method=S256&prompt=none&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMTUuMCJ9
Frame ID: 5DBD5749A68945407DB252E9D66A7605
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
You've received an encrypted message from sthomas@yccf.org | PasteDetected technologies
Amplitude (Analytics) ExpandDetected patterns
- cdn\.amplitude\.com
Facebook (Widgets) Expand
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Made with Paste
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://secure.adnxs.com/px?id=1244963&seg=21740900&redir=https%3A%2F%2Fpixel.mediaiqdigital.com%2Fpixel%3F%26pixel_id%3D1244963%26uid%3D%24%7BUID%7D&t=2 HTTP 307
- https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1244963%26seg%3D21740900%26redir%3Dhttps%253A%252F%252Fpixel.mediaiqdigital.com%252Fpixel%253F%2526pixel_id%253D1244963%2526uid%253D%2524%257BUID%257D%26t%3D2 HTTP 302
- https://pixel.mediaiqdigital.com/pixel?&pixel_id=1244963&uid=8771274519296302407
60 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
zmJA6wuVNOO
pasteapp.com/p/ |
110 KB 38 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor.abbecb5e788e3682f82b.css
pasteapp.com/styles/ |
309 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.63b26eeedcc1d173f9b1.css
pasteapp.com/styles/ |
35 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
179 KB 65 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
platform.js
cdn.embedly.com/widgets/ |
69 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor.dd13b84ba65ba6c0163e.js
pasteapp.com/scripts/ |
4 MB 1 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
polyfill.ac27a6b1c4fcf993d150.js
pasteapp.com/scripts/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.9da4a5ff3b5118b71f38.js
pasteapp.com/scripts/ |
6 MB 3 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
227 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amplitude-5.2.2-min.gz.js
cdn.amplitude.com/libs/ |
54 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
filestack.js
api.filestackapi.com/ |
66 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
216 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
176 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bat.js
bat.bing.com/ |
42 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
173 KB 47 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pixel
pixel.mediaiqdigital.com/ Redirect Chain
|
2 B 82 B |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 168 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque_W_Regular.woff
fonts.fiftythree.com/actief/ |
30 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
15 B 35 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
2 B 344 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
2 B 22 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1904796869803472
connect.facebook.net/signals/config/ |
135 KB 36 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
17116656.js
bat.bing.com/p/action/ |
0 118 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0
bat.bing.com/action/ |
0 360 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorize
auth.wetransfer.com/ Frame FB95 |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js
www.googletagmanager.com/gtag/ |
233 KB 81 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 69 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 242 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
stats.g.doubleclick.net/g/ |
0 17 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-spa.1097a448-1.238.0.min.js
js-agent.newrelic.com/ |
76 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jgz9nkp3
widget.intercom.io/widget/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dialog.filestackapi.com/dialog/comm_iframe/ Frame 2CB4 |
2 KB 1018 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.filestackapi.com/dialog/comm_iframe/ Frame B717 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
api.amplitude.com/ |
7 B 206 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorize
auth.wetransfer.com/ Frame A147 |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
378e1eac2f
bam.nr-data.net/1/ |
40 B 461 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
378e1eac2f
bam.nr-data.net/1/ |
40 B 461 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frame-modern.668cbe03.js
js.intercomcdn.com/ Frame 9427 |
488 KB 136 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-modern.3e20a93f.js
js.intercomcdn.com/ Frame 9427 |
249 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque_W_Bold.woff
fonts.fiftythree.com/actief/ |
30 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
378e1eac2f
bam.nr-data.net/resources/1/ |
36 B 413 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
378e1eac2f
bam.nr-data.net/ins/1/ |
0 339 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
378e1eac2f
bam.nr-data.net/ins/1/ |
0 339 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ping
api-iam.intercom.io/messenger/web/ Frame 9427 |
4 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorize
auth.wetransfer.com/ Frame 5DBD |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zmJA6wuVNOO
paste-studio.wetransfer.net/presentations/ |
9 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
policy
paste-studio.wetransfer.net/presentations/zmJA6wuVNOO/filestack/ |
709 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
zmJA6wuVNOO
paste-studio.wetransfer.net/presentations/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
policy
paste-studio.wetransfer.net/presentations/zmJA6wuVNOO/filestack/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
api-iam.intercom.io/messenger/web/ Frame 9427 |
4 B 681 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AvenirNext-Bold.woff
fonts.fiftythree.com/avenir-next/ |
104 KB 105 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AvenirNext-DemiBold.woff
fonts.fiftythree.com/avenir-next/ |
91 KB 92 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AvenirNext-Regular.woff
fonts.fiftythree.com/avenir-next/ |
124 KB 125 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1607962584701_6fVplmos.png
studio-paste-cdn.fiftythree.com/presentations/zmJA6wuVNOO/studio-public/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque_W_Medium.woff
fonts.fiftythree.com/actief/ |
31 KB 32 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
api.amplitude.com/ |
7 B 205 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
events
api-iam.intercom.io/messenger/web/ Frame 9427 |
4 B 680 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)46 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| documentPictureInPicture object| NREUM object| webpackChunk:NRBA-1.238.0.PROD object| newrelic function| gtag object| dataLayer object| amplitude object| intercomSettings function| Intercom string| releaseVersion string| PASTE_CONFIG string| CSRF_TOKEN string| DEVICE_TOKEN object| libringEventAPI function| embedly object| filepicker object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| fbq function| _fbq object| webpackJsonp object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| _ object| fiftythree object| gaGlobal function| Mousetrap object| gaplugins object| gaData function| UET function| UET_init function| UET_push object| ueto_f77e018f9f object| uetq boolean| isReady function| __intercomAssignLocation function| __intercomReloadLocation22 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.filestackapi.com/dialog/comm_iframe | Name: Value: testcookie |
|
dialog.filestackapi.com/dialog/comm_iframe | Name: Value: testcookie |
|
pasteapp.com/ | Name: present_session Value: eyJjc3JmU2VjcmV0IjoiMkNxWGJ3NktFano4RWpnZmRMXzY5UFJvIn0= |
|
pasteapp.com/ | Name: present_session.sig Value: te_biyacbQs00x6Y_hroHPHI-Tc |
|
.adnxs.com/ | Name: uuid2 Value: 8771274519296302407 |
|
.adnxs.com/ | Name: anj Value: dTM7k!M4/8CxrEQF']wIg2HaMKOZzk!@wnf-Te9(>wL5L!!'KP$fTKo |
|
.pasteapp.com/ | Name: _ga_TMQPGDT3S2 Value: GS1.1.1692833604.1.0.1692833604.0.0.0 |
|
.pasteapp.com/ | Name: _ga Value: GA1.2.1786188454.1692833604 |
|
.pasteapp.com/ | Name: _gid Value: GA1.2.514754391.1692833604 |
|
.pasteapp.com/ | Name: _dc_gtm_UA-11792855-25 Value: 1 |
|
.pasteapp.com/ | Name: _gat_gtag_UA_30418293_14 Value: 1 |
|
.pasteapp.com/ | Name: _uetsid Value: 74146120420d11ee82e843f52cc15e8b |
|
.pasteapp.com/ | Name: _uetvid Value: 74147e20420d11eeb8af4b3162a97fdc |
|
.bing.com/ | Name: MUID Value: 226A45473A356E3B259756313BBF6F72 |
|
.bat.bing.com/ | Name: MR Value: 0 |
|
auth.wetransfer.com/ | Name: did Value: s%3Av0%3A745cc930-420d-11ee-9602-31602a908bc7.GPUNhZI7nteUn3WZu%2FLoGFzdrQl5yatiU1UdfIUccqM |
|
.pasteapp.com/ | Name: _fbp Value: fb.1.1692833605101.25910150 |
|
.pasteapp.com/ | Name: _ga_LX946HRSM9 Value: GS1.2.1692833605.1.0.1692833605.60.0.0 |
|
.pasteapp.com/ | Name: intercom-id-jgz9nkp3 Value: 9a9f6b70-6c63-4c2f-aaa3-63c74f40454a |
|
.pasteapp.com/ | Name: intercom-session-jgz9nkp3 Value: |
|
.pasteapp.com/ | Name: intercom-device-id-jgz9nkp3 Value: fbd7fa8c-fd5d-4ec2-9127-7ea41d86bad4 |
|
.pasteapp.com/ | Name: amplitude_id_0b99d1fe24ad918bbe8568945c86a142pasteapp.com Value: eyJkZXZpY2VJZCI6ImQ4YmE4YjRiLWEyMDAtNDY0ZC04MjEwLTFhNTY5NDhlZTNkZFIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTY5MjgzMzYwMzY3MywibGFzdEV2ZW50VGltZSI6MTY5MjgzMzYwNzMwNiwiZXZlbnRJZCI6MiwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjJ9 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
api-iam.intercom.io
api.amplitude.com
api.filestackapi.com
auth.wetransfer.com
bam.nr-data.net
bat.bing.com
cdn.amplitude.com
cdn.embedly.com
connect.facebook.net
dialog.filestackapi.com
fonts.fiftythree.com
js-agent.newrelic.com
js.intercomcdn.com
paste-studio.wetransfer.net
pasteapp.com
pixel.mediaiqdigital.com
secure.adnxs.com
stats.g.doubleclick.net
studio-paste-cdn.fiftythree.com
widget.intercom.io
www.facebook.com
www.filestackapi.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
104.16.89.50
151.101.130.133
151.101.66.137
162.247.241.14
18.164.115.7
18.165.25.51
18.165.25.79
18.165.25.83
18.165.9.112
18.165.9.17
18.173.219.86
2001:4860:4802:32::181
2607:f8b0:4004:c0b::9a
2607:f8b0:4006:80a::200e
2607:f8b0:4006:80c::2004
2607:f8b0:4006:81c::2008
2620:1ec:c11::200
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:182:face:b00c:0:25de
3.218.116.69
35.171.61.100
44.240.175.230
52.44.26.223
68.67.160.76
13a20aa5816395cdaefc820241a6d197a2e9fa94c33c6dd9b93462a7b7dc1d2c
17c7c74c0c1644269bf78f7530adda01b74abf41e97dea3f70c941e7cb4d9577
188342239ece0e05733298bc402d0741d2ac8c4c525b3860731799e8fac971c8
2173f130ca59dc5554498343432f02f92ecce45c4f9381ea12b203a2978f33d4
2203465318dd8c2b3e41e888779e753827577f09023bff35555f82232adc302a
24c98b3653a1a89489a370d23ab35375bba6bf386f5c2cf8a34f59f1ee7ab2ee
2bc2ba90a19b1fa7c5a3288ca664fd0ddc077cd2c547affe438d05debb004d6c
2cf5bee6aaab35f8b58b4c6df0aa0b0be1eda5e75f41c614c77396d4e2690ada
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
393f705dc4c30bdfaa23fcbc243c8f29392d1e031b560e9d2a1cb1b4b3345cf1
428a5da576c256c4f4f350d32dd06850382c8907cb2026cb8bb3a03f80a52251
4603ea1b2f9df0c9d4f2a253c550ffbaf27ea2cb53ecde4277b2acf9dde33979
488711ae3363789dbdbeebbac2c75a55269356e3d11467cf731df8dd3026119b
5b28bd72df3f7f7dceab0fa3c04df29057192c9134c28a7d76b77c86b5d8e351
5c09d8cf9c4709f822a9d1e4b13156943082361f1e44175c765ef83e873c935a
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
630b2487c6cd57569c4262bfdfb96f2fcba3f9af7b4b6b75218bd81a2631905e
6800541f3fa1eb8649d45fb0836aee81202d5ae34de7bd2aadab7cc3950a8422
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
743657b27549bd78ee86bbd29360ad204115c9f30781217dddc42d32dde7b3b9
77d11aff102415b4d3e178dfc8292ca7c958a8d5f08e18b4275b0a536693e3e4
7c2817557c2b5c7e4c604fb9fc53bd080ae63447730ead7f463314771293789a
7d4b1f0c8f162ecaf25f4565ac4231cdb6a12c45149a9e70baffb5f6741167fd
95365fd7e40a48dccd396566b88ecc25a345b84861b0ef0ffba04db40f064a06
979f96e6627414aa6148479256d79b4768886137153689f9743141b853cb20b9
9e16eecb114bb36df2b69c9ce41ca963bed4a810db6bc07f271a076f6f91f495
9fd58f081ef4b4904172eca648ccb15b0215e5a263f05da7694e43202cb0ec99
a12ef796ae16690f93d98e6692d8b54f2a36b4ee911c39bfc6d44389aa2dddfb
a7851278d1fa9aadf6b50a7e0f340985a927888afe06a6f2f8f7ec6733995c0a
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af841bb91fc11a21f4af48a93d4694d2459108cad08d8791bba5332f0487d692
b23fe6e755a035635e9e2e32f1df61e5143b644dd451ac6cebec6bce367de684
b2cffb3d4620ddeb697ba04e787b68c7749efaa66614d9c6d16bc6082444f3bb
b4a0c5394100f125644330f1ab4c51647f872d22dfc8bad90206c748a1215a4d
ba42167573bc1d7c7ea1b7872fd62df470a8ec5351c5d66cd98928649827217d
c4a97b41fcbbf9e6c29d0280a79761f082bd66d356bc753e7229c6ac471bf99e
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f
d348f96376b16af091e56cfc086dd89c7156c40bd23400278bfd05062dec1dd0
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e10808d43975dc400731053386849f864f297e6c4f7519c380f3dbaf7067a840
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec140ae8baa4b61226d96beba9277a0072e45b805004b8ea983c5d43402aeb66
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f924dec24ab2a814e41adeddb24961c987f57d956c258774984bb2443ba1267c
fa184bd409648522465575a2598716e6461d5b8272bf00ab4e40d3879320868b
fda116f5fc53110dd655e5b1e409d480db44039e36676f8f6bebefab3181e2af