please-wait-redirecting.site Open in urlscan Pro
2606:4700:3037::6815:483f Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://api.neonemails.com/emails/tracking/click-link/K6-3eFNeMQhNj9-ut6P8N-YMlrDFEvYUlFX_-TYPbD4=/j7HPL61TZ7DgUKAbuF0In7NT...
Effective URL:
https://please-wait-redirecting.site/
Submission: On August 03 via manual (August 3rd 2024, 4:34:18 pm UTC) from PH — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 9 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3037::6815:483f, located in United States and belongs to CLOUDFLARENET, US. The main domain is please-wait-redirecting.site.
TLS certificate: Issued by WE1 on July 30th 2024. Valid for: 3 months.

This is the only time please-wait-redirecting.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.193.213.229 34.193.213.229	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.205.214.8 52.205.214.8	14618 (AMAZON-AES) (AMAZON-AES)
1	88.198.36.249 88.198.36.249	24940 (HETZNER-AS) (HETZNER-AS)
2	2606:4700:303... 2606:4700:3037::6815:483f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6812:5f29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	13.32.27.94 13.32.27.94	16509 (AMAZON-02) (AMAZON-02)
1	13.35.58.31 13.35.58.31	16509 (AMAZON-02) (AMAZON-02)
1	185.199.108.133 185.199.108.133	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:5e29	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	8

1 34.193.213.229 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-213-229.compute-1.amazonaws.com

api.neonemails.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.205.214.8 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-214-8.compute-1.amazonaws.com

azpharmacy.app.neoncrm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.36.249 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: 249.purpleprofile.pt

il-rentacar.pt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::6815:483f (United States)

ASN13335 (CLOUDFLARENET, US)

please-wait-redirecting.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:5f29 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.94 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-94.fra56.r.cloudfront.net

findicons.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.58.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-31.fra60.r.cloudfront.net

images.freeimages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.108.133 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-108-133.github.com

gist.githubusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:5e29 (United States)

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	cloudflare.com 1 redirects challenges.cloudflare.com — Cisco Umbrella Rank: 3877 cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	22 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	35 KB
2	please-wait-redirecting.site please-wait-redirecting.site	7 KB
1	githubusercontent.com gist.githubusercontent.com — Cisco Umbrella Rank: 36401	15 KB
1	freeimages.com images.freeimages.com — Cisco Umbrella Rank: 360028	772 B
1	findicons.com 1 redirects findicons.com — Cisco Umbrella Rank: 651315	306 B
1	il-rentacar.pt il-rentacar.pt	360 B
1	neoncrm.com 1 redirects azpharmacy.app.neoncrm.com	665 B
1	neonemails.com 1 redirects api.neonemails.com — Cisco Umbrella Rank: 447472	190 B
10	9

	Domain	Requested by
3	challenges.cloudflare.com	1 redirects please-wait-redirecting.site challenges.cloudflare.com
2	cdn.jsdelivr.net	please-wait-redirecting.site
2	please-wait-redirecting.site	il-rentacar.pt
1	gist.githubusercontent.com	please-wait-redirecting.site
1	images.freeimages.com	please-wait-redirecting.site
1	findicons.com	1 redirects
1	cdnjs.cloudflare.com	please-wait-redirecting.site
1	il-rentacar.pt
1	azpharmacy.app.neoncrm.com	1 redirects
1	api.neonemails.com	1 redirects
10	10

This site contains no links.

Subject Issuer	Validity	Valid
*.il-rentacar.pt R3	`2024-06-06` - `2024-09-04`	3 months	crt.sh
please-wait-redirecting.site WE1	`2024-07-30` - `2024-10-28`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh
challenges.cloudflare.com E5	`2024-07-17` - `2024-10-15`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://please-wait-redirecting.site/
Frame ID: CD17A1DEAB03107EAFBE3E4AA3147233
Requests: 9 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/bupl9/0x4AAAAAAAgJxyc5tUdElKMP/auto/fbE/normal/auto/
Frame ID: 0A445DAB82EF5FAA5002D6E9287AD9E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Access My Account

Page URL History Show full URLs

https://api.neonemails.com/emails/tracking/click-link/K6-3eFNeMQhNj9-ut6P8N-YMlrDFEvYUlFX_-TYPbD4=/j7HP... HTTP 302
https://azpharmacy.app.neoncrm.com/track//servlet/DisplayLink?orgId=azpharmacy&emailId=b36f0a80a8f46a1e90df8e12... HTTP 302
https://il-rentacar.pt/assets/zai/index.html Page URL
https://please-wait-redirecting.site/ Page URL

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

10
Requests

80 %
HTTPS

45 %
IPv6

9
Domains

10
Subdomains

8
IPs

2
Countries

81 kB
Transfer

227 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://api.neonemails.com/emails/tracking/click-link/K6-3eFNeMQhNj9-ut6P8N-YMlrDFEvYUlFX_-TYPbD4=/j7HPL61TZ7DgUKAbuF0In7NTpEVyoyjMrTel_LOCwrI= HTTP 302
https://azpharmacy.app.neoncrm.com/track//servlet/DisplayLink?orgId=azpharmacy&emailId=b36f0a80a8f46a1e90df8e12e144baf8bm1182717b36&&linkId=71563&targetUrl=https://il-rentacar.pt/assets/zai/index.html HTTP 302
https://il-rentacar.pt/assets/zai/index.html Page URL
https://please-wait-redirecting.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://api.neonemails.com/emails/tracking/click-link/K6-3eFNeMQhNj9-ut6P8N-YMlrDFEvYUlFX_-TYPbD4=/j7HPL61TZ7DgUKAbuF0In7NTpEVyoyjMrTel_LOCwrI= HTTP 302
https://azpharmacy.app.neoncrm.com/track//servlet/DisplayLink?orgId=azpharmacy&emailId=b36f0a80a8f46a1e90df8e12e144baf8bm1182717b36&&linkId=71563&targetUrl=https://il-rentacar.pt/assets/zai/index.html HTTP 302
https://il-rentacar.pt/assets/zai/index.html

Request Chain 1

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP 302
https://challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/api.js

Request Chain 5

https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png HTTP 301
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

index.html Show response
il-rentacar.pt/assets/zai/
Redirect Chain

https://api.neonemails.com/emails/tracking/click-link/K6-3eFNeMQhNj9-ut6P8N-YMlrDFEvYUlFX_-TYPbD4=/j7HPL61TZ7DgUKAbuF0In7NTpEVyoyjMrTel_LOCwrI=
https://azpharmacy.app.neoncrm.com/track//servlet/DisplayLink?orgId=azpharmacy&emailId=b36f0a80a8f46a1e90df8e12e144baf8bm1182717b36&&linkId=71563&targetUrl=https://il-rentacar.pt/assets/zai/index.html
https://il-rentacar.pt/assets/zai/index.html

119 B
360 B

332ms
10ms

Document
text/html

88.198.36.249
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://il-rentacar.pt/assets/zai/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 88.198.36.249 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 249.purpleprofile.pt
Software: Apache /
Resource Hash: 5dfae9fbc00a25f0b1f1f2c4d5809efe2a38b206c1fc3f0b612325e21b34ba6c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 119
Content-Type: text/html
Date: Sat, 03 Aug 2024 16:34:06 GMT
Keep-Alive: timeout=5, max=50
Last-Modified: Fri, 02 Aug 2024 19:33:00 GMT
Server: Apache

Redirect headers

content-length: 0
date: Sat, 03 Aug 2024 16:34:06 GMT
location: https://il-rentacar.pt/assets/zai/index.html
server: -

GET
H3 200 Primary Request / Show response
please-wait-redirecting.site/ 20 KB
6 KB 78ms
50ms Document
text/html 2606:4700:3037::6815:483f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://please-wait-redirecting.site/
Requested by: Host: il-rentacar.pt
URL: https://il-rentacar.pt/assets/zai/index.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:483f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bb7b762f3da5a76b7c370f8b04576e3ac03b49a5a05ef8d338226c9049962f6

Request headers

Referer: https://il-rentacar.pt/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ad7b6987f3cbbbc-FRA
content-encoding: br
content-type: text/html
date: Sat, 03 Aug 2024 16:34:06 GMT
last-modified: Fri, 02 Aug 2024 20:27:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8OVQ60IblUtTCWXnsqe7kYgPIWDEavD9UbVzgrAV0IrGuvaTsmWsEvwWPxWvnRz0HzqK8bORjwHxH5nydW%2BiiChY7Pi%2B1O8dZfZVERehcGTirynCf4DfoESXtisBrMTXB9gzryzs%2Fv6pTkLB%2BTHOD51bAXL1REgzN7zl"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3

200

api.js Show response
challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/
Redirect Chain

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
https://challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/api.js

43 KB
15 KB

17ms
17ms

Script
application/javascript

2606:4700::6812:5f29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/api.js
Requested by: Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/
Protocol: H3
Server: 2606:4700::6812:5f29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25b1f543c4682618e2fff0c607d70a896ecfc080ce500c41ce00b7ffad0ec411

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 16:34:06 GMT
content-encoding: br
last-modified: Fri, 26 Jul 2024 18:15:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
cross-origin-resource-policy: cross-origin
cf-ray: 8ad7b698fc4c9208-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 03 Aug 2024 16:34:06 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-origin: *
location: /turnstile/v0/b/8c81cb09042c/api.js
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
cf-ray: 8ad7b698ec2f9208-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 localforage.js Show response
cdn.jsdelivr.net/gh/mozilla/localForage@master/dist/ 92 KB
22 KB 57ms
29ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/mozilla/localForage@master/dist/localforage.js

Requested by

Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9f100dee1745c2b62b08705672e474d3e7c5e871763b2d7ec951f1222ba5b96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 16:34:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 27311
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21508
x-served-by: cache-fra-etou8220159-FRA, cache-lga21977-LGA
x-jsd-version-type: branch
server: cloudflare
etag: W/"16e36-67PBRT1jcuHzNe8PbwW184wBAY4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=77HSHx%2BklQV54w2TmWP7WoiKNBEKSGdJk%2Ftg2zWTAEjM1fh9UcQKzZ96Njai9A9OaEqJWmBIdnwPkH%2BHt6oQqjHjrYc76rN0g%2FvUdq4TSfbiTK2%2F2B6TRHuIUANIWhYK80l0%2FeORc%2BIGknbqKAg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad7b698fdf83656-FRA

GET
H2 200 opfs.min.js Show response
cdn.jsdelivr.net/gh/Joe12387/op-fingerprinting-script@main/ 41 KB
13 KB 119ms
91ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/Joe12387/op-fingerprinting-script@main/opfs.min.js

Requested by

Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aca978ef4c7d58d146e93ec9f3502f829a2ac00274d5a229995e5ef0ec3c988

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 16:34:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 33549
x-jsd-version: main
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13238
x-served-by: cache-fra-etou8220128-FRA, cache-lga21945-LGA
x-jsd-version-type: branch
server: cloudflare
etag: W/"a2fa-fvIVjM9ZuDY51nvBztAuZsjps1s"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2B4bUQcvNZz5Zd4k5NtnTOH29MLV4A6lbLEWAwLGEZ6T2AX5a%2BKu4T%2BPmsteu6AYv2m4ggp5lfZxyEb0YFIVEYHC%2FQI3ih%2Ft0sWK1hmTd6JJXWLMy%2BbXq8ZTIYkGNEGOMClxp8VQLA2H3BGO2wQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad7b698fdfe3656-FRA

GET
H3 200 ua-parser.min.js Show response
cdnjs.cloudflare.com/ajax/libs/UAParser.js/1.0.37/ 17 KB
7 KB 34ms
20ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/UAParser.js/1.0.37/ua-parser.min.js

Requested by

Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7284cae968813b965f10bcbc74bfc833b54c3ccce37a99c674e00e4a6d71e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 16:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5003821
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6948
last-modified: Sat, 28 Oct 2023 03:30:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "653c8066-1b24"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iRKyjYO61K3QScl5l8HbLmjONwkpzEVGBz4vqqF%2FEIFCAhA7GdmyO2GjG%2F4gXbY0JBQR2h2GlwAFiQnyyDc7l2JTRBWi045B%2BfX41Bns4qHw1mIgue5bgWERkkXnlfd2gvDMgO92Z2GxWqDBiOgIJgqY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ad7b698eeaf71d0-FRA
expires: Thu, 24 Jul 2025 16:34:06 GMT

GET
H2

200

microsoft_new_logo_alt.png
images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/
Redirect Chain

https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

254 B
772 B

44ms
9ms

Image
image/png

13.35.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

Requested by

Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/

Protocol

Server

13.35.58.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-58-31.fra60.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 10:54:28 GMT
via: 1.1 a097fc75e5eca387ecd3618341d82f1a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P10
age: 17732379
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 254
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 20 Dec 2022 05:17:19 GMT
server: AmazonS3
etag: "57ab754695eb0a2c74201ecd6948c12f"
x-frame-options: DENY
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 1bpYikBIo1gcoIBX2kkEBZ9Rsju1JS-AC_zPv7LMue_TvjWDZ_4Sqw==

Redirect headers

date: Mon, 22 Jul 2024 23:49:36 GMT
via: 1.1 1a3d61cabf9778724765b3e70befe816.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
age: 1010670
x-cache: Hit from cloudfront
location: https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
content-length: 0
x-amz-cf-id: 50mGZf326q3hmmLNTKX-up9zKFaIgx5lulUWCqhyxJH9RUlrcw4hhA==

GET
H2 200 fowiwoeijiervoerier.js Show response
gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/ 15 KB
15 KB 161ms
138ms Script
text/plain 185.199.108.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/fowiwoeijiervoerier.js

Requested by

Host: please-wait-redirecting.site
URL: https://please-wait-redirecting.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.199.108.133 , United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-108-133.github.com

Software

Resource Hash

47ba09f99b9e72c39c3aacfe2657ce4745e8b8881dbacc1c41f7a76352e39314

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://please-wait-redirecting.site/
Origin: https://please-wait-redirecting.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fastly-request-id: 37c5ae5d385a47f6ffdb279e010080c651918db5
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sat, 03 Aug 2024 16:34:07 GMT
via: 1.1 varnish
expires: Sat, 03 Aug 2024 16:39:07 GMT
x-cache: MISS
cross-origin-resource-policy: cross-origin
content-length: 14888
x-xss-protection: 1; mode=block
x-served-by: cache-fra-eddf8230156-FRA
x-github-request-id: C50B:1AD0DF:9CA846:A53118:66AE5BFE
x-timer: S1722702847.010699,VS0,VE130
etag: W/"e842e40349087bea6bfd3231ee95261af10b6e3aafb2a2b51c209cabaed7882d"
source-age: 0
x-frame-options: deny
vary: Authorization,Accept-Encoding,Origin
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 favicon.ico
please-wait-redirecting.site/ 630 B
1 KB 96ms
96ms Other
image/x-icon 2606:4700:3037::6815:483f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://please-wait-redirecting.site/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:483f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3f780e26aa6261c3b9a0ebe5aa80510197a11cc8412e24fd4688b05d478599f

Request headers

Referer: https://please-wait-redirecting.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 16:34:07 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 30 Jul 2024 18:17:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"66a92e4d-276"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ItwcicbrkaZ2URXvNSG5p1F85jCEon%2B2UT6U3omdBWaSs%2BmbGljAWIunqdycJxUGU08kgsNSqHoi6e%2FdmK7GRMfjQJU8l%2BvTOshgT5UbdkqZ7mOA9seU3m1zfaxk0IQ95JhtDA8%2FwzrGxezTO0b5cItPybPjXXtrlSGc"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=14400
cf-ray: 8ad7b69ec877bbbc-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 /
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/bupl9/0x4AAAAAAAgJxyc5tUdElKMP/auto/fbE/normal/auto/ Frame 0A44 0
0 38ms
29ms Document
text/html 2606:4700::6812:5e29
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/bupl9/0x4AAAAAAAgJxyc5tUdElKMP/auto/fbE/normal/auto/

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:5e29 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Referer: https://please-wait-redirecting.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8ad7b69f8e181c0f-FRA
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Sat, 03 Aug 2024 16:34:07 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
azpharmacy.app.neoncrm.com/np	1970-01-21 07:17:18	Name: orgId Value: azpharmacy
azpharmacy.app.neoncrm.com/	1970-01-20 22:41:47	Name: AWSALB Value: ivlbU+MTID+g8lS/acCOSF/fZq+DXq3228GnOZN6NkIHr13EMVJh9z4VwLf23spOjEvheMcHiTlvm6MPncG7aELcRgGWvIErrHhh8cvuFP5MIQ86gE5M/GF8y39U
azpharmacy.app.neoncrm.com/	1970-01-20 22:41:47	Name: AWSALBCORS Value: ivlbU+MTID+g8lS/acCOSF/fZq+DXq3228GnOZN6NkIHr13EMVJh9z4VwLf23spOjEvheMcHiTlvm6MPncG7aELcRgGWvIErrHhh8cvuFP5MIQ86gE5M/GF8y39U
azpharmacy.app.neoncrm.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 2D58E0A836C4D1711159B2FDB1FD512B
azpharmacy.app.neoncrm.com/	1970-01-21 07:17:18	Name: orgId Value: azpharmacy

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://gist.githubusercontent.com/M41KL-N41TT/7c89db4f971a7fd5dc381184bd3d4f23/raw/442ba4a025f86727df7d58de3fbe088d0c8bd12d/fowiwoeijiervoerier.js Message: Failed to load module script: Expected a JavaScript module script but the server responded with a MIME type of "text/plain". Strict MIME type checking is enforced for module scripts per HTML spec.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.neonemails.com
azpharmacy.app.neoncrm.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
challenges.cloudflare.com
findicons.com
gist.githubusercontent.com
il-rentacar.pt
images.freeimages.com
please-wait-redirecting.site
13.32.27.94
13.35.58.31
185.199.108.133
2606:4700:3037::6815:483f
2606:4700::6811:180e
2606:4700::6812:5e29
2606:4700::6812:5f29
2606:4700::6812:bb1f
34.193.213.229
52.205.214.8
88.198.36.249
2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36
25b1f543c4682618e2fff0c607d70a896ecfc080ce500c41ce00b7ffad0ec411
47ba09f99b9e72c39c3aacfe2657ce4745e8b8881dbacc1c41f7a76352e39314
5dfae9fbc00a25f0b1f1f2c4d5809efe2a38b206c1fc3f0b612325e21b34ba6c
6bb7b762f3da5a76b7c370f8b04576e3ac03b49a5a05ef8d338226c9049962f6
8aca978ef4c7d58d146e93ec9f3502f829a2ac00274d5a229995e5ef0ec3c988
c3f780e26aa6261c3b9a0ebe5aa80510197a11cc8412e24fd4688b05d478599f
db7284cae968813b965f10bcbc74bfc833b54c3ccce37a99c674e00e4a6d71e7
e9f100dee1745c2b62b08705672e474d3e7c5e871763b2d7ec951f1222ba5b96

please-wait-redirecting.site Open in urlscan Pro 2606:4700:3037::6815:483f Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

80 %HTTPS

45 %IPv6

9 Domains

10 Subdomains

8 IPs

2 Countries

81 kBTransfer

227 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

please-wait-redirecting.site Open in urlscan Pro
2606:4700:3037::6815:483f Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

45 %
IPv6

9
Domains

10
Subdomains

8
IPs

2
Countries

81 kB
Transfer

227 kB
Size

5
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!