pub-1e70ac779fe34f6697df71a879159d73.r2.dev Open in urlscan Pro
2a06:98c1:58::eb Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html
Submission Tags: @phish_report
Submission: On October 03 via api (October 3rd 2024, 11:16:14 pm UTC) from FI — Scanned from FI

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 2a06:98c1:58::eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-1e70ac779fe34f6697df71a879159d73.r2.dev.
TLS certificate: Issued by E5 on September 29th 2024. Valid for: 3 months.

This is the only time pub-1e70ac779fe34f6697df71a879159d73.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2a06:98c1:58::eb 2a06:98c1:58::eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
3	2600:9000:235... 2600:9000:2359:ae00:15:c281:3500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.227 142.250.185.227	15169 (GOOGLE) (GOOGLE)
2	172.217.18.1 172.217.18.1	15169 (GOOGLE) (GOOGLE)
9	7

1 2a06:98c1:58::eb (United States)

ASN13335 (CLOUDFLARENET, US)

pub-1e70ac779fe34f6697df71a879159d73.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2359:ae00:15:c281:3500:93a1 (United States)

ASN16509 (AMAZON-02, US)

ik.imagekit.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.1 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f1.1e100.net

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	imagekit.io ik.imagekit.io — Cisco Umbrella Rank: 22982	58 KB
3	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 517	79 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	846 B
1	r2.dev pub-1e70ac779fe34f6697df71a879159d73.r2.dev	16 KB
9	5

	Domain	Requested by
3	ik.imagekit.io	pub-1e70ac779fe34f6697df71a879159d73.r2.dev
3	cdn.ampproject.org	pub-1e70ac779fe34f6697df71a879159d73.r2.dev cdn.ampproject.org
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	pub-1e70ac779fe34f6697df71a879159d73.r2.dev
1	pub-1e70ac779fe34f6697df71a879159d73.r2.dev
9	5

This site contains links to these domains. Also see Links.

Domain
bit.ly

Subject Issuer	Validity	Valid
*.r2.dev E5	`2024-09-29` - `2024-12-28`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
misc-sni.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.imagekit.io Amazon RSA 2048 M02	`2024-01-23` - `2025-02-19`	a year	crt.sh
*.gstatic.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html
Frame ID: 7F6E9F3E04DC2388D1873D776990FE33
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SLOT GACOR > BANDAR TOGEL ONLINE TERBAIK & SLOT GACOR MUDAH MAXWIN HARI INI

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Lightbox (JavaScript Libraries) Expand

Page Statistics

9
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

5
Subdomains

7
IPs

2
Countries

179 kB
Transfer

432 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://bit.ly/sayang-mantan
Title: Disini Link Resmi Daftar Slot Gacor 2024 Mudah Mendapatkan Jakcpot

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
pub-1e70ac779fe34f6697df71a879159d73.r2.dev/ 16 KB
16 KB 514ms
395ms Document
text/html 2a06:98c1:58::eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f429ca0e4d536015d40aaf6651da5bd9462176cca1c85e35cde020128fb52d2e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
CF-RAY: 8cd0a35dcd9f8d67-HEL
Connection: keep-alive
Content-Length: 16431
Content-Type: text/html
Date: Thu, 03 Oct 2024 23:16:08 GMT
ETag: "20d358cb284fd7f4abc2b6ff8c9c6b25"
Last-Modified: Wed, 02 Oct 2024 05:18:41 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 css
fonts.googleapis.com/ 2 KB
846 B 209ms
69ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Karla:400,700&display=swap

Requested by

Host: pub-1e70ac779fe34f6697df71a879159d73.r2.dev
URL: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f185ca5e9fcaaeeccb097c120077f2d80829fd76bdf3c2ca61edc9f9a314b4e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 03 Oct 2024 23:16:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 23:16:08 GMT
content-type: text/css; charset=utf-8
last-modified: Thu, 03 Oct 2024 23:16:08 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 v0.js Show response
cdn.ampproject.org/ 278 KB
72 KB 287ms
67ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0.js

Requested by

Host: pub-1e70ac779fe34f6697df71a879159d73.r2.dev
URL: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bab3f95661eb3deaa71fd64e9f34deb6b9d9a8de1b61b3797c308f82afad4633

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

content-encoding: br
etag: "27ac6ded61abb27a"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Thu, 03 Oct 2024 23:16:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 23:16:08 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: private, max-age=3000, stale-while-revalidate=1206600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 73091
x-xss-protection: 0
server: sffe

GET
H2 200 435872269e88f01902df314a5aafadd1.jpg
ik.imagekit.io/book21/ 22 KB
23 KB 203ms
68ms Image
image/webp 2600:9000:2359:ae00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/book21/435872269e88f01902df314a5aafadd1.jpg?updatedAt=1727444054977
Requested by: Host: pub-1e70ac779fe34f6697df71a879159d73.r2.dev
URL: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2359:ae00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2a03d2907729c3af53025e66570a708ad2ebc664483a80e49defbda819509df9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

x-request-id: c789beae-6a29-4ae5-9f91-87354442c936
etag: "f9ed2e7f32b6c5ef2b129405f622019d"
age: 266744
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZrteCBQYPQQu-GZdJC_luaisvYvsm8aazDM_9V9u4mRdUwjhnENaEg==
date: Mon, 30 Sep 2024 21:10:24 GMT
content-type: image/webp
vary: Accept
x-server: ImageKit.io
last-modified: Mon, 30 Sep 2024 15:30:07 GMT
access-control-allow-headers: *
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
timing-allow-origin: *
via: 1.1 122731c1a09cfba14dfeeff504946134.cloudfront.net (CloudFront), 1.1 f1b6636265d2ca44d8a0ca5488a5ec0c.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 22446
x-amz-cf-pop: FRA60-P10

GET
H3 200 qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v31/ 24 KB
24 KB 134ms
60ms Font
font/woff2 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Karla:400,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

ef71f07257bf7ab1ff3b76ac3c0fa25b8686bbb26c5617c570c7528e337e48d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev
Referer: https://fonts.googleapis.com/

Response headers

age: 2361
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 03 Oct 2025 22:36:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 22:36:47 GMT
last-modified: Wed, 27 Sep 2023 15:41:12 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24364
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 86 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 83117cbc506b1acca44b51d6460c3f8fa70e0f5687252060568a8526c08d249b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 d006f1556f6fa7426c3077cd5d974cf3-fotor-20240528165227.jpg
ik.imagekit.io/book21/ 35 KB
36 KB 65ms
65ms Image
image/webp 2600:9000:2359:ae00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/book21/d006f1556f6fa7426c3077cd5d974cf3-fotor-20240528165227.jpg?updatedAt=1727846270546
Requested by: Host: pub-1e70ac779fe34f6697df71a879159d73.r2.dev
URL: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2359:ae00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 38eb074f716eff5de9392d215b1d309c0c5ec0ad1d88b827ee75e474efcda96b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

x-request-id: dfd4d5dd-d738-4182-8616-d2d98ddd5f2c
etag: W/"8d98-NWN64HE6gCwFhytHqAbaYsvibP8"
age: 124279
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: vZanjvsA-g_xOQcE2FmRPF-90LT3SQJLOiygAbyN4msaMAJH-nUZ5g==
date: Wed, 02 Oct 2024 12:44:49 GMT
content-type: image/webp
vary: Accept
x-server: ImageKit.io
access-control-allow-headers: *
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
timing-allow-origin: *
via: 1.1 5626bf35345f32d3e58fb8d33ec4d966.cloudfront.net (CloudFront), 1.1 f1b6636265d2ca44d8a0ca5488a5ec0c.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 36248
x-amz-cf-pop: FRA60-P10

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012409191841000/v0/ 8 KB
3 KB 186ms
67ms Script
text/javascript 172.217.18.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012409191841000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f1.1e100.net

Software

sffe /

Resource Hash

53b9f0675567207b19dc57e272bdd9d622323d7a2df57a6d88353843319d246b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

content-encoding: br
etag: "df7f47267741337c"
age: 198771
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 16:03:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 16:03:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 2970
x-xss-protection: 0
server: sffe

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012409191841000/v0/ 12 KB
4 KB 179ms
60ms Script
text/javascript 172.217.18.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012409191841000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f1.1e100.net

Software

sffe /

Resource Hash

1d524f844c89076f1293a2b50d98dfe254c5a1d23dcb7b8add23b969377adb3a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

content-encoding: br
etag: "a6b3e5909db709ed"
age: 198771
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 16:03:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 16:03:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 3934
x-xss-protection: 0
server: sffe

GET
H2 200 d006f1556f6fa7426c3077cd5d974cf3-fotor-20240528165227.jpg
ik.imagekit.io/book21/ 35 KB
0 0ms
0ms Other
image/webp 2600:9000:2359:ae00:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/book21/d006f1556f6fa7426c3077cd5d974cf3-fotor-20240528165227.jpg?updatedAt=1727846270546
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2359:ae00:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 38eb074f716eff5de9392d215b1d309c0c5ec0ad1d88b827ee75e474efcda96b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pub-1e70ac779fe34f6697df71a879159d73.r2.dev/

Response headers

x-request-id: dfd4d5dd-d738-4182-8616-d2d98ddd5f2c
etag: W/"8d98-NWN64HE6gCwFhytHqAbaYsvibP8"
age: 124279
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: vZanjvsA-g_xOQcE2FmRPF-90LT3SQJLOiygAbyN4msaMAJH-nUZ5g==
date: Wed, 02 Oct 2024 12:44:49 GMT
content-type: image/webp
vary: Accept
x-server: ImageKit.io
access-control-allow-headers: *
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
timing-allow-origin: *
via: 1.1 5626bf35345f32d3e58fb8d33ec4d966.cloudfront.net (CloudFront), 1.1 f1b6636265d2ca44d8a0ca5488a5ec0c.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 36248
x-amz-cf-pop: FRA60-P10

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
fonts.googleapis.com
fonts.gstatic.com
ik.imagekit.io
pub-1e70ac779fe34f6697df71a879159d73.r2.dev
142.250.185.227
172.217.18.1
2600:9000:2359:ae00:15:c281:3500:93a1
2a00:1450:4001:80e::2001
2a00:1450:4001:830::200a
2a06:98c1:58::eb
1d524f844c89076f1293a2b50d98dfe254c5a1d23dcb7b8add23b969377adb3a
2a03d2907729c3af53025e66570a708ad2ebc664483a80e49defbda819509df9
38eb074f716eff5de9392d215b1d309c0c5ec0ad1d88b827ee75e474efcda96b
53b9f0675567207b19dc57e272bdd9d622323d7a2df57a6d88353843319d246b
83117cbc506b1acca44b51d6460c3f8fa70e0f5687252060568a8526c08d249b
bab3f95661eb3deaa71fd64e9f34deb6b9d9a8de1b61b3797c308f82afad4633
ef71f07257bf7ab1ff3b76ac3c0fa25b8686bbb26c5617c570c7528e337e48d0
f185ca5e9fcaaeeccb097c120077f2d80829fd76bdf3c2ca61edc9f9a314b4e7
f429ca0e4d536015d40aaf6651da5bd9462176cca1c85e35cde020128fb52d2e

pub-1e70ac779fe34f6697df71a879159d73.r2.dev Open in urlscan Pro 2a06:98c1:58::eb Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

67 %IPv6

5 Domains

5 Subdomains

7 IPs

2 Countries

179 kBTransfer

432 kBSize

0 Cookies

1 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

0 Cookies

Indicators

pub-1e70ac779fe34f6697df71a879159d73.r2.dev Open in urlscan Pro
2a06:98c1:58::eb Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

5
Subdomains

7
IPs

2
Countries

179 kB
Transfer

432 kB
Size

0
Cookies

9 HTTP transactions
1 data transactions