www.packageorigin.com Open in urlscan Pro
2a01:7e01::f03c:91ff:fe8a:a43b  Public Scan

URL: https://www.packageorigin.com/
Submission: On April 02 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2a01:7e01::f03c:91ff:fe8a:a43b, located in Frankfurt am Main, Germany and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is www.packageorigin.com.
TLS certificate: Issued by R3 on April 2nd 2024. Valid for: 3 months.
This is the only time www.packageorigin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 2a01:7e01::f0... 63949 (AKAMAI-LI...)
7 1
Apex Domain
Subdomains
Transfer
7 packageorigin.com
www.packageorigin.com
98 KB
7 1
Domain Requested by
7 www.packageorigin.com www.packageorigin.com
7 1

This site contains links to these domains. Also see Links.

Domain
miln.eu
indie.miln.eu
packageorigin.com
Subject Issuer Validity Valid
www.packageorigin.com
R3
2024-04-02 -
2024-07-01
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.packageorigin.com/
Frame ID: 2FB7CF7C2DB6639B5CA76FEE65DB9494
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Package Origin

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

98 kB
Transfer

383 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.packageorigin.com/
8 KB
3 KB
Document
General
Full URL
https://www.packageorigin.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
4a374372c124c0408fd85f0865c456f50c22ca525e1bb4dfcc112d130a5d94e0
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
cache-control
public, max-age=15, must-revalidate
content-encoding
gzip
content-length
2749
content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-type
text/html; charset=utf-8
date
Tue, 02 Apr 2024 07:46:31 GMT
etag
W/"sande15xf"
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
last-modified
Wed, 20 Mar 2024 12:58:49 GMT
permissions-policy
interest-cohort=()
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=63072000; includeSubdomains;
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
miln.min.901bfabfe0457087d86eb799c022294a55a57887367b8ba6c31a6ac7763a6a0d.css
www.packageorigin.com/css/
243 KB
33 KB
Stylesheet
General
Full URL
https://www.packageorigin.com/css/miln.min.901bfabfe0457087d86eb799c022294a55a57887367b8ba6c31a6ac7763a6a0d.css
Requested by
Host: www.packageorigin.com
URL: https://www.packageorigin.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
901bfabfe0457087d86eb799c022294a55a57887367b8ba6c31a6ac7763a6a0d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=63072000; includeSubdomains;
last-modified
Wed, 20 Mar 2024 12:58:49 GMT
x-content-type-options
nosniff
date
Tue, 02 Apr 2024 07:46:31 GMT
etag
W/"sande15c8z"
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css; charset=utf-8
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
bootstrap.bundle.min.aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04.js
www.packageorigin.com/js/
79 KB
23 KB
Script
General
Full URL
https://www.packageorigin.com/js/bootstrap.bundle.min.aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04.js
Requested by
Host: www.packageorigin.com
URL: https://www.packageorigin.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=63072000; includeSubdomains;
last-modified
Wed, 20 Mar 2024 12:58:49 GMT
x-content-type-options
nosniff
date
Tue, 02 Apr 2024 07:46:31 GMT
etag
W/"sande11q1x"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
mask-icon.svg
www.packageorigin.com/
3 KB
2 KB
Image
General
Full URL
https://www.packageorigin.com/mask-icon.svg
Requested by
Host: www.packageorigin.com
URL: https://www.packageorigin.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
c5b42702654a9d7408ef6f1718d875e97a7ddb30484e5d3df64912ef95413c7d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
date
Tue, 02 Apr 2024 07:46:31 GMT
content-length
1709
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 20 Jun 2022 10:40:55 GMT
etag
W/"rdrv072mq"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
miln-package-origin.svg
www.packageorigin.com/
13 KB
3 KB
Image
General
Full URL
https://www.packageorigin.com/miln-package-origin.svg
Requested by
Host: www.packageorigin.com
URL: https://www.packageorigin.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
849f7be13676e5dd9b93bc3dbe951da014ba0b900ae920241f0b32d8d715813c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
date
Tue, 02 Apr 2024 07:46:31 GMT
content-length
2746
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Mar 2024 12:58:48 GMT
etag
W/"sande0ah4"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
favicon.svg
www.packageorigin.com/
5 KB
2 KB
Other
General
Full URL
https://www.packageorigin.com/favicon.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
ed5677e627e5e73d9ed4643c9541a14fafbbd5de7e11e126b1a407beca52e670
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubdomains;
date
Tue, 02 Apr 2024 07:46:31 GMT
content-length
2344
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 20 Jun 2022 10:40:55 GMT
etag
W/"rdrv073vx"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/svg+xml
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
favicon.png
www.packageorigin.com/
32 KB
32 KB
Other
General
Full URL
https://www.packageorigin.com/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a01:7e01::f03c:91ff:fe8a:a43b Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
e436b6b484f620413567a810213b36b4ea40d30614b5ec84b8e382806fa7e909
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.packageorigin.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
strict-transport-security
max-age=63072000; includeSubdomains;
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Sat, 18 Jun 2022 13:52:39 GMT
date
Tue, 02 Apr 2024 07:46:31 GMT
etag
"rdoejrp5e"
x-frame-options
DENY
content-type
image/png
cache-control
public, max-age=15, must-revalidate
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'
permissions-policy
interest-cohort=()
accept-ranges
bytes
content-length
32594

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal number| uidEvent object| bootstrap

0 Cookies

4 Console Messages

Source Level URL
Text
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'speaker'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'vr'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline'; img-src 'self' data: ; upgrade-insecure-requests; frame-src https://www.youtube-nocookie.com/
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY