phja81vt4zm2753xe960gybd.z13.web.core.windows.net Open in urlscan Pro
52.239.221.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Submission: On September 11 via manual (September 11th 2024, 7:24:09 pm UTC) from CA — Scanned from CA

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 6 domains to perform 25 HTTP transactions. The main IP is 52.239.221.231, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is phja81vt4zm2753xe960gybd.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on August 23rd 2024. Valid for: a year.

This is the only time phja81vt4zm2753xe960gybd.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
4	52.239.221.231 52.239.221.231	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
16	2a02:4780:21:... 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	2607:f8b0:400... 2607:f8b0:4006:81f::200e	15169 (GOOGLE) (GOOGLE)
1	2600:141b:1c0... 2600:141b:1c00:2488::f03	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	172.67.208.186 172.67.208.186	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	7

4 52.239.221.231 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

phja81vt4zm2753xe960gybd.z13.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:821::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 (Phoenix, United States)

ASN47583 (AS-HOSTINGER, CY)

nerdinthebrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81f::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2488::f03 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

support.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.208.186 (United States)

ASN13335 (CLOUDFLARENET, US)

userstatics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	nerdinthebrain.com nerdinthebrain.com	200 KB
4	windows.net phja81vt4zm2753xe960gybd.z13.web.core.windows.net	24 KB
1	userstatics.com userstatics.com — Cisco Umbrella Rank: 303208	689 B
1	microsoft.com support.microsoft.com — Cisco Umbrella Rank: 12550
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	103 KB
25	6

	Domain	Requested by
16	nerdinthebrain.com	phja81vt4zm2753xe960gybd.z13.web.core.windows.net
4	phja81vt4zm2753xe960gybd.z13.web.core.windows.net	phja81vt4zm2753xe960gybd.z13.web.core.windows.net
1	userstatics.com	nerdinthebrain.com
1	support.microsoft.com	phja81vt4zm2753xe960gybd.z13.web.core.windows.net
1	www.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	phja81vt4zm2753xe960gybd.z13.web.core.windows.net
25	6

This site contains no links.

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 04	`2024-08-23` - `2025-08-18`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
nerdinthebrain.com R10	`2024-07-27` - `2024-10-25`	3 months	crt.sh
support.microsoft.com Microsoft Azure ECC TLS Issuing CA 04	`2024-05-01` - `2025-04-26`	a year	crt.sh
userstatics.com WE1	`2024-07-24` - `2024-10-22`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Frame ID: 078272EC14946AA8A136A5D9CE09B9B0
Requests: 25 HTTP requests in this frame

Frame: https://support.microsoft.com/contactus
Frame ID: B0C6382F32AB1C61433F85E988DD0CB4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft Security center Alert

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

25
Requests

96 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

1
Countries

328 kB
Transfer

810 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ 22 KB
23 KB 344ms
76ms Document
text/html 52.239.221.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.239.221.231 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f3b1fd5811eabd05f9c80b3bdbe115c557cfb42c62110ebce22e4d3cddd8465f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Content-Length: 22834
Content-MD5: 23uT2bmN8fhmAQnaRPn8Ug==
Content-Type: text/html
Date: Wed, 11 Sep 2024 19:24:03 GMT
ETag: "0x8DCD28F4C0C3F40"
Last-Modified: Wed, 11 Sep 2024 18:26:47 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: bb095a4a-c01e-0079-3180-0434bb000000
x-ms-version: 2018-03-28

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 309 KB
103 KB 385ms
109ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e286257ee7732c3f2518fa78140e81c4f0cdcd205ef021aafaae6fa7622eb869

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 104638
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 11 Sep 2024 19:24:05 GMT

GET
H2 200 tapa.css
nerdinthebrain.com/itez/bb/css/ 20 KB
5 KB 512ms
170ms Stylesheet
text/css 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/css/tapa.css

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

71bfb296313c3c1a5055e979377ad542d9d956b4d776327bfc960406670dd725

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 16654
alt-svc: h3=":443"; ma=86400
content-length: 4223
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "4e03-66e087a9-7030c17c5225265;br"
x-hcdn-request-id: 3126946ddeccdadbed81b6d67c77a3ac-phx-edge6
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 14:46:31 GMT

GET
H2 200 bootstrap.min.css
nerdinthebrain.com/itez/bb/css/ 216 KB
26 KB 503ms
169ms Stylesheet
text/css 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/css/bootstrap.min.css

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

458065441358714a3d8d72dbb55b98de5f274a030d44cc117eea1fb038c08299

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 16654
alt-svc: h3=":443"; ma=86400
content-length: 26239
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "35e94-66e087a9-320ef6cc287d7bd0;br"
x-hcdn-request-id: 0a12eca08d9b0f6c55a4135fd91b1636-phx-edge6
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 14:46:31 GMT

GET
H2 200 jquery.min.js Show response
nerdinthebrain.com/itez/bb/js/ 83 KB
29 KB 505ms
171ms Script
application/x-javascript 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/js/jquery.min.js

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 16654
alt-svc: h3=":443"; ma=86400
content-length: 28857
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "14b51-66e087a9-717ce754e2cf38b2;br"
x-hcdn-request-id: af3f94cd930156f1ebe277f5e679a639-phx-edge6
content-type: application/x-javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 14:46:31 GMT

GET bootstrap.min.js
nerdinthebrain.com/itez/bb/js/ 0
0

GET
H2 200 font-awesome.min.css
nerdinthebrain.com/itez/bb/css/ 27 KB
6 KB 503ms
169ms Stylesheet
text/css 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/css/font-awesome.min.css

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 16654
alt-svc: h3=":443"; ma=86400
content-length: 5850
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "6b24-66e087a9-da28b75541cda99a;br"
x-hcdn-request-id: 3a213d391b59b31331205cd9e34dc0b7-phx-edge6
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 14:46:31 GMT

GET
H2 200 esc.js Show response
nerdinthebrain.com/itez/bb/js/ 99 B
480 B 504ms
171ms Script
application/x-javascript 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/js/esc.js

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

36c93ecca4ea10ed850a8b04465a4141f6afc135419d644181e63a98da87a376

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
panel: hpanel
age: 16654
alt-svc: h3=":443"; ma=86400
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: W/"63-66e087a9-2f9fddff68293551;;;"
vary: Accept-Encoding
x-hcdn-request-id: adf575d28ac29a0aeb9077d3fbd3cb8d-phx-edge6
content-type: application/x-javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
platform: hostinger
expires: Wed, 18 Sep 2024 14:46:31 GMT

GET
H2 200 flscn.js Show response
nerdinthebrain.com/itez/bb/js/ 269 B
530 B 504ms
171ms Script
application/x-javascript 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/js/flscn.js

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

34ccdb50687c38ca7f6f04c46aaba862b1e93f6bd1ab158915a4ae1034f2e65e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-security-policy: upgrade-insecure-requests
content-encoding: br
panel: hpanel
age: 3489
alt-svc: h3=":443"; ma=86400
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: W/"10d-66e087a9-c66d5b4b5290a94f;;;"
vary: Accept-Encoding
x-hcdn-request-id: 9340dc959ead8e0ea0f02f7bb0c3af09-phx-edge6
content-type: application/x-javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
platform: hostinger
expires: Wed, 18 Sep 2024 18:25:56 GMT

GET
H2 200 main.js Show response
nerdinthebrain.com/itez/bb/js/ 2 KB
1009 B 508ms
174ms Script
application/x-javascript 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/js/main.js

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

3616cf46b53ecac41813d66874380a99715b0b31baf1c27c5db0ba320b9369c8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 3489
alt-svc: h3=":443"; ma=86400
content-length: 594
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "891-66e087a9-89d0a483c9c0e5db;br"
x-hcdn-request-id: b46c7ab9f081af12ace5e6e1ce6b5ede-phx-edge6
content-type: application/x-javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 18:25:56 GMT

GET
H2 200 mnc.png
nerdinthebrain.com/itez/bb/images/ 484 B
722 B 178ms
177ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/mnc.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 48ff940e394fb1968b729c29a719aac4e64c6943e32a77d74f0ddd84db8ccfba

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: 20b9d7a3ccfc6131e937e657ddd730bf-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 484

GET
H2 200 msmm.png
nerdinthebrain.com/itez/bb/images/ 474 B
712 B 178ms
178ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/msmm.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 0b2ec8ec8e4677ed296b07891de45bbb1fb301eaa2840968462fb704f216bd07

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: c49672eb234aff22805727f80d830ad6-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 474

GET
H2 200 set.png
nerdinthebrain.com/itez/bb/images/ 360 B
598 B 111ms
107ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/set.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 2595e57e581712bacbbb36e04af8eca3911068fc15fe527fd048ee5562ebc61e

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: 274cf081993152ecc106e3f76344dffe-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 360

GET
H2 200 vsc.png
nerdinthebrain.com/itez/bb/images/ 992 B
1 KB 175ms
172ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/vsc.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 33ccd8e22b64f8375988afca456e153a82a1f27d601b7bd40261edb4ae2a4c7d

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: d6a150ffa19054d17f211afde6b65bc3-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 992

GET
H2 200 scn.png
nerdinthebrain.com/itez/bb/images/ 3 KB
3 KB 161ms
159ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/scn.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 94938f012d4be173e3e8b11506268736d896fbca6cffde2c720ca6643e589637

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: 95c85437596c929164d7294358e1ddb4-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2562

GET
H/1.1 404
The requested content does not exist. bg1.png
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/images/ 321 B
321 B 65ms
64ms Image
text/html 52.239.221.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/images/bg1.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.239.221.231 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: b2111c6960cb3ead19b7a3fb8f13151bf0c111a68ceaaf3324ee839507d068a7

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-request-id: bb095c93-c01e-0079-2980-0434bb000000
Date: Wed, 11 Sep 2024 19:24:04 GMT
x-ms-version: 2018-03-28
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound
Content-Length: 321
Content-Type: text/html

GET
H2 200 bel.png
nerdinthebrain.com/itez/bb/images/ 364 B
602 B 161ms
160ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/itez/bb/images/bel.png
Requested by: Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: f0cea24a9aa91f2a46a2b70f8f34d2837f57377d618dab0e4e08df8743016934

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 3489
x-hcdn-request-id: 12beb7ae26399f376a25a6bcb9d4cf23-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 364

GET
H2 200 1.webp
nerdinthebrain.com/itez/bb/images/ 10 KB
10 KB 161ms
160ms Image
image/webp 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nerdinthebrain.com/itez/bb/images/1.webp

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

a7f0e4544075c15917ec572b96858df8d706288c67005eac4f4477447e9e8f65

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-security-policy: upgrade-insecure-requests
panel: hpanel
age: 3489
alt-svc: h3=":443"; ma=86400
content-length: 9808
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
etag: "2650-66e087a9-561bcd394f2bac55;;;"
x-hcdn-request-id: 860e3b99d4e7a97e191c07adce068b5f-phx-edge6
content-type: image/webp
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
platform: hostinger
expires: Wed, 18 Sep 2024 18:25:56 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 414ms
171ms Fetch
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-F9ZFHN0DV3&gtm=45je4990v9182508741za200&_p=1726082644791&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=0&cid=597986550.1726082645&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1726082645&sct=1&seg=0&dl=https%3A%2F%2Fphja81vt4zm2753xe960gybd.z13.web.core.windows.net%2F%3Fmsclkid%3D3cf2f4b4cf621fbc99a192552b2902d1&dt=Microsoft%20Security%20center%20Alert&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=943
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81f::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 11 Sep 2024 19:24:05 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 contactus
support.microsoft.com/ Frame B0C6 0
0 1661ms
1229ms Document
text/html 2600:141b:1c00:2488::f03
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://support.microsoft.com/contactus

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:2488::f03 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/ ASP.NET

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-Ems-Correlationid,X-Ems-SessionId
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 31034
content-type: text/html; charset=utf-8
date: Wed, 11 Sep 2024 19:24:07 GMT
expires: Wed, 11 Sep 2024 19:24:07 GMT
pragma: no-cache
request-context: appId=cid-v1:b8b1f729-292d-4d99-ae99-6e39faf60ad8
strict-transport-security: max-age=86400 ; includeSubDomains
vary: Accept-Encoding
x-azure-ref: 20240911T192405Z-16579567576fh7f86y3uqsyhx00000000pn000000000whmz
x-content-type-options: nosniff
x-ems-correlationid: c195e77b-2a2b-46a1-8a26-e747f55a8de1
x-ems-envname: emerald-prod-eus2
x-ems-instname: PD0SDWK0009PZ
x-ems-sessionid: c195e77b-2a2b-46a1-8a26-e747f55a8de1
x-powered-by: ASP.NET
x-processing-time-from-csp: 1140ms

GET
DATA 200
OK truncated
/ 349 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 206 beep.mp3
nerdinthebrain.com/itez/bb/media/ 8 KB
9 KB 129ms
128ms Media
audio/mpeg 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/media/beep.mp3

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
panel: hpanel
age: 3489
etag: "20d5-66e087a9-491bf0653c2e5f86;;;"
x-hcdn-request-id: 2a943b73bf393c8c5f4af3bc5349f20b-phx-edge6
content-type: audio/mpeg
Content-Range: bytes 0-8404/8405
x-turbo-charged-by: LiteSpeed
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 8405

GET
H2 206 eng.mp3
nerdinthebrain.com/itez/bb/media/ 108 KB
108 KB 129ms
128ms Media
audio/mpeg 2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/itez/bb/media/eng.mp3

Requested by

Host: phja81vt4zm2753xe960gybd.z13.web.core.windows.net
URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:4780:21:b8c3:1ca3:d3bd:e63:c608 Phoenix, United States, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

9fa4f2ad709ff397d792afa42087c38ac2d13ac10ee104e557f594ffbf93a603

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 11 Sep 2024 19:24:05 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: HIT
last-modified: Tue, 10 Sep 2024 17:53:45 GMT
server: hcdn
panel: hpanel
age: 3489
etag: "1ae95-66e087a9-be8165b7a11d89d4;;;"
x-hcdn-request-id: 6fd76be105d64a92763b3b22d7c4941c-phx-edge6
content-type: audio/mpeg
Content-Range: bytes 0-110228/110229
x-turbo-charged-by: LiteSpeed
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 110229

GET
H3 200 script.js Show response
userstatics.com/get/ 133 B
689 B 464ms
297ms Script
text/javascript 172.67.208.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://userstatics.com/get/script.js?referrer=https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Requested by: Host: nerdinthebrain.com
URL: https://nerdinthebrain.com/itez/bb/js/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.208.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.1
Resource Hash: df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 19:24:06 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.2.1
vary: Accept-Encoding
access-control-allow-methods: GET, POST
content-type: text/javascript; charset=utf-8
access-control-allow-origin: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nv4rqPHGJoVrh7a5LUMaiG%2By%2FzKED645M9IfHLlH3%2F2E%2BAhxgN8Qsj%2Bcn5%2BNdKb8%2FuJVgqIhW7%2FpRKwIXjzyiCC4UzZOJQZg2W4UROGfffYKprmbPUrw6gta01%2BC74WlQL4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8c1a093d3f5f36d9-YYZ
access-control-allow-headers: X-Requested-With,content-type
alt-svc: h3=":443"; ma=86400

GET
H/1.1 404
The requested content does not exist. w3.html
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ 321 B
629 B 93ms
93ms Other
text/html 52.239.221.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/w3.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.239.221.231 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 50614a0933c4dae3a1e38214db5353082030a4e3c32e1d763a0d861146473f3b

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-request-id: bb0968e4-c01e-0079-7080-0434bb000000
Date: Wed, 11 Sep 2024 19:24:08 GMT
x-ms-version: 2018-03-28
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound
Content-Length: 321
Content-Type: text/html

GET
H/1.1 404
The requested content does not exist. w1.html
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ 321 B
629 B 47ms
45ms Other
text/html 52.239.221.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/w1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 52.239.221.231 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 64ff929d576a748b07c5349f9967d2cf26f10147ab85afbfc3d35b751da9815e

Request headers

Referer: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-ms-request-id: bb096a8c-c01e-0079-5780-0434bb000000
Date: Wed, 11 Sep 2024 19:24:08 GMT
x-ms-version: 2018-03-28
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound
Content-Length: 321
Content-Type: text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/itez/bb/js/bootstrap.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.windows.net/	1970-01-21 09:04:02	Name: _ga_F9ZFHN0DV3 Value: GS1.1.1726082645.1.0.1726082645.0.0.0
.windows.net/	1970-01-21 09:04:02	Name: _ga Value: GA1.1.597986550.1726082645
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/	1970-01-20 23:28:42	Name: PHPREFS Value: full
.support.microsoft.com/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: 0241d6265034feef4a36c16a45a840bac100cb636af65f2ce6dfa779f8a3cda5
support.microsoft.com/	1970-01-21 08:13:38	Name: MicrosoftApplicationsTelemetryDeviceId Value: 2559e58f-4dde-489f-b55c-5ce95d278905
support.microsoft.com/	1970-01-21 08:13:38	Name: ai_user Value: NeRN7CzF+FqGhnNP+kUnyJ\|2024-09-11T19:24:08.203Z
support.microsoft.com/	1970-01-20 23:28:04	Name: ai_session Value: t22QwKW04uhq2oqMOOx2Zh\|1726082648015\|1726082648969

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1 Message: Access to script at 'https://nerdinthebrain.com/itez/bb/js/bootstrap.min.js' from origin 'https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://nerdinthebrain.com/itez/bb/js/bootstrap.min.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/images/bg1.png Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
network	error	URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/w3.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
security	error	Message: Refused to frame 'https://mem.gfx.ms/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://support.microsoft.com".
network	error	URL: https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/w1.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nerdinthebrain.com
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
support.microsoft.com
userstatics.com
www.google-analytics.com
www.googletagmanager.com
nerdinthebrain.com
172.67.208.186
2600:141b:1c00:2488::f03
2607:f8b0:4006:81f::200e
2607:f8b0:4006:821::2008
2a02:4780:21:b8c3:1ca3:d3bd:e63:c608
52.239.221.231
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
0b2ec8ec8e4677ed296b07891de45bbb1fb301eaa2840968462fb704f216bd07
2595e57e581712bacbbb36e04af8eca3911068fc15fe527fd048ee5562ebc61e
33ccd8e22b64f8375988afca456e153a82a1f27d601b7bd40261edb4ae2a4c7d
34ccdb50687c38ca7f6f04c46aaba862b1e93f6bd1ab158915a4ae1034f2e65e
3616cf46b53ecac41813d66874380a99715b0b31baf1c27c5db0ba320b9369c8
36c93ecca4ea10ed850a8b04465a4141f6afc135419d644181e63a98da87a376
436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
458065441358714a3d8d72dbb55b98de5f274a030d44cc117eea1fb038c08299
48ff940e394fb1968b729c29a719aac4e64c6943e32a77d74f0ddd84db8ccfba
50614a0933c4dae3a1e38214db5353082030a4e3c32e1d763a0d861146473f3b
64ff929d576a748b07c5349f9967d2cf26f10147ab85afbfc3d35b751da9815e
71bfb296313c3c1a5055e979377ad542d9d956b4d776327bfc960406670dd725
94938f012d4be173e3e8b11506268736d896fbca6cffde2c720ca6643e589637
9fa4f2ad709ff397d792afa42087c38ac2d13ac10ee104e557f594ffbf93a603
a7f0e4544075c15917ec572b96858df8d706288c67005eac4f4477447e9e8f65
b2111c6960cb3ead19b7a3fb8f13151bf0c111a68ceaaf3324ee839507d068a7
ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e286257ee7732c3f2518fa78140e81c4f0cdcd205ef021aafaae6fa7622eb869
f0cea24a9aa91f2a46a2b70f8f34d2837f57377d618dab0e4e08df8743016934
f3b1fd5811eabd05f9c80b3bdbe115c557cfb42c62110ebce22e4d3cddd8465f

phja81vt4zm2753xe960gybd.z13.web.core.windows.net Open in urlscan Pro 52.239.221.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

25 Requests

96 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

7 IPs

1 Countries

328 kBTransfer

810 kBSize

7 Cookies

0 Outgoing links

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

7 Cookies

6 Console Messages

Indicators

phja81vt4zm2753xe960gybd.z13.web.core.windows.net Open in urlscan Pro
52.239.221.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

96 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

1
Countries

328 kB
Transfer

810 kB
Size

7
Cookies

25 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!