urlscan.io logo urlscan.io
SecurityTrails logo

pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev Open in urlscan Pro
104.18.2.35  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://diamond84257.emlnk.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y
Effective URL: https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Submission: On July 29 via manual from LV — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 7 HTTP transactions. The main IP is 104.18.2.35, located in and belongs to CLOUDFLARENET, US. The main domain is pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 54.82.80.250 14618 (AMAZON-AES)
1 1 104.17.203.31 13335 (CLOUDFLAR...)
1 104.18.2.35 13335 (CLOUDFLAR...)
2 104.18.41.169 13335 (CLOUDFLAR...)
1 172.253.63.95 15169 (GOOGLE)
1 142.251.16.95 15169 (GOOGLE)
2 64.233.180.94 15169 (GOOGLE)
7 6
1    54.82.80.250 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-82-80-250.compute-1.amazonaws.com
diamond84257.emlnk.com
1    104.17.203.31 (None, )

ASN13335 (CLOUDFLARENET, US)
diamond84257.activehosted.com
1    104.18.2.35 (None, )

ASN13335 (CLOUDFLARENET, US)
pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
2    104.18.41.169 (None, )

ASN13335 (CLOUDFLARENET, US)
bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
bafkreiczv23yr36fkofiyzji4mo5qnruuzpi65y3c2coqun6kv4tzpq3oq.ipfs.w3s.link
1    172.253.63.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f95.1e100.net
fonts.googleapis.com
1    142.251.16.95 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f95.1e100.net
ajax.googleapis.com
2    64.233.180.94 (United States)

ASN15169 (GOOGLE, US)
PTR: pe-in-f94.1e100.net
fonts.gstatic.com
Domain Requested by
2 fonts.gstatic.com fonts.googleapis.com
1 ajax.googleapis.com bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
1 fonts.googleapis.com bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
1 bafkreiczv23yr36fkofiyzji4mo5qnruuzpi65y3c2coqun6kv4tzpq3oq.ipfs.w3s.link pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
1 bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
1 pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
1 diamond84257.activehosted.com 1 redirects
1 diamond84257.emlnk.com 1 redirects
7 8

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2024-06-03 -
2024-09-01		 3 months crt.sh
w3s.link
E6		 2024-07-14 -
2024-10-12		 3 months crt.sh
upload.video.google.com
WR2		 2024-07-01 -
2024-09-23		 3 months crt.sh
*.gstatic.com
WR2		 2024-07-01 -
2024-09-23		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Frame ID: 2CDF15C28893AE2887C32957B4E52158
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Webmail Login

Page URL History Show full URLs

  1. https://diamond84257.emlnk.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y HTTP 307
    https://diamond84257.activehosted.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y HTTP 302
    https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

6
IPs

2
Countries

381 kB
Transfer

2073 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://diamond84257.emlnk.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y HTTP 307
    https://diamond84257.activehosted.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y HTTP 302
    https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request web.html
pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/
Redirect Chain
  • https://diamond84257.emlnk.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y
  • https://diamond84257.activehosted.com/lt.php?x=3TxtmrUFUqPUT55qA1M6Ufau_pR.mPkWrA5hXoM9U4j4I7ah7Nh4iVdw5XFzi.~y
  • https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
269 B
578 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.18.2.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bac04fbad03ae1eb9e4116e69412897a25adebf16592748a317b5ed6e4e3f7b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8aac8039cb43ac7c-YYZ
Connection
keep-alive
Content-Length
269
Content-Type
text/html
Date
Mon, 29 Jul 2024 10:42:12 GMT
ETag
"0fd0570de31eff51fb30b40e7637b1fd"
Last-Modified
Mon, 29 Jul 2024 09:43:43 GMT
Server
cloudflare
Vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8aac8037ffc939cf-YYZ
content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 29 Jul 2024 10:42:12 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-privacy-policy
You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
x-request-id
85a7f08f7b2e320954b9d4e497c2de88
x-robots-tag
noindex
/
bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ 		2 MB
272 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/
Requested by
Host: pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
URL: https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.41.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a26cc80387362efb1c46ed7f64d947a79da95e997dae2a5474926d52ef45193
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage

Request headers

Referer
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:42:12 GMT
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage
content-encoding
gzip
cf-cache-status
HIT
age
6975
x-dotstorage-resolution-id
cache-zone
server-timing
request;dur=99
reporting-endpoints
csp-endpoint="https://csp-report-to.web3.storage"
server
cloudflare
etag
W/"bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/plain; charset=ASCII
access-control-allow-origin
*
x-freeway-version
2.19.0
access-control-expose-headers
Link
cache-control
public, max-age=29030400
x-dotstorage-resolution-layer
cdn
cf-ray
8aac803deb79ac34-YYZ
expires
Mon, 30 Jun 2025 10:42:12 GMT
/
bafkreiczv23yr36fkofiyzji4mo5qnruuzpi65y3c2coqun6kv4tzpq3oq.ipfs.w3s.link/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bafkreiczv23yr36fkofiyzji4mo5qnruuzpi65y3c2coqun6kv4tzpq3oq.ipfs.w3s.link/
Requested by
Host: pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
URL: https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.41.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59aeb788efc5538a8c6528e31dd83634a65e8f771b1684e851be55793cbe1b74
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage

Request headers

Referer
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:42:13 GMT
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage
content-encoding
gzip
x-dotstorage-resolution-id
https://freeway.dag.haus
server-timing
request;dur=796
reporting-endpoints
csp-endpoint="https://csp-report-to.web3.storage"
server
cloudflare
etag
W/"bafkreiczv23yr36fkofiyzji4mo5qnruuzpi65y3c2coqun6kv4tzpq3oq"
x-dotstorage-anchor
a3e13e1ac198254e8aaaf562a9bff299a1d661bbfb5cec7257c083e9cca4f4e4
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/plain; charset=ASCII
access-control-allow-origin
*
x-freeway-version
2.19.0
access-control-expose-headers
Link
cache-control
public, max-age=29030400, immutable
x-dotstorage-resolution-layer
dotstorage-race
cf-ray
8aac803e0940ab5a-YYZ
css2
fonts.googleapis.com/ 		23 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap
Requested by
Host: bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.63.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f95.1e100.net
Software
ESF /
Resource Hash
2af467e5c74d9700a4f33f351d77f5d9a20abf58203d5dfdc5209095d8acf768
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 29 Jul 2024 10:42:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 29 Jul 2024 09:19:10 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 29 Jul 2024 10:42:13 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.16.95 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS
bl-in-f95.1e100.net
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 29 Jul 2024 09:39:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3779
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 29 Jul 2025 09:39:14 GMT
truncated
/ 		37 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e8f7e8e8672e4713a862483e86dd0eefbc326e2bc374e9fa21167cca50e07499

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		320 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 		47 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.180.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pe-in-f94.1e100.net
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sat, 27 Jul 2024 09:49:52 GMT
x-content-type-options
nosniff
age
175941
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 27 Jul 2025 09:49:52 GMT
truncated
/ 		450 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
fonts.gstatic.com/s/opensans/v40/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.180.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pe-in-f94.1e100.net
Software
sffe /
Resource Hash
7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sat, 27 Jul 2024 17:03:03 GMT
x-content-type-options
nosniff
age
149950
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24984
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:04:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 27 Jul 2025 17:03:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x5056 function| _0x1cde function| _0x3a61bd function| $ function| jQuery function| _0xed16 function| showEl function| _0x35cd function| hideEl

4 Cookies

Domain/Path Name / Value
diamond84257.activehosted.com/ Name: PHPSESSID
Value: 22ee7b048d2bac802848497380e72c5a
.diamond84257.activehosted.com/ Name: cmp1003242768
Value: 404ad93e37ed28317d8021c74d905a88
.activehosted.com/ Name: __cf_bm
Value: fhM4sZGzwwGodL3e5kJukcDSyr4Q6gUZ2XQBiNK6obg-1722249732-1.0.1.1-.ecd.DG8SlqHH6Q_oQfNjtTc2hHbNU3PbUPx.FTIQoo0y_pdOfPn3Z4WlryZ.hp3VuXUUQ7Kvq3aQcK5HQR68w
.w3s.link/ Name: __cf_bm
Value: Il3t8iBooERIBozEvHiD.1RUY_BKvAjDRGcY.jZ.FDU-1722249733-1.0.1.1-q3_BrJkncel1V6G5m4xq2Oy_MPxVKfZVEueEpxQxZRQPMIBVPyJPztX0wgjnkAfQKCWIZ8.mFTnuEgrn5hUQkg

3 Console Messages

Source Level URL
Text
javascript warning URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://pub-3a163fa6a2ab4047a0890e0e1e0585d7.r2.dev/web.html
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o