Submitted URL: http://webmail22yiytdyufuye5eu.pages.dev/
Effective URL: https://webmail22yiytdyufuye5eu.pages.dev/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 23 via api from IT — Scanned from NL

Summary

This website contacted 5 IPs in 5 countries across 5 domains to perform 8 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is webmail22yiytdyufuye5eu.pages.dev.
TLS certificate: Issued by WE1 on October 23rd 2024. Valid for: 3 months.
This is the only time webmail22yiytdyufuye5eu.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 188.114.97.3 13335 (CLOUDFLAR...)
2 104.17.24.14 13335 (CLOUDFLAR...)
1 2 190.183.195.2 20207 (Gigared S.A.)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
8 5
Apex Domain
Subdomains
Transfer
3 pages.dev
webmail22yiytdyufuye5eu.pages.dev
75 KB
2 gigared.com
webmail.gigared.com
6 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
88 KB
1 pnghut.com
img1.pnghut.com — Cisco Umbrella Rank: 662015
10 KB
1 gstatic.com
encrypted-tbn0.gstatic.com
4 KB
8 5
Domain Requested by
3 webmail22yiytdyufuye5eu.pages.dev webmail22yiytdyufuye5eu.pages.dev
2 webmail.gigared.com 1 redirects webmail22yiytdyufuye5eu.pages.dev
2 cdnjs.cloudflare.com webmail22yiytdyufuye5eu.pages.dev
cdnjs.cloudflare.com
1 img1.pnghut.com
1 encrypted-tbn0.gstatic.com webmail22yiytdyufuye5eu.pages.dev
8 5

This site contains no links.

Subject Issuer Validity Valid
webmail22yiytdyufuye5eu.pages.dev
WE1
2024-10-23 -
2025-01-21
3 months crt.sh
cdnjs.cloudflare.com
WE1
2024-09-28 -
2024-12-27
3 months crt.sh
*.gstatic.com
WR2
2024-10-07 -
2024-12-30
3 months crt.sh
pnghut.com
WE1
2024-10-06 -
2025-01-04
3 months crt.sh

This page contains 1 frames:

Primary Page: https://webmail22yiytdyufuye5eu.pages.dev/
Frame ID: 0557995B653303E5D0E5BB1E97133C5D
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Webmail Login

Page URL History Show full URLs

  1. http://webmail22yiytdyufuye5eu.pages.dev/ HTTP 307
    https://webmail22yiytdyufuye5eu.pages.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

8
Requests

88 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

5
Countries

182 kB
Transfer

369 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://webmail22yiytdyufuye5eu.pages.dev/ HTTP 307
    https://webmail22yiytdyufuye5eu.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://webmail.gigared.com/cPanel_magic_revision_1610662436/unprotected/cpanel/images/webmail-logo.svg HTTP 308
  • https://webmail.gigared.com/unprotected/cpanel/images/webmail-logo.svg

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
webmail22yiytdyufuye5eu.pages.dev/
Redirect Chain
  • http://webmail22yiytdyufuye5eu.pages.dev/
  • https://webmail22yiytdyufuye5eu.pages.dev/
1013 B
1 KB
Document
General
Full URL
https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
821a9b401cbde6a6c3c948e500c1d431907f143f65af6204e8d172acd04b6a24
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8d73d62e3fc99fd0-AMS
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 23 Oct 2024 18:37:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jVjxvlKcV0xSP3U88lhA22%2BDTMXjFjNWGqyJtYL2agRArezhPChjQQjrY9c6m4Ebj0Bm8v6s1qs5j%2BUJtAxx9aTVPdfWpGmXXp6ckz%2B%2FC0ierNd9Bfni1HO72Z2Srml9hwnZ1d%2B0ZjrlP7KVVbyEvGsXcYQ%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=15839&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4173&recv_bytes=4454&delivery_rate=35039&cwnd=12000&unsent_bytes=0&cid=4f2ae105382970cc&ts=102&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://webmail22yiytdyufuye5eu.pages.dev/
Non-Authoritative-Reason
HSTS
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/
58 KB
11 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css
Requested by
Host: webmail22yiytdyufuye5eu.pages.dev
URL: https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://webmail22yiytdyufuye5eu.pages.dev
Referer

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"613fa20b-28de"
age
153339
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZWGI%2BxLcyekGuO47gNqKpvaF06BB0wZImyXjLSMv9ktd38GV7OHPfIDREbYtLKIgmKqya5ZdDPgA58NTupqBKCLycwVg7yoUvvZjtGMx6EJpAJ4OndxtHcSMm%2Fo%2BHRy%2FaefOPvC"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Mon, 13 Oct 2025 18:37:08 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 23 Oct 2024 18:37:08 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 13 Sep 2021 19:10:03 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d73d62fe96c0e40-AMS
accept-ranges
bytes
access-control-allow-origin
*
content-length
10462
server
cloudflare
main.25669b58.js
webmail22yiytdyufuye5eu.pages.dev/static/js/
215 KB
73 KB
Script
General
Full URL
https://webmail22yiytdyufuye5eu.pages.dev/static/js/main.25669b58.js
Requested by
Host: webmail22yiytdyufuye5eu.pages.dev
URL: https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
233fff54ff79b1fe2eabf493ea6e07b1cdf8c468932b73753bb840e235536d21
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://webmail22yiytdyufuye5eu.pages.dev/

Response headers

content-encoding
br
etag
W/"64eed09aece1145450727c621f2d70ca"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NaNoft6kfOJlyUhvMdPeKHKZSyIcUKtBRj39S4yhbfZNOKlPaarJC92%2FU6kllMZYIIHqJWtjjFMGXTV63HLjoWjXihDmsBJYnbiDlkiiOoxC1vZQiVTckst4nwUlo8WbSi59YKNl2HP4X3eDcn85pTg7PXo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=17477&sent=15&recv=13&lost=0&retrans=0&sent_bytes=6238&recv_bytes=5185&delivery_rate=23968&cwnd=12000&unsent_bytes=0&cid=4f2ae105382970cc&ts=266&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 23 Oct 2024 18:37:08 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8d73d62f59989fd0-AMS
access-control-allow-origin
*
server
cloudflare
main.31d6cfe0.css
webmail22yiytdyufuye5eu.pages.dev/static/css/
0
704 B
Stylesheet
General
Full URL
https://webmail22yiytdyufuye5eu.pages.dev/static/css/main.31d6cfe0.css
Requested by
Host: webmail22yiytdyufuye5eu.pages.dev
URL: https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://webmail22yiytdyufuye5eu.pages.dev/

Response headers

etag
"9e7a27539226d700e116522ee435029d"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q51jrClS1LoJ1TdJUqJ0LNg%2Bykz1SBHuZ3OMXTXtvri%2BUllfBtc%2Fpqcz89Y2bAorvy1RgsQxn3Y9JCU0tFOjiZ2rgQUoOA0yIlGsz7DCZPn6fAo6MRSRxNw33erm9gJKwC4U1r0TWzLIopCArN6LP1mg0HE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=17477&sent=14&recv=13&lost=0&retrans=0&sent_bytes=5511&recv_bytes=5185&delivery_rate=23968&cwnd=12000&unsent_bytes=0&cid=4f2ae105382970cc&ts=254&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 23 Oct 2024 18:37:08 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8d73d62f599a9fd0-AMS
access-control-allow-origin
*
content-length
0
server
cloudflare
webmail-logo.svg
webmail.gigared.com/unprotected/cpanel/images/
Redirect Chain
  • https://webmail.gigared.com/cPanel_magic_revision_1610662436/unprotected/cpanel/images/webmail-logo.svg
  • https://webmail.gigared.com/unprotected/cpanel/images/webmail-logo.svg
5 KB
6 KB
Image
General
Full URL
https://webmail.gigared.com/unprotected/cpanel/images/webmail-logo.svg
Requested by
Host: webmail22yiytdyufuye5eu.pages.dev
URL: https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
HTTP/1.1
Server
190.183.195.2 ParanĂ¡, Argentina, ASN20207 (Gigared S.A., AR),
Reverse DNS
panel.gigaredhost.com.ar
Software
nginx /
Resource Hash
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://webmail22yiytdyufuye5eu.pages.dev/

Response headers

Cache-Control
max-age=5184000, public
Connection
keep-alive
X-Content-Type-Options
nosniff
Expires
Sun, 22 Dec 2024 18:37:08 GMT
Content-Length
5360
Date
Wed, 23 Oct 2024 18:37:08 GMT
Content-Type
image/svg+xml
Last-Modified
Thu, 14 Jan 2021 22:13:56 GMT
Server
nginx
X-Frame-Options
SAMEORIGIN

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate, private
Location
/unprotected/cpanel/images/webmail-logo.svg
Content-Length
127
Date
Wed, 23 Oct 2024 18:37:08 GMT
Content-Type
text/html; charset="utf-8"
Server
nginx
Connection
keep-alive
images
encrypted-tbn0.gstatic.com/
3 KB
4 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRXeNlCtJpIjX0MieB0Jdtx5xI2iKL-AUJCYw&s
Requested by
Host: webmail22yiytdyufuye5eu.pages.dev
URL: https://webmail22yiytdyufuye5eu.pages.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d31991ae665557070ce9bd63cec4065c28202947ce8b73b5f3213ac1de81e0f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://webmail22yiytdyufuye5eu.pages.dev/

Response headers

age
41747
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options
nosniff
expires
Thu, 23 Oct 2025 07:01:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 23 Oct 2024 07:01:21 GMT
last-modified
Thu, 13 May 2021 16:34:44 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
content-length
3556
x-xss-protection
0
server
sffe
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/
76 KB
77 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://webmail22yiytdyufuye5eu.pages.dev
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"613fa20b-131bc"
age
152870
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HTN%2BWmIQnAxbLOti7L8O7S9RbAvcCwB7aceUKv8g%2BoRwfIibWs3EODa9V%2Flrx7wAbFJ02GbZ8uYCHOQ81onMhO6u9xsYYZ8zzqaicfYsJq%2F4hsiGiIGP%2FNqKJDPShbKGkXA0crIQ"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Mon, 13 Oct 2025 18:37:08 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 23 Oct 2024 18:37:08 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Mon, 13 Sep 2021 19:10:03 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d73d6310b310e40-AMS
accept-ranges
bytes
access-control-allow-origin
*
content-length
78268
server
cloudflare
orange-internet-hosting-service-remote-backup-trademark-webmail.jpg
img1.pnghut.com/t/6/5/1/NEYNA78DeB/
10 KB
10 KB
Other
General
Full URL
https://img1.pnghut.com/t/6/5/1/NEYNA78DeB/orange-internet-hosting-service-remote-backup-trademark-webmail.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27f4114b6f4fd8c50b740bb39ffaec98e90a93eba1ca06c21515e3913ab5d77f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://webmail22yiytdyufuye5eu.pages.dev/

Response headers

cache-control
max-age=31536000
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status
MISS
etag
"5ec44b05-27d6"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dAh5abmTJnWEbBsixwiMXJsx8FnaSCwyhAf4kma%2BTxAm8af2dZwtUqZB8LZTsiNNCQST8i047cZgO4LfuUrvWcdB8WE9g%2BZA9YYrW0htEW1JiP%2BQNljZq4RggV2fR74PNGY4S6mV4C86azvhRw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d73d639cb420e58-AMS
expires
Thu, 23 Oct 2025 18:37:10 GMT
accept-ranges
bytes
content-length
10198
date
Wed, 23 Oct 2024 18:37:10 GMT
x-xss-protection
1; mode=block
content-type
image/jpeg
last-modified
Tue, 19 May 2020 21:09:25 GMT
vary
Accept-Encoding
server
cloudflare

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://webmail22yiytdyufuye5eu.pages.dev/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff