view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com Open in urlscan Pro
2a01:7e03::f03c:93ff:feda:494a  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request printnow.html Show response view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/	220 B 554 B	1152ms 225ms	Document text/html	2a01:7e03::f03c:93ff:feda:494a AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/printnow.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a01:7e03::f03c:93ff:feda:494a Los Angeles, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash 5b856545c52ce54c43dc773a19ec8e476d13341671c9a36f930f5e69aed41d60 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 220 Content-Type text/html Date Wed, 24 Jul 2024 15:53:07 GMT ETag "2e5a29b3f29b8e5c33d069e3a08591c8" Last-Modified Mon, 22 Jul 2024 16:56:09 GMT x-amz-request-id tx000004d13c4f2e5809ce6-0066a12361-44bd9023-default x-rgw-object-type Normal
GET H3	200	acd8431 Show response d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/	21 KB 7 KB	1437ms 1040ms	Script application/javascript	2606:4700:3035::6815:1c42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Requested by Host: view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com URL: https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/printnow.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1c42 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f8a629536f3853012f1cb42b92fc3620695c9f23fc53b4805fe9d41c1703ec4 Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ Origin https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 24 Jul 2024 15:53:09 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W8AV5m%2BYENwj6IqlBIRfu2hH3vBPLNl5alpPTsqMLkdfYBycG48Oc%2Fp3tfjr18sBGU%2BfKGonMeeRBswOkpU7ERzTRWPswet5v1y0VyzosnWiuUvZjL1JeYYMcgrl0%2B5wNr0jsq%2FCzxTh0WWMXkTRYjRHnHAm7VtLUg33WtUuPJCmh%2BLLVZa6nDeycK%2Fw0Ts%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS access-control-allow-origin * content-type application/javascript access-control-allow-credentials true cf-ray 8a8514d19fa5431c-EWR alt-svc h3=":443"; ma=86400
GET H/1.1	403 Forbidden	favicon.ico view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/	253 B 485 B	144ms 144ms	Other application/xml	2a01:7e03::f03c:93ff:feda:494a AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a01:7e03::f03c:93ff:feda:494a Los Angeles, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS Software / Resource Hash a71fe5afa5c3631f91db766e604ca450c25b1ee22c074ab3b877471be23f0943 Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/printnow.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 24 Jul 2024 15:53:07 GMT Connection keep-alive x-amz-request-id tx00000fef0028802b02af2-0066a12361-44bd4826-default Accept-Ranges bytes Content-Length 253 Content-Type application/xml
GET H2	200	v1 Show response openfpcdn.io/botd/	15 KB 5 KB	483ms 142ms	Script text/javascript	3.162.103.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://openfpcdn.io/botd/v1 Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.103.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-103-43.iad61.r.cloudfront.net Software CloudFront / Resource Hash 29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/ Origin https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Wed, 24 Jul 2024 14:19:12 GMT via 1.1 b140d5b0fbed1dab248b0959f44a7944.cloudfront.net (CloudFront) x-amz-cf-pop IAD61-P1 age 5637 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 server CloudFront etag W/"5co2cnhGrt59+8B+iLKwJesMrpA" vary Accept-Encoding content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=586524, s-maxage=10796 x-amz-cf-id bO5ufEy_z5r_h-FhOB2tMiAEntfNg_c2wgcRWb9OgoHwaFlFPWvJoQ==
GET H3	200	76 Show response d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/	39 KB 17 KB	349ms 349ms	Script application/javascript	2606:4700:3035::6815:1c42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/76?0 Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1c42 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8b28fee0ae9868382a9f84073063611e372000f1f3139b832fd4328063ba0a8c Request headers Referer https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Origin https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 24 Jul 2024 15:53:09 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fm93pUaneMQ4WyC%2BbNax8hN5%2F7tvAeZ0UQrcI6%2BY8uSH82aANa3991xtxuYZiKh9YTg1epbtVw0SH4hJkS07%2BjWh%2Fh2%2BP%2BA5%2FaHmzyOlDgHO%2FZDANPtxxSrn2C%2Bwo6gLWis%2FTX9CLm30ZAcyjqzQRaAQ0jtRYCiZ7lCEpozBODJf5BwDKs%2FlBU%2FSHj9bvFs%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS access-control-allow-origin * content-type application/javascript access-control-allow-credentials true cf-ray 8a8514d99ba8431c-EWR alt-svc h3=":443"; ma=86400
POST H3	200	76 Show response d568b509c5.desmoinesmedicalmalpracticelawyer.com/r/	369 KB 98 KB	511ms 510ms	Fetch text/html	2606:4700:3035::6815:1c42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/r/76?session=f19d6396d2a244db5829adb005cf0f642cc026173127fa1f36b623f97747620c Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1c42 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ae483e90e67ca739067507b09d7eaa48417dc10242c2b693963f69201e0e63bd Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryFFqMciTW3L3Z4AAO Response headers date Wed, 24 Jul 2024 15:53:10 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3JW1HlgrhdW0%2FlYB5P4PcK5gGtoHRIHIwoE9oHSy0EHKu6Xjqex3mi2pWSQjA3TO6pol%2FbemNg%2BW9GkTpUeawdjgcysFWxOByV8ad0xnkGeeYlw6nhW%2FiQWOcvIJeElixCKtfNtXw%2BPHagJCxsgO%2B%2F4cnyDH273FsjgGp9wSD7veeKE6yky6JTWtGlW7Bl0%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS access-control-allow-origin * content-type text/html; charset=utf-8 access-control-allow-credentials true cf-ray 8a8514de89d8431c-EWR alt-svc h3=":443"; ma=86400
GET H3	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	372ms 103ms	Stylesheet text/css	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ Origin https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Wed, 24 Jul 2024 15:53:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1037710 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OrOwHpzONNBrIJWQAcY%2FvcHlreZ57XYpr1wJSNhZQ5jAffxgdra0HoIwyjbMfJV%2FvI2DZl1Wu6R%2FZRmbI0jJJj7Lu8J1oDqgNO4JusSpdQRpjkAwzrEIZE5Dfn50G2ibsRIPkCTVB2pDBpW%2FBf45CBg2"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8a8514e57c944350-EWR expires Mon, 14 Jul 2025 15:53:11 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	408ms 94ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 24 Jul 2024 15:53:11 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 5566035 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-ewr18175-EWR last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1721836391.351424,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 33613, 10640
GET H2	200	picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	3 KB 2 KB	502ms 99ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 24 Jul 2024 15:53:11 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 1173 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B83749623C9 x-azure-ref 20240724T155311Z-17f67b96dd5mr24dwsp2qmcggg000000027g000000005rkn content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0f508e7a-f01e-005d-5adc-dd59b6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	250 B 761 B	505ms 102ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 24 Jul 2024 15:53:11 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 199 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B8374CE7F93 x-azure-ref 20240724T155311Z-17f67b96dd5mr24dwsp2qmcggg000000027g000000005rkp content-type image/svg+xml access-control-allow-origin * x-ms-request-id 84b0e07c-a01e-0062-2edc-dd0171000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	501ms 98ms	Image image/svg+xml	2620:1ec:29:1::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg Requested by Host: d568b509c5.desmoinesmedicalmalpracticelawyer.com URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers Referer https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 24 Jul 2024 15:53:11 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 2407 x-ms-lease-status unlocked last-modified Fri, 11 Mar 2022 11:11:29 GMT etag 0x8DA034FE445C10D x-azure-ref 20240724T155311Z-17f67b96dd5mr24dwsp2qmcggg000000027g000000005rkm content-type image/svg+xml access-control-allow-origin * x-ms-request-id c36dae10-001e-0022-02dc-dd22a9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	250 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cbb3706e65b35a43bdcfebd23b5479dc0542ca7e23197869b683d12b524472fe Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _0x3f3149 function| _0x23aff9 function| _0x3c689f function| _0x238076 function| _0x45c5 function| _0x59378f function| _0xf5f84 function| _0x1a1a object| ws function| Email

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript	warning	URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431(Line 316) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://d568b509c5.desmoinesmedicalmalpracticelawyer.com/s/acd8431(Line 316) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	warning	URL: https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/printnow.html Message: [DOM] Found 2 elements with non-unique id #idTxtBx_SAOTCC_OTC: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com/printnow.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
cdnjs.cloudflare.com
code.jquery.com
d568b509c5.desmoinesmedicalmalpracticelawyer.com
openfpcdn.io
view-pdf-printonline901938849019384.us-lax-1.linodeobjects.com
2606:4700:3035::6815:1c42
2606:4700::6811:190e
2620:1ec:29:1::40
2a01:7e03::f03c:93ff:feda:494a
2a04:4e42:200::649
3.162.103.43
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0f8a629536f3853012f1cb42b92fc3620695c9f23fc53b4805fe9d41c1703ec4
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5b856545c52ce54c43dc773a19ec8e476d13341671c9a36f930f5e69aed41d60
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8b28fee0ae9868382a9f84073063611e372000f1f3139b832fd4328063ba0a8c
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a71fe5afa5c3631f91db766e604ca450c25b1ee22c074ab3b877471be23f0943
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
ae483e90e67ca739067507b09d7eaa48417dc10242c2b693963f69201e0e63bd
cbb3706e65b35a43bdcfebd23b5479dc0542ca7e23197869b683d12b524472fe