papervalleymodelrailroad.org Open in urlscan Pro
2606:4700:3031::6815:1bed Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rb.gy/ybma82?go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcU...
Effective URL:
https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
Submission: On October 20 via manual (October 20th 2022, 12:43:23 pm UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 5 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3031::6815:1bed, located in United States and belongs to CLOUDFLARENET, US. The main domain is papervalleymodelrailroad.org.
TLS certificate: Issued by E1 on September 28th 2022. Valid for: 3 months.

This is the only time papervalleymodelrailroad.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cox (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.248.219.100 13.248.219.100	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:223... 2600:9000:223d:e200:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 12	2606:4700:303... 2606:4700:3031::6815:1bed	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	65.9.86.42 65.9.86.42	16509 (AMAZON-02) (AMAZON-02)
1	13.226.153.37 13.226.153.37	16509 (AMAZON-02) (AMAZON-02)
14	3

1 13.248.219.100 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: abaa834e320054d4d.awsglobalaccelerator.com

rb.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223d:e200:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

gj1ri.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3031::6815:1bed (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

papervalleymodelrailroad.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.86.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-86-42.ams1.r.cloudfront.net

global.oktacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.153.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-153-37.dus51.r.cloudfront.net

gateway.foresee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	papervalleymodelrailroad.org 1 redirects papervalleymodelrailroad.org	102 KB
2	oktacdn.com global.oktacdn.com — Cisco Umbrella Rank: 12471	47 KB
1	foresee.com gateway.foresee.com — Cisco Umbrella Rank: 4810	3 KB
1	app.link 1 redirects gj1ri.app.link	804 B
1	rb.gy 1 redirects rb.gy — Cisco Umbrella Rank: 195057	351 B
14	5

	Domain	Requested by
12	papervalleymodelrailroad.org	1 redirects papervalleymodelrailroad.org
2	global.oktacdn.com	papervalleymodelrailroad.org global.oktacdn.com
1	gateway.foresee.com	papervalleymodelrailroad.org
1	gj1ri.app.link	1 redirects
1	rb.gy	1 redirects
14	5

This site contains no links.

Subject Issuer	Validity	Valid
*.papervalleymodelrailroad.org E1	`2022-09-28` - `2022-12-27`	3 months	crt.sh
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-22` - `2023-01-22`	a year	crt.sh
foresee.com Amazon	`2022-05-28` - `2023-06-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
Frame ID: 307BD2FD74648D2D4BDA4C9F0BB1F0C9
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cox Login - Sign Into Your Cox Account

Page URL History Show full URLs

https://rb.gy/ybma82?go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbz... HTTP 301
https://gj1ri.app.link/zt0GXt0Ucub?/frtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ... HTTP 307
https://papervalleymodelrailroad.org/kin/CoxLab2022/?%2Ffrtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlg... HTTP 302
https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

14
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

1
Countries

151 kB
Transfer

883 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rb.gy/ybma82?go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0= HTTP 301
https://gj1ri.app.link/zt0GXt0Ucub?/frtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0%3D HTTP 307
https://papervalleymodelrailroad.org/kin/CoxLab2022/?%2Ffrtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0%3D&_branch_match_id=1111622982719128279&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAAwXB0Q6CIAAAwK%2FpVckgpK21ZqmzZnOLyt4ATQkwlrgcX99d75wdN2HYvZdfGTBrAy0HFXoHsocDVEx81322EUaCk5hDHAsYR2uMEWKQE9IQxH57y8eENa9jm%2BpO5oNUVZQm1Ljz3czm6VPDfbFqtTZcN57RYj4BfRG0n8rMlrdcwUrVsKbaVVewWB3%2Bb1pJGJQAAAA%3D HTTP 302
https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
papervalleymodelrailroad.org/kin/CoxLab2022/web/
Redirect Chain

https://rb.gy/ybma82?go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0=
https://gj1ri.app.link/zt0GXt0Ucub?/frtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0%3D
https://papervalleymodelrailroad.org/kin/CoxLab2022/?%2Ffrtgardfzd&go=275cb98b478c48267755a4b99d95awApbsCadfEeFlgiHnikQ2FCUmtLWmxmZzFmbzJ3ellmbldzaUJxK0lOcUhuNGpNVHk4QkY4YUltQT0%3D&_branch_match_id...
https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

27 KB
5 KB

96ms
96ms

Document
text/html

2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1947a67145677f2c55277b42bbd964ad4affd677262354f962660f85180dd794

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75d1d6a57d729ba1-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 20 Oct 2022 12:43:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gdkyh8jJBEfXYa9z3EosqSkCfGB0F5pk3GHvfr4rI8fE49Y1FU0r15KZpL%2FAhiROxhwJOqO04H%2FtXnvqIf6OB7YGhwzL0LdCc9MFBpMCOzoKRLokMFuJu5P%2FrvLb8bmpxVcmfhUalAhk582RzV0zoIefHnhuLbmGSH%2Bg"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-nginx-upstream-cache-status: BYPASS
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 75d1d6a4fbdb9ba1-FRA
content-type: text/html; charset=UTF-8
date: Thu, 20 Oct 2022 12:43:19 GMT
location: web/login.php?web/cox/SignOn#/now/overviewAccounts/overview/index=LwS9rCzgeC68F3SvKZkYNfh7PaNUBrXMBMFlhiNkiwpQSlJ2fY8bOXJefzd5FgHn1e9Bu7hMfUbt5y9s
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHyfEwHBLstc1EtN2TT0eDRvGlPerYjRV%2BcISlzuEKfxDZhzRqhn0meJD8C3RPQ90nh0s2iyGZt%2Fz%2FK3j9RJC55qoongbiWAfEiRlwyMOQ22AfVZwohB4JdtAAteTSb0as97sB1nuJ1%2BzqYWH9stsKwyz%2B%2BhXv5%2Fs6fi"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff
x-nginx-upstream-cache-status: MISS
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block

GET
H2 200 okta-sign-in.min.css
global.oktacdn.com/okta-signin-widget/3.8.2/css/ 180 KB
26 KB 80ms
16ms Stylesheet
text/css 65.9.86.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://global.oktacdn.com/okta-signin-widget/3.8.2/css/okta-sign-in.min.css

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.86.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-86-42.ams1.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

68ef764e2d683a2b137e78e7b4a96cc195e229729bf9f82ad7b92eb0892b3a06

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id: VioymT0ami6RAq5l.msmhnEwxweXAIS1
strict-transport-security: max-age=315360000
x-content-type-options: nosniff
date: Thu, 20 Oct 2022 06:13:58 GMT
content-encoding: gzip
x-amz-cf-pop: AMS1-C1
age: 23362
via: 1.1 241b025da3883bdb653910a6da97c0a8.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 20 Mar 2020 02:19:40 GMT
server: AmazonS3
etag: W/"92cb194fd7896eb0997c23a4a3dbb596"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: F77xi2KnOKW3Ou5fhF4OMAf-cIjO3qxUdKiRZ7W0jGiBHX2g7ol47Q==

GET
H3 200 flex-presentation.css
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/ 173 KB
26 KB 58ms
57ms Stylesheet
text/css 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4456f76512cd54420bbc6cd0b1f92db6f087ca96ca2cde36974f7cd6b3edb4f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Mon, 18 Oct 2021 20:52:50 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8fd%2FVIryp4nMeZBiHWTz6AOhAtzK0ck%2FjwIRKosOwtUZOOhBWfC5HrBj78y0EMU0Dk20127URvZMa1i%2B2wPR1TTKPpP%2FrwO%2BlnOEjRx2LEtwanvUAO8LrgOha7mbjTatcsr6QOfU179cQk5OyFL4QBqfrNY%2F5rdgpEFR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 75d1d6a61d08924d-FRA
expires: Sat, 19 Nov 2022 12:43:18 GMT

GET
H3 200 cox-residential-aemapp.css
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/ 424 KB
58 KB 79ms
78ms Stylesheet
text/css 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/cox-residential-aemapp.css

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c762adc41ad599e970d9abfa68241385a659911d11e96f152670620995d68f5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Sun, 12 Sep 2021 18:34:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oer7DTUwD972d5JcpgUKFF3f5%2F1AOP%2B2al%2FknX9uwEQAboH98h92d5tXGpBfd2GG9GYZVXws9YPTtmuiyd0PtCNKo2KQiFYZWcIT58Vjm0VKPaxgo%2BgVO2Xw9nF6HM4IeDN2YgdkZHAOL2lwhgDyNnkWpCSulF9iKwFv"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 75d1d6a61d0f924d-FRA
expires: Sat, 19 Nov 2022 12:43:18 GMT

GET
H3 200 flex2text-styles.min.css
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/ 5 KB
1 KB 49ms
49ms Stylesheet
text/css 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex2text-styles.min.css

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4929a2cc0087f4dc4362c4560fd1fb087168a026c0e798bbc869072ba0c2376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Sun, 12 Sep 2021 18:34:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=54vErAwUZhXyVaJNzAG%2Bm8%2BBfsN4Gg6Iya11Kh6KDcpvWHyKw7TckyUbZioyVZGhOj5MNWzQvYH2voEReoEhjM8zT0U2bfYtZCwgthAW5GyNBoODNMrJmrj%2Fm6LmCprTpP4ehVk6VEfo%2FPfnziGDWS2DA59XHniNucRn"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 75d1d6a61d12924d-FRA
expires: Sat, 19 Nov 2022 12:43:18 GMT

GET
H3 200 overrides.min.css
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/ 49 KB
9 KB 40ms
40ms Stylesheet
text/css 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/overrides.min.css

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c4a03e412933e80d79287abd90e2674bf51d408c30e49b850239b2378d7e899

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Sun, 12 Sep 2021 18:34:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jEb1tLQTc7dirMo5YYiMumDs3JrhZ1c43hcHuav3Ukcr5MqbIMqFQqVTElWyvx3di3kMKU2kjr%2Fy34i9sQ99G49yttzf%2FCWIVdf6V1RqmtAfg%2BPdTqEtgbRjgJaDyg3SCVZzE7ktD0OE2pvRoXoDYSIcnQ2yAsdtbyJV"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 75d1d6a61d17924d-FRA
expires: Sat, 19 Nov 2022 12:43:18 GMT

GET
H2 200 oo_icon_white.gif
gateway.foresee.com/code/5.10.4-oo/ 2 KB
3 KB 65ms
10ms Image
image/gif 13.226.153.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gateway.foresee.com/code/5.10.4-oo/oo_icon_white.gif
Requested by: Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.153.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-153-37.dus51.r.cloudfront.net
Software: /
Resource Hash: c3f012ffdb0be6fe0417057e7debc8c5129eed0476fd765cd93f234bb2cf77a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 23:11:47 GMT
via: 1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
age: 1431092
x-cache: Hit from cloudfront
status: 200
content-length: 2247
last-modified: Thu, 24 Jun 2021 17:07:14 GMT
etag: "f12d8abbdb0cb10ebe21199595d28c4b"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=2419200
access-control-allow-headers: X-Requested-With
x-amz-cf-id: KH-iLlpNZoi0aXt3OQV8mpj8JG4NuLRMfaUIleyM9FKzUTl9hSBHIA==
expires: Mon, 31 Oct 2022 23:11:47 GMT

GET
H3 200 cox_logo.png
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/img/ 2 KB
2 KB 34ms
34ms Image
image/png 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/img/cox_logo.png

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d60826499153bf6fcb4e8a8809d3b10d737cf4990ee4a0c8d796af7d5c0a9175

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/login.php?web/cox/SignOn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1865
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Mon, 18 Oct 2021 15:55:26 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6PE3f9NY4UxpPrfuWR3oqLrnel%2Fa0kTq1cmMtBk%2FypAEzd8orsIPUhrd3lvPr4DzVPbAX8rJbLI2cQtucmitFwllyy3p6F44CzwQbl2LsdfN4LzffE1zSoy%2FlRtmoTEfZCdjWS7J6Js6t17gSHouq0XYeUqiY6ck7yfu"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=5184000
accept-ranges: bytes
cf-ray: 75d1d6a6ce5f924d-FRA
expires: Mon, 19 Dec 2022 12:43:18 GMT

GET
H3 200 checkbox-default.svg
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/img/ 270 B
768 B 45ms
45ms Image
image/svg+xml 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/img/checkbox-default.svg

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/cox-residential-aemapp.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5647edf02795dbd3d4fb9f5c38e1ffefa0d563c31c9cc060db7320e28bf9844

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/cox-residential-aemapp.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: STALE
last-modified: Sun, 12 Sep 2021 18:34:34 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J3SDD8oIMGJ2wPhXdDaL9DomZ3zG1H6y2os6WmkXt%2F4I3X44%2Fl6M1%2BAzDy0Olo1dtjkTlcp5se%2BWWdO460Io6tQtCO2VxOkvVjUSs9a47C8Y6HOyzPn%2BYMO1KY3iqbJ92A1ndObJZ6BsJJ6ElEb6%2FczUn27zwstM79Qm"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=5184000
cf-ray: 75d1d6a6ce60924d-FRA
expires: Mon, 19 Dec 2022 12:43:18 GMT

GET
H2 200 okticon.woff
global.oktacdn.com/okta-signin-widget/3.8.2/font/ 20 KB
21 KB 50ms
19ms Font
application/octet-stream 65.9.86.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://global.oktacdn.com/okta-signin-widget/3.8.2/font/okticon.woff

Requested by

Host: global.oktacdn.com
URL: https://global.oktacdn.com/okta-signin-widget/3.8.2/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.86.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-86-42.ams1.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000
X-Content-Type-Options	nosniff

Request headers

Referer: https://global.oktacdn.com/okta-signin-widget/3.8.2/css/okta-sign-in.min.css
Origin: https://papervalleymodelrailroad.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

x-amz-version-id: dDQhkYt0RHrEVEp9cvTtLweQzsWLGlTl
strict-transport-security: max-age=315360000
x-content-type-options: nosniff
date: Thu, 20 Oct 2022 07:18:57 GMT
via: 1.1 e328b143eb69c36369a2def78300d502.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-C1
age: 19463
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 20600
last-modified: Fri, 20 Mar 2020 02:19:41 GMT
server: AmazonS3
etag: "db28723126138387cdf40680e6e0fa5d"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: sfrDvxUV2kOSpvEEUzqavNVeQu8XGL3QNJEYqyoSZuHK0bpi7qhFKQ==

GET
H3 404 OpenSans-Regular-webfont.woff
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/ 0
0 52ms
52ms Font
text/html 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Regular-webfont.woff

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css
Origin: https://papervalleymodelrailroad.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S29F2C%2F3XVEgh6oDdADWPbf8Emh5KBjWBNY8lTe9rVLobw0SkMSjrQrvQlzASEaK4Ysyr5vqKxYdE7yACJpT704CSLGi8AuuvyxOdKOaig7iJuibFIs%2BeNDUjRNshVm3o0Ry6VcZlBLJnj7bmFCK0xsER70%2FcZZDVVu2"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 75d1d6a6de6a924d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 404 OpenSans-Semibold-webfont.woff
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/ 0
0 43ms
43ms Font
text/html 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Semibold-webfont.woff

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css
Origin: https://papervalleymodelrailroad.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2FRcu9bVqXqD6MOjXHYRJBGTFvdmj4N3p2LWv1Qtlz3p%2B9QqotYIVyAVxVTCaovRQG89EQopzckb%2B2M8r%2BjPnZm4p881ZT3a14xbbPCryN12oUR3%2BF0vBqmc52lFRYVGZtoR7sZLFPkDULp5KxUZ3DGWVKYPAxOIUJbI"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 75d1d6a6de87924d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 404 OpenSans-Semibold-webfont.ttf
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/ 0
0 47ms
46ms Font
text/html 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Semibold-webfont.ttf

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css
Origin: https://papervalleymodelrailroad.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4c3jjesyg2uXITnX4ghdAbK8YSTwWDjptlucmkAWrrc2EDBkoNi0094ZZhVvChdPRSCKVJtSSxeEqHjhEjlC8LBWmwrJ1iasgfCJlxZHvyjAAYMD1ivOkNHFSGKcNvAVi8r%2FKvyGnwuZ9gTtVk%2FUQZy73%2F7eYggEU7I8"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 75d1d6a72f4b924d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 404 OpenSans-Regular-webfont.ttf
papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/ 0
0 51ms
51ms Font
text/html 2606:4700:3031::6815:1bed
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Regular-webfont.ttf

Requested by

Host: papervalleymodelrailroad.org
URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::6815:1bed , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/flex-presentation.css
Origin: https://papervalleymodelrailroad.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Thu, 20 Oct 2022 12:43:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yRAyR90UuywId0%2BR3yY0uTe%2BCfvThi%2F%2FqJJwkfkc3veCpWB84d98yTHM4xg0dQ66d3LTbrOCAkH8cNuLHjpuZ5Mzx%2BtlfXBQ%2B%2BNB4cJeo8diZGiUQZaqz%2BXqtzX%2B2N68aOIUlbXUW%2B9mZ0Mt%2FzfqN2aCXiZbJT2yTcdh"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 75d1d6a72f50924d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cox (Telecommunication)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.app.link/	1970-01-20 15:36:45	Name: _s Value: 1ufZcXFaQlobRFsUd5tqvWQV%2BrJDNoBbVprkJUhC1X0YMQsQ12w8G8y5zqVkVskc

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Semibold-webfont.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Regular-webfont.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Semibold-webfont.ttf Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://papervalleymodelrailroad.org/kin/CoxLab2022/web/assets/css/fonts/OpenSans-Regular-webfont.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gateway.foresee.com
gj1ri.app.link
global.oktacdn.com
papervalleymodelrailroad.org
rb.gy
13.226.153.37
13.248.219.100
2600:9000:223d:e200:19:9934:6a80:93a1
2606:4700:3031::6815:1bed
65.9.86.42
1947a67145677f2c55277b42bbd964ad4affd677262354f962660f85180dd794
4456f76512cd54420bbc6cd0b1f92db6f087ca96ca2cde36974f7cd6b3edb4f4
68ef764e2d683a2b137e78e7b4a96cc195e229729bf9f82ad7b92eb0892b3a06
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
8c4a03e412933e80d79287abd90e2674bf51d408c30e49b850239b2378d7e899
b4929a2cc0087f4dc4362c4560fd1fb087168a026c0e798bbc869072ba0c2376
c3f012ffdb0be6fe0417057e7debc8c5129eed0476fd765cd93f234bb2cf77a3
c762adc41ad599e970d9abfa68241385a659911d11e96f152670620995d68f5e
d60826499153bf6fcb4e8a8809d3b10d737cf4990ee4a0c8d796af7d5c0a9175
e5647edf02795dbd3d4fb9f5c38e1ffefa0d563c31c9cc060db7320e28bf9844

papervalleymodelrailroad.org Open in urlscan Pro 2606:4700:3031::6815:1bed Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

3 IPs

1 Countries

151 kBTransfer

883 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

4 Console Messages

Security Headers

Indicators

papervalleymodelrailroad.org Open in urlscan Pro
2606:4700:3031::6815:1bed Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

1
Countries

151 kB
Transfer

883 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!