urlscan.io logo urlscan.io
SecurityTrails logo

forcefuloriginalmarketing.carlosmejia1961.repl.co Open in urlscan Pro
34.120.194.28  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://q-12-sd.frappe.cloud/login1
Effective URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Submission Tags: @phish_report
Submission: On October 10 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 4 domains to perform 28 HTTP transactions. The main IP is 34.120.194.28, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is forcefuloriginalmarketing.carlosmejia1961.repl.co.
TLS certificate: Issued by GTS CA 1P5 on October 9th 2023. Valid for: 3 months.
This is the only time forcefuloriginalmarketing.carlosmejia1961.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tuya (Financial)

Domain & IP information

IP Address AS Autonomous System
4 3.84.240.128 14618 (AMAZON-AES)
12 34.120.194.28 396982 (GOOGLE-CL...)
1 2a04:4e42:200... 54113 (FASTLY)
8 2a06:98c1:312... 13335 (CLOUDFLAR...)
2 2606:4700:310... 13335 (CLOUDFLAR...)
28 6
4    3.84.240.128 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-84-240-128.compute-1.amazonaws.com
q-12-sd.frappe.cloud
12    34.120.194.28 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 28.194.120.34.bc.googleusercontent.com
forcefuloriginalmarketing.carlosmejia1961.repl.co
1    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
8    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
dnshqm.pages.dev
2    2606:4700:310c::ac42:2f08 (United States)

ASN13335 (CLOUDFLARENET, US)
yuta.pages.dev
Apex Domain
Subdomains		 Transfer
12 repl.co
forcefuloriginalmarketing.carlosmejia1961.repl.co
33 KB
10 pages.dev
dnshqm.pages.dev Failed
yuta.pages.dev
174 KB
4 frappe.cloud
q-12-sd.frappe.cloud
428 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 925
82 KB
28 4
Domain Requested by
12 forcefuloriginalmarketing.carlosmejia1961.repl.co q-12-sd.frappe.cloud
forcefuloriginalmarketing.carlosmejia1961.repl.co
8 dnshqm.pages.dev forcefuloriginalmarketing.carlosmejia1961.repl.co
4 q-12-sd.frappe.cloud
2 yuta.pages.dev dnshqm.pages.dev
1 code.jquery.com forcefuloriginalmarketing.carlosmejia1961.repl.co
28 5

This site contains no links.

Subject Issuer Validity Valid
*.frappe.cloud
R3		 2023-09-18 -
2023-12-17		 3 months crt.sh
carlosmejia1961.repl.co
GTS CA 1P5		 2023-10-09 -
2024-01-07		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
dnshqm.pages.dev
GTS CA 1P5		 2023-09-13 -
2023-12-12		 3 months crt.sh
yuta.pages.dev
GTS CA 1P5		 2023-08-25 -
2023-11-23		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Frame ID: 6D77F23CFF093CA39709C34928E57E90
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Activacion & Información |

Page URL History Show full URLs

  1. https://q-12-sd.frappe.cloud/login1 Page URL
  2. https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/ Page URL
  3. https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

28
Requests

96 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

6
IPs

1
Countries

717 kB
Transfer

2324 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://q-12-sd.frappe.cloud/login1 Page URL
  2. https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/ Page URL
  3. https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
login1
q-12-sd.frappe.cloud/ 		114 KB
31 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://q-12-sd.frappe.cloud/login1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-84-240-128.compute-1.amazonaws.com
Software
Frappe Cloud /
Resource Hash
f22cb1ff036b5f6c33ff24b85e71bfe21590b2580d3efa5e777602978b14f567
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
'Origin, Content-Type, Accept
access-control-allow-methods
'GET, POST, OPTIONS
access-control-allow-origin
https://q-12-sd.frappe.cloud
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 10 Oct 2023 22:28:23 GMT
link
</assets/frappe/dist/css/website.bundle.T64CP4BY.css>; rel=preload; as=style,</assets/frappe/dist/js/frappe-web.bundle.3PQWM4VP.js>; rel=preload; as=script,</website_script.js>; rel=preload; as=script
referrer-policy
no-referrer-when-downgrade
server
Frappe Cloud
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-from-cache
False
x-page-name
login1
x-proxy-upstream
http://3f3dfde14efcbca5
x-ratelimit-limit
3600000000
x-ratelimit-remaining
3556573573
x-ratelimit-reset
23497
x-ratelimit-used
111047
x-xss-protection
1; mode=block
website.bundle.T64CP4BY.css
q-12-sd.frappe.cloud/assets/frappe/dist/css/ 		414 KB
68 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://q-12-sd.frappe.cloud/assets/frappe/dist/css/website.bundle.T64CP4BY.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-84-240-128.compute-1.amazonaws.com
Software
Frappe Cloud /
Resource Hash
fc4f3ea54a9288a0ed51a60c17656d45f5ebd4df667a1a7036b258c1abcf41d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://q-12-sd.frappe.cloud/login1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 09 Oct 2023 08:33:59 GMT
server
Frappe Cloud
content-encoding
gzip
etag
W/"6523baf7-67782"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-proxy-upstream
http://3f3dfde14efcbca5
x-xss-protection
1; mode=block
x-proxy-cache
EXPIRED
frappe-web.bundle.3PQWM4VP.js
q-12-sd.frappe.cloud/assets/frappe/dist/js/ 		1 MB
328 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://q-12-sd.frappe.cloud/assets/frappe/dist/js/frappe-web.bundle.3PQWM4VP.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-84-240-128.compute-1.amazonaws.com
Software
Frappe Cloud /
Resource Hash
4136909ed94f7facf52934cee48df6ac311f90dea60cf4b6cc5e841a14cabdc2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://q-12-sd.frappe.cloud/login1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:23 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 09 Oct 2023 08:33:59 GMT
server
Frappe Cloud
content-encoding
gzip
etag
W/"6523baf7-11ebd0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-proxy-upstream
http://3f3dfde14efcbca5
x-xss-protection
1; mode=block
x-proxy-cache
EXPIRED
website_script.js
q-12-sd.frappe.cloud/ 		25 B
892 B 		Script
General
Check archive.org
Download Go to
Full URL
https://q-12-sd.frappe.cloud/website_script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.84.240.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-84-240-128.compute-1.amazonaws.com
Software
Frappe Cloud /
Resource Hash
bfc3f25bc17c6b96e68b6c11b85d9c6f9ea1f26f94bc5153c8f2312148265e3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://q-12-sd.frappe.cloud/login1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-page-name
website_script.js
date
Tue, 10 Oct 2023 22:28:23 GMT
x-ratelimit-used
40974
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-from-cache
False
x-xss-protection
1; mode=block
x-proxy-upstream
http://3f3dfde14efcbca5
referrer-policy
no-referrer-when-downgrade
server
Frappe Cloud
vary
Accept-Encoding
x-ratelimit-remaining
3556462526
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
access-control-allow-origin
https://q-12-sd.frappe.cloud
access-control-allow-credentials
true
x-ratelimit-reset
23497
x-ratelimit-limit
3600000000
access-control-allow-methods
'GET, POST, OPTIONS
access-control-allow-headers
'Origin, Content-Type, Accept
/
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/ 		1008 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/
Requested by
Host: q-12-sd.frappe.cloud
URL: https://q-12-sd.frappe.cloud/login1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/ PHP/8.2.0RC7
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=7681947; includeSubDomains

Request headers

Referer
https://q-12-sd.frappe.cloud/login1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 10 Oct 2023 22:28:24 GMT
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
refresh
1; URL=./docFiles/index.html
replit-cluster
hacker
strict-transport-security
max-age=7681947; includeSubDomains
x-powered-by
PHP/8.2.0RC7
unique-1.2.4.min.js
dnshqm.pages.dev/files/js/ 		0
0
Primary Request index.html
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
4bff8d6f86c89aab7e48a21e0abfb223cea0deeed41dce3036f1759617b9a13e
Security Headers
Name Value
Strict-Transport-Security max-age=7681946; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-length
10901
content-type
text/html; charset=UTF-8
date
Tue, 10 Oct 2023 22:28:25 GMT
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
strict-transport-security
max-age=7681946; includeSubDomains
jquery-3.7.1.js
code.jquery.com/ 		279 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.7.1.js
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe

Request headers

Referer
Origin
https://forcefuloriginalmarketing.carlosmejia1961.repl.co
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
2174674
x-cache
HIT, HIT
content-length
83619
x-served-by
cache-lga21929-LGA, cache-hel1410022-HEL
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1696976905.306030,VS0,VE0
etag
W/"28feccc0-45a82"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
14, 10
unique-1.2.4.min.js
dnshqm.pages.dev/files/js/ 		1017 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dnshqm.pages.dev/files/js/unique-1.2.4.min.js
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f5aec01983e910fc24558a8fd3518ef9b22dad118baded5f4036658775256a7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"22e73e4c3451e996392fdbefb503e49a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4RNkayxdCJA7RhmPlPHkFGpNdPUHJiViR%2BOxAt1iIFYScS9DzJgdGVU%2BSUkZfS1vf12qPZ5DnRGosppXG67noFf%2B%2FWu0T8ul9TgMQZCO8vD5%2BWpEI5mhyrJs0QVPimyzOZkKk8GID6nCnadctNfA"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bd9b97b4c84-HEL
alt-svc
h3=":443"; ma=86400
bootstrap.min.css
dnshqm.pages.dev/files/tema/404/ 		158 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dnshqm.pages.dev/files/tema/404/bootstrap.min.css
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4317c03b8d4d20c4c54e163b6d3c16e0107b02d4ee9acd7406d9f7c725cc8f2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"7b851c593d3782c1b1d6d1fba495954c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2FumpLx7L2Xk8%2F9kGZ0CSUx5AmnPseOJO4qBBdROhtrjtVsfWzKUwx2FbNZZ1m7D8kUkbd35BFWCTSLEX2bnfuemmFify1GhGGLhFopfl%2FSJiIEpyFvF1aHwoRi87icRw1VsvdcZGC3yl%2BB649W1"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bd9b9774c84-HEL
alt-svc
h3=":443"; ma=86400
Default1.css
dnshqm.pages.dev/files/tema/404/ 		24 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dnshqm.pages.dev/files/tema/404/Default1.css
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3c7ee6f2308c911e44bfe4b9252bfd3398d8a1b5a3227287af58963795a4fd7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"8beb2d628cbf5c880f5fb822b9dbe0a1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BLggMkxPZooUjtS%2B5Wg3Ps6rTs80Q9%2FVbKdfAvXFBF%2BA8ZpPrMdtfGPZqtt1meuncH%2BkJNL%2FSU%2B2tp72KI1TLW%2BOyK7qJnYrh526BnXqhfOU8oOBmoTxm8uK0k8NbWVdJ%2FC56zY40Wm35x2kQAV7"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bd9b97c4c84-HEL
alt-svc
h3=":443"; ma=86400
_UtilidadesSitio.js
dnshqm.pages.dev/files/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dnshqm.pages.dev/files/js/_UtilidadesSitio.js
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ede4ccfde544d9cfa94ee943bfecfe850076daa080771d7146f5cff4338c5745
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"b5a31959cc019c7f785b32a0d72a99c6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RqqIR3BhHHvsJXuLn%2BvvlACKNHJY8nvBdDvtClJg%2BrISJeRopfFEnYrKpLUinr0y4PaMDV5bi5dJPaUEl4D5zMkKtkFwbKGrdeScuRphghkeeL1ZLXspfdzfxAFZMblwF%2B1oOVWnQV4mZuK16mg1"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bd9b97d4c84-HEL
alt-svc
h3=":443"; ma=86400
jsAjaxCommans.js
dnshqm.pages.dev/files/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dnshqm.pages.dev/files/js/jsAjaxCommans.js
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88234284c6d5acf9a94b3d7db3710d86843e6b0929b365694abde950d9384b98
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"8a276efbc528bf1d123dce8ebee7523c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AtwhDQqHgaR4XiyEx8ijOT%2BFdQ%2B%2Fqp82Xz%2F8JymA%2BCLOkABP2JyDuxLMv5sHTExLdxukDBUyIuoSNTwNFue6YTQTM4QErAbHBV0xUu23gVRDMNTC3GqkafmC9YjnzINpH3AxZ1ONENlvkGlcB5KO"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bd9b97f4c84-HEL
alt-svc
h3=":443"; ma=86400
bannerPortalSinMarcas.png
dnshqm.pages.dev/files/tema/Imagenes/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dnshqm.pages.dev/files/tema/Imagenes/bannerPortalSinMarcas.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72a927e2b16de3869cd61aebf6cab10e36c1eb5a2a0d97c0d646f75483d56d1c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:25 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"0e6f2bb03acccfb53907b6834646a0aa"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yzb7jvM%2FpyzdgurPeyZO3DIRTFBTmfGKSCvauPGUI6wRnkwPH1IBJ5TNrKvfl8iH7bsbyriG15TwmPuchN%2F6DKiV0QwajG6C9gWylboofupvq60RzC8juY8mfZc7vrcfV3%2B499DPfC%2FxonLlhPro"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bdc1d794c84-HEL
alt-svc
h3=":443"; ma=86400
content-length
15929
PublicidadPortal.JPG
dnshqm.pages.dev/files/tema/Imagenes/ 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dnshqm.pages.dev/files/tema/Imagenes/PublicidadPortal.JPG
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"3468e3c10fcd90f2f27d099e382de6a8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RhZey3gQOwXOO9%2FL44OwHE5OoibwFcQ7LtROZJP7fRVKJfX8DxRtR228k%2BJZ8O3jsYZ30Joz1HWR58244Qb7CdI%2FlRienlGQJ4rJ82V3nUMXTAkGqK79TTHem5qF9h8x9hte%2BF%2F1uI83ldGQXD2m"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bdded66d98d-HEL
alt-svc
h3=":443"; ma=86400
content-length
78850
boton3.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton3.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
d994557f9b3a2dbbf52cfbea260ae86c0e7815de3d2c798b42321363b0ac4ee3
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2311
content-type
image/png
boton1.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton1.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
fa9929129a567369394f0d97e9fab7fc320cd5eb21938a01e844dfbb8c1116d3
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
1084
content-type
image/png
boton6.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton6.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
b7c27b2cb4cc310e1e675d2d19d5c2a0a88287740013558c47e18b8649ca804d
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2580
content-type
image/png
boton0.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton0.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
59f2629c01fc1dedc36d4d94e3d8dc5b95cebb41d95d1ee81a4fd9ac8445e59c
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2390
content-type
image/png
boton7.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton7.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
81fdd88dc815fbcf6d9dcad7c79d9278220576d033761141f36d449ab67c0ae5
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
1622
content-type
image/png
boton8.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton8.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
486d3c09c74ef88ccb58aabd7ac3010936f1c00a0cc788e7d86e970e69e36f22
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2741
content-type
image/png
boton9.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton9.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
57a1ec62cda2a2b0af03063e66e5590bd24fc8fb8576ebae5eb2372d64137ca9
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2593
content-type
image/png
boton4.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton4.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
7c109e713efe659aa8edda8af67fe41a4b27ca43f4a9c617a1766f5caa4e8b5b
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
1577
content-type
image/png
boton5.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton5.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
ad755dfae1647fa2c926168ed41aef17961c7993a8362662707e57572e13e37b
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
1839
content-type
image/png
boton2.png
forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/files/tema/Imagenes/boton2.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.194.28 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
28.194.120.34.bc.googleusercontent.com
Software
/
Resource Hash
5d4fb09832af72e1747b2ab493057a2856a1d31018f16226367a5d57010e41d2
Security Headers
Name Value
Strict-Transport-Security max-age=7681945; includeSubDomains

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
strict-transport-security
max-age=7681945; includeSubDomains
host
forcefuloriginalmarketing.carlosmejia1961.repl.co
replit-cluster
hacker
expect-ct
max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length
2046
content-type
image/png
BotonBorrar.png
yuta.pages.dev/files/tema/Imagenes/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yuta.pages.dev/files/tema/Imagenes/BotonBorrar.png
Requested by
Host: dnshqm.pages.dev
URL: https://dnshqm.pages.dev/files/tema/404/Default1.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2f08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dnshqm.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"15b1b9d172eb5a14caf9795a7cc2a535"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oSsosLldDcmzm2K553EA0wQU849P60czkYLaKk2BAz4bmD9HVMIwYGHBv50SnNxovbioAeFNSUQ2gAJQVsY1AQDACN1Ci%2FTlDcDQPyVdgMfbVoOIoUx6Mu1Ai%2BhA6Xci9Zi4d1HHcoIF8mprbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bdf3b024c8b-HEL
alt-svc
h3=":443"; ma=86400
content-length
4277
botonAceptar_login.png
dnshqm.pages.dev/files/tema/Imagenes/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dnshqm.pages.dev/files/tema/Imagenes/botonAceptar_login.png
Requested by
Host: forcefuloriginalmarketing.carlosmejia1961.repl.co
URL: https://forcefuloriginalmarketing.carlosmejia1961.repl.co/moranufby651/wqerf5458wg/mediaFiles/index.html?event&seC_7QIjRIpiH_T1_I_EVENT-ef8l-876-reYH_rvyqLHwz1FDvLLLM=DFJ&&_e95ef_E_H_T2_I_evdNAJ9mnora-SpcrzrlgeOHrvyqLHwz1FDvLLLM
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce62e581b5780a29de2936c2d6af906df2e9ddfeee5a0b9e3d21bb16cb3fafc2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://forcefuloriginalmarketing.carlosmejia1961.repl.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6f431798f959fda75928f621067ac3b1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7lgGZwFfbfaKm2I0U%2BnURgCa1HJUARicSNYdMOvLg608KXbBFbVprwXAyJ%2Bpy5xSFPPvnPbYJuOK0sjpmBgSLulHiutRmDWaJXbqG8VjgAnzxXGlN8uH5naXl6AGCrKZ%2BPyGtSXqu0Qf8ePdzX7b"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bdebee4d98d-HEL
alt-svc
h3=":443"; ma=86400
content-length
5340
titulos-productos.png
yuta.pages.dev/files/tema/Imagenes/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yuta.pages.dev/files/tema/Imagenes/titulos-productos.png
Requested by
Host: dnshqm.pages.dev
URL: https://dnshqm.pages.dev/files/tema/404/Default1.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2f08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
79e1b2f6c2c1ced5706d2d22f92bdd11542fff1a7506e9106c0ea6b16a04da80
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dnshqm.pages.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date
Tue, 10 Oct 2023 22:28:26 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"dea6aea2df19be537b98109dbb7beb5c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1Ms9%2B9RI2dy3rEXJA5dCMT5wKL%2FW31cLJdI5ug9WqyIWzp5lgw52uxQygv1VWNZi70m3MWcw%2FlVxb8yqKl6PLwmA1zpQ9dY5lQhLSFdxbsOk%2BcP%2BVVdZhXQbNrmG0p2%2FB95nQTs6b1zMyZR%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
81424bdf3b044c8b-HEL
alt-svc
h3=":443"; ma=86400
content-length
35555

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dnshqm.pages.dev
URL
https://dnshqm.pages.dev/files/js/unique-1.2.4.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tuya (Financial)

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery function| generateRandomToken string| currentUrl string| cleanUrl string| parameterName string| parameterValue string| newUrl function| AbrirAplicacion function| fullScreen function| noEmbebed function| disableContext function| disableKeys function| onlyDigits function| getPath function| mouseOverPad function| mouseOutPad function| mouseOverStart function| mouseOutStart function| Llenarclave function| limpiarPass function| checkFields object| slideCache function| RunSlideShow object| focoPassword function| initProveedor function| initFoco function| foco function| no_foco function| Validate_Checkbox function| VentanaAyuda function| launch function| launchRemote function| detectAcrobat function| addClass function| removeClass undefined| USER undefined| PASS undefined| PIN undefined| PIN2 undefined| PIN3 undefined| NUMBER undefined| ip undefined| ip2 undefined| message function| ready function| sender function| ready1 function| sender1 function| ready2 string| chat_id function| sender2 function| ready3 string| telegram_bot_id function| sender3

5 Cookies

Domain/Path Name / Value
q-12-sd.frappe.cloud/ Name: sid
Value: Guest
q-12-sd.frappe.cloud/ Name: system_user
Value: no
q-12-sd.frappe.cloud/ Name: full_name
Value: Guest
q-12-sd.frappe.cloud/ Name: user_id
Value: Guest
q-12-sd.frappe.cloud/ Name: user_image
Value:

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
dnshqm.pages.dev
forcefuloriginalmarketing.carlosmejia1961.repl.co
q-12-sd.frappe.cloud
yuta.pages.dev
dnshqm.pages.dev
2606:4700:310c::ac42:2f08
2a04:4e42:200::649
2a06:98c1:3120::3
3.84.240.128
34.120.194.28
1f5aec01983e910fc24558a8fd3518ef9b22dad118baded5f4036658775256a7
3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b
4136909ed94f7facf52934cee48df6ac311f90dea60cf4b6cc5e841a14cabdc2
486d3c09c74ef88ccb58aabd7ac3010936f1c00a0cc788e7d86e970e69e36f22
4bff8d6f86c89aab7e48a21e0abfb223cea0deeed41dce3036f1759617b9a13e
57a1ec62cda2a2b0af03063e66e5590bd24fc8fb8576ebae5eb2372d64137ca9
59f2629c01fc1dedc36d4d94e3d8dc5b95cebb41d95d1ee81a4fd9ac8445e59c
5d4fb09832af72e1747b2ab493057a2856a1d31018f16226367a5d57010e41d2
72a927e2b16de3869cd61aebf6cab10e36c1eb5a2a0d97c0d646f75483d56d1c
78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe
79e1b2f6c2c1ced5706d2d22f92bdd11542fff1a7506e9106c0ea6b16a04da80
7c109e713efe659aa8edda8af67fe41a4b27ca43f4a9c617a1766f5caa4e8b5b
81fdd88dc815fbcf6d9dcad7c79d9278220576d033761141f36d449ab67c0ae5
88234284c6d5acf9a94b3d7db3710d86843e6b0929b365694abde950d9384b98
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
a4317c03b8d4d20c4c54e163b6d3c16e0107b02d4ee9acd7406d9f7c725cc8f2
ad755dfae1647fa2c926168ed41aef17961c7993a8362662707e57572e13e37b
b7c27b2cb4cc310e1e675d2d19d5c2a0a88287740013558c47e18b8649ca804d
bfc3f25bc17c6b96e68b6c11b85d9c6f9ea1f26f94bc5153c8f2312148265e3b
ce62e581b5780a29de2936c2d6af906df2e9ddfeee5a0b9e3d21bb16cb3fafc2
d3c7ee6f2308c911e44bfe4b9252bfd3398d8a1b5a3227287af58963795a4fd7
d994557f9b3a2dbbf52cfbea260ae86c0e7815de3d2c798b42321363b0ac4ee3
ede4ccfde544d9cfa94ee943bfecfe850076daa080771d7146f5cff4338c5745
f22cb1ff036b5f6c33ff24b85e71bfe21590b2580d3efa5e777602978b14f567
fa9929129a567369394f0d97e9fab7fc320cd5eb21938a01e844dfbb8c1116d3
fc4f3ea54a9288a0ed51a60c17656d45f5ebd4df667a1a7036b258c1abcf41d3