online.affirmatoin.shop Open in urlscan Pro
2606:4700:3037::6815:188a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Page URL
2. https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	mordenization.html online.affirmatoin.shop/	100 KB 14 KB	2804ms 2707ms	Document text/html	2606:4700:3037::6815:188a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:188a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 7dde9b67ea8a333d-MIA content-encoding br content-type text/html; charset=UTF-8 date Tue, 27 Jun 2023 15:08:46 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TWR4ABhAyS1zZkBDGOsxKtl8GaZzI6AWwvUypsELXtaXVTtgBptdQBKvQLe6UYNK%2BGDYqDvumV8DtpUh8vNtZtE%2Bzr4CHdD5e%2BweWFxhGEPazgTch8RXaWkwBdEwmOSbjILFXZff3kCFDScFh7FGi6NnG4MV0g%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options DENY x-turbo-charged-by LiteSpeed
GET DATA	200 OK	truncated /	5 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/gif
POST H2	200	Primary Request mordenization.html Show response online.affirmatoin.shop/	46 KB 17 KB	862ms 861ms	Document text/html	2606:4700:3037::6815:188a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:188a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f08f11f1f08c6aa24d166c1475f158a22f4ac5d04fb1a837f4a2734a92e1f76 Security Headers Name Value X-Frame-Options DENY Request headers Content-Type application/x-www-form-urlencoded Origin https://online.affirmatoin.shop Referer https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 7dde9b7b3c95333d-MIA content-encoding br content-type text/html; charset=UTF-8 date Tue, 27 Jun 2023 15:08:48 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7VfQdG%2Bev8xD2CzLt%2FwrVkuZcrw6tm5n%2BJafQvNqb7zMIuArVMxumra39PrPwRuKmWqsZpE5QFGZJAPds4wc%2FaZ2TuGPPSu5nI7BHEZ5Eca%2FNntVwvMwNvaQD2RLzWYJESFF0Z4TAt9CJCu6tK%2BWEFDYkpSfhg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options DENY x-turbo-charged-by LiteSpeed
GET H2	200	element.js Show response translate.google.com/translate_a/	85 KB 30 KB	287ms 103ms	Script text/javascript	2607:f8b0:4006:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit Requested by Host: online.affirmatoin.shop URL: https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:824::200e Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d017f361d69bdbd778fbc662ca5af3befe80b48a824b5a401c68cc2d6f1a7528 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://online.affirmatoin.shop/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers pragma no-cache date Tue, 27 Jun 2023 15:08:48 GMT content-encoding gzip x-content-type-options nosniff server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	m=el_main_css www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/	25 KB 5 KB	224ms 64ms	Stylesheet text/css	2607:f8b0:4006:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/m=el_main_css Requested by Host: URL: /_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/m=el_conf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7db470720bc87269e9bf81c2da2649d4f59d54eb54ca5ed4547855758d6688a0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://online.affirmatoin.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 26 Jun 2023 19:17:03 GMT content-encoding gzip x-content-type-options nosniff age 71505 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4396 x-xss-protection 0 last-modified Sun, 12 Mar 2023 00:11:57 GMT server sffe cross-origin-opener-policy same-origin; report-to="rosetta" vary Accept-Encoding report-to {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]} content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 25 Jun 2024 19:17:03 GMT
GET H2	200	m=el_main Show response translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/exm=el_conf/ed=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/	215 KB 76 KB	236ms 64ms	Script text/javascript	2607:f8b0:4006:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/exm=el_conf/ed=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/m=el_main Requested by Host: URL: /_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/m=el_conf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81e::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5bfc98b868806e22d2de205dbefb7401ada224583dade0e1a06acd3e92eb4cb9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://online.affirmatoin.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 26 Jun 2023 17:18:34 GMT content-encoding gzip x-content-type-options nosniff age 78614 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 77403 x-xss-protection 0 last-modified Sat, 24 Jun 2023 03:09:33 GMT server sffe cross-origin-opener-policy same-origin; report-to="rosetta" vary Accept-Encoding report-to {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 25 Jun 2024 17:18:34 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6675b179d2d8eb50ad05f3658330cace232e923ffc8291a62e08fabad0555bdf Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	782 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8a6dbab00954f416062b255e3bddfc93d4764e35befbc706249a6a62f649e3db Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	840 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d0893bd64649158f0ccd1f26269eebc9c7b3fc3107afe55b4c6266149f5bed5d Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	7 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6df75cd7c2c93db9cd66ee448461bc41d50ccaf7feb716144d68c36fbbd8344a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated Show response / Frame 3C54	1 KB 1 KB		Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7637a4cc7e15b52376c9dba975683af0b7987a44b3d05200747c035a6852274 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Content-Type text/html;charset=UTF-8
GET H2	200	translate_24dp.png www.gstatic.com/images/branding/product/2x/	2 KB 2 KB	63ms 62ms	Image image/png	2607:f8b0:4006:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/product/2x/translate_24dp.png Requested by Host: www.gstatic.com URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/m=el_main_css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/m=el_main_css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 26 Jun 2023 15:34:55 GMT x-content-type-options nosniff age 84834 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1842 x-xss-protection 0 last-modified Thu, 14 Oct 2021 09:08:00 GMT server sffe vary Origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/png cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Tue, 25 Jun 2024 15:34:55 GMT
GET H2	200	m=el_main_css www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/ Frame 7B22	25 KB 4 KB	62ms 61ms	Stylesheet text/css	2607:f8b0:4006:80d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.69JJaQ5G5xA.L.W.O/d=0/rs=AN8SPfpC36MIoWPngdVwZ4RUzeJYZaC7rg/m=el_main_css Requested by Host: translate.googleapis.com URL: https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/exm=el_conf/ed=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/m=el_main Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80d::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7db470720bc87269e9bf81c2da2649d4f59d54eb54ca5ed4547855758d6688a0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://online.affirmatoin.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Mon, 26 Jun 2023 19:17:03 GMT content-encoding gzip x-content-type-options nosniff age 71506 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4396 x-xss-protection 0 last-modified Sun, 12 Mar 2023 00:11:57 GMT server sffe cross-origin-opener-policy same-origin; report-to="rosetta" vary Accept-Encoding report-to {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]} content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 25 Jun 2024 19:17:03 GMT
GET H2	200	24px.svg fonts.gstatic.com/s/i/productlogos/translate/v14/	6 KB 4 KB	222ms 67ms	Image image/svg+xml	2607:f8b0:4006:820::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg Requested by Host: online.affirmatoin.shop URL: https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://online.affirmatoin.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 22 Jun 2023 18:54:28 GMT content-encoding gzip x-content-type-options nosniff age 418461 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3340 x-xss-protection 0 last-modified Wed, 20 Apr 2022 14:24:23 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 21 Jun 2024 18:54:28 GMT
GET H2	200	cleardot.gif www.google.com/images/	43 B 505 B	256ms 100ms	Image image/gif	2607:f8b0:4006:821::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/images/cleardot.gif Requested by Host: online.affirmatoin.shop URL: https://online.affirmatoin.shop/mordenization.html?let=QT1WNUw7Jy1TPFcpUzAmLUg5NzlSO1ZYTjtWWU06Ni1SO1ctTzlHME44Vl1N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2004 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://online.affirmatoin.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Tue, 27 Jun 2023 15:08:49 GMT x-content-type-options nosniff last-modified Tue, 22 Oct 2019 18:30:00 GMT server sffe report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/gif cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	log Show response translate.googleapis.com/element/	131 B 152 B	137ms 137ms	XHR text/plain	2607:f8b0:4006:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0 Requested by Host: URL: /_/translate_http/_/js/k=translate_http.tr.en_US.-YQEAOJdpbU.O/d=1/rs=AN8SPfoOu3dkvdcamx_uoduV_WS9KAUxrg/m=el_conf Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:81e::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Playlog / Resource Hash 502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358 Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Content-Encoding gzip Referer https://online.affirmatoin.shop/ X-Goog-AuthUser 0 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/binary Response headers date Tue, 27 Jun 2023 15:08:59 GMT content-encoding gzip server Playlog x-frame-options SAMEORIGIN content-type text/plain; charset=UTF-8 access-control-allow-origin https://online.affirmatoin.shop cache-control private access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers X-Playlog-Web content-length 131 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
OPTIONS H3	200	log translate.googleapis.com/element/ Frame	0 0	268ms 137ms	Preflight text/plain	2607:f8b0:4006:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/element/log?format=json&hasfast=true&authuser=0 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:81e::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Playlog / Resource Hash Security Headers Name Value X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-encoding,content-type,x-goog-authuser Access-Control-Request-Method POST Origin https://online.affirmatoin.shop Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://online.affirmatoin.shop access-control-max-age 86400 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 content-type text/plain; charset=UTF-8 date Tue, 27 Jun 2023 15:08:59 GMT server Playlog x-frame-options SAMEORIGIN x-xss-protection 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 boolean| credentialless object| onbeforetoggle object| onscrollend function| googleTranslateElementInit function| _DumpException object| default_tr string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| closure_lm_215925

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			online.affirmatoin.shop/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4e1fa734020263866c062e47111dd7a5
			online.affirmatoin.shop/	1970-01-20 12:51:22	Name: googtrans Value: %2Fauto%2Fen
			.online.affirmatoin.shop/	1970-01-20 12:51:22	Name: googtrans Value: %2Fauto%2Fen

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
online.affirmatoin.shop
translate.google.com
translate.googleapis.com
www.google.com
www.gstatic.com
2606:4700:3037::6815:188a
2607:f8b0:4006:80d::2003
2607:f8b0:4006:81e::200a
2607:f8b0:4006:820::2003
2607:f8b0:4006:821::2004
2607:f8b0:4006:824::200e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4f08f11f1f08c6aa24d166c1475f158a22f4ac5d04fb1a837f4a2734a92e1f76
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
5bfc98b868806e22d2de205dbefb7401ada224583dade0e1a06acd3e92eb4cb9
6675b179d2d8eb50ad05f3658330cace232e923ffc8291a62e08fabad0555bdf
6df75cd7c2c93db9cd66ee448461bc41d50ccaf7feb716144d68c36fbbd8344a
7db470720bc87269e9bf81c2da2649d4f59d54eb54ca5ed4547855758d6688a0
8a6dbab00954f416062b255e3bddfc93d4764e35befbc706249a6a62f649e3db
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
b7637a4cc7e15b52376c9dba975683af0b7987a44b3d05200747c035a6852274
d017f361d69bdbd778fbc662ca5af3befe80b48a824b5a401c68cc2d6f1a7528
d0893bd64649158f0ccd1f26269eebc9c7b3fc3107afe55b4c6266149f5bed5d