Submitted URL: http://korotko-web.pages.dev/
Effective URL: https://korotko-web.pages.dev/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On November 30 via api from IT — Scanned from NL

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 10 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is korotko-web.pages.dev.
TLS certificate: Issued by WE1 on November 30th 2024. Valid for: 3 months.
This is the only time korotko-web.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 188.114.96.3 13335 (CLOUDFLAR...)
4 216.58.206.42 15169 (GOOGLE)
1 23.75.65.39 16625 (AKAMAI-AS)
1 88.221.168.178 16625 (AKAMAI-AS)
10 4
Apex Domain
Subdomains
Transfer
4 googleapis.com
firestore.googleapis.com — Cisco Umbrella Rank: 1478
508 B
4 pages.dev
korotko-web.pages.dev
125 KB
1 dailymail.co.uk
i.dailymail.co.uk — Cisco Umbrella Rank: 12098
158 KB
1 telegraph.co.uk
www.telegraph.co.uk — Cisco Umbrella Rank: 40474
75 KB
10 4
Domain Requested by
4 firestore.googleapis.com korotko-web.pages.dev
4 korotko-web.pages.dev korotko-web.pages.dev
1 i.dailymail.co.uk
1 www.telegraph.co.uk
10 4

This site contains no links.

Subject Issuer Validity Valid
korotko-web.pages.dev
WE1
2024-11-30 -
2025-02-28
3 months crt.sh
edgecert.googleapis.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
www.telegraph.co.uk
DigiCert TLS RSA SHA256 2020 CA1
2024-09-19 -
2025-01-23
4 months crt.sh
*.dailymail.co.uk
DigiCert TLS RSA SHA256 2020 CA1
2024-07-23 -
2025-07-23
a year crt.sh

This page contains 1 frames:

Primary Page: https://korotko-web.pages.dev/
Frame ID: 20DC7E4B54B1EC2D8504FC097287C5B8
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

sh[0]rt news

Page URL History Show full URLs

  1. http://korotko-web.pages.dev/ HTTP 307
    https://korotko-web.pages.dev/ Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

359 kB
Transfer

8942 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://korotko-web.pages.dev/ HTTP 307
    https://korotko-web.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
korotko-web.pages.dev/
Redirect Chain
  • http://korotko-web.pages.dev/
  • https://korotko-web.pages.dev/
664 B
1 KB
Document
General
Full URL
https://korotko-web.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8c429ca76ae86bb76b3a737b66508569734ac665680c31837c4d99f3c32d08a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8ead8e46afb966b2-AMS
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 30 Nov 2024 20:23:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=44BAxxNfPxu5zuz6KcIDd5kaLUM6zchiE2S5GM0aIXgMwkV0jmpdnJBBXTNkDHx5sr%2BCY18VXKqwJjKj%2BSWzfYLKgMULD00UbIg%2B5x9Fu4v0sjzXX07yPuWD5RkwSTUrWq8dCP%2F%2BkME%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=12156&min_rtt=11811&rtt_var=2953&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4150&recv_bytes=4446&delivery_rate=47201&cwnd=12000&unsent_bytes=0&cid=6c0ed1ce216a59d1&ts=65&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://korotko-web.pages.dev/
Non-Authoritative-Reason
HSTS
main.8c049424.js
korotko-web.pages.dev/static/js/
385 KB
121 KB
Script
General
Full URL
https://korotko-web.pages.dev/static/js/main.8c049424.js
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92c08b9cdb6f78dd7051ef8388f228d396dff82e8a8a5e941a81eafbe808c2ab
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

content-encoding
br
etag
W/"cc331155de2bc423d4576c8c78398c78"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BRR7tSGb5l4GcVbp5mst1MpjQo4ILHtxOuq0fzf9DTuakjXkcIy1k8qGSxewsb4Rw%2FGwWi7j3bFH0kGZ9%2FbfDGc%2FmkVHdthXe9utgcBEEeIGyk9s1HIeMYWO2XrdUfEprGAoWV4Pcp8%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=13047&min_rtt=11811&rtt_var=3587&sent=13&recv=12&lost=0&retrans=0&sent_bytes=5228&recv_bytes=5105&delivery_rate=29379&cwnd=12000&unsent_bytes=0&cid=6c0ed1ce216a59d1&ts=110&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 30 Nov 2024 20:23:31 GMT
content-type
application/javascript
vary
Accept-Encoding
priority
u=3,i=?0
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8ead8e47185066b2-AMS
access-control-allow-origin
*
server
cloudflare
main.afd1e5f2.css
korotko-web.pages.dev/static/css/
3 KB
2 KB
Stylesheet
General
Full URL
https://korotko-web.pages.dev/static/css/main.afd1e5f2.css
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7070be6e5a54cf7c37ac25738852a3bcf82374cd90f6a0d0a0f5830a4057e15c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

content-encoding
br
etag
W/"bf24d515d57404e3652e196d07023741"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tbpjmgyGXf583mrI%2BDDLI8SMPtyW6OtGIoH3shxJiIxfIKksTqSdqcTfdcpF3OZF4qMRjhX%2FbQcI6HE0fY0O8YCkZpcyzIZqc94Y8b0DN4plSkWoAuEYaOfmyJt3JECvm66PfAuvbvM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=13047&min_rtt=11811&rtt_var=3587&sent=14&recv=12&lost=0&retrans=0&sent_bytes=5948&recv_bytes=5105&delivery_rate=29379&cwnd=12000&unsent_bytes=0&cid=6c0ed1ce216a59d1&ts=111&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 30 Nov 2024 20:23:31 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8ead8e47185666b2-AMS
access-control-allow-origin
*
server
cloudflare
favicon.png
korotko-web.pages.dev/
723 B
1 KB
Other
General
Full URL
https://korotko-web.pages.dev/favicon.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
68777724cbdad2bcd30601979d2bbbcb6accfa39afde72d1696a5c1e3d61145d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

etag
"1e7024cec2a1d5a79faa2abe898e29ad"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JkaXNVDQVwdgHD7Qosg%2FUg%2FfeUOwf4g78o6lgp24rA4wWva2nqDPV49fGZnjYtqSNl5gncb0xH8sxUkA%2FgbeA597bdkgKPxncn0a2g0B2qzkRnSRY%2BaMSWskKxIhoy0pr4bH7NekRHU%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=12003&min_rtt=11636&rtt_var=337&sent=125&recv=38&lost=0&retrans=0&sent_bytes=134071&recv_bytes=6547&delivery_rate=5111503&cwnd=79200&unsent_bytes=0&cid=6c0ed1ce216a59d1&ts=214&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 30 Nov 2024 20:23:31 GMT
content-type
image/png
vary
Accept-Encoding
priority
u=1,i
cache-control
public, max-age=0, must-revalidate
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
cf-ray
8ead8e47c93866b2-AMS
access-control-allow-origin
*
content-length
723
server
cloudflare
channel
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/
54 B
455 B
Fetch
General
Full URL
https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?VER=8&database=projects%2Falgesnews%2Fdatabases%2F(default)&RID=878&CVER=22&X-HTTP-Session-Id=gsessionid&zx=l5tccob3b8x&t=1
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/static/js/main.8c049424.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lcfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
629929a8bca7bd277677e2ba1c6cabb7618c1dcf229858fd80011f8150ab8c05
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type
application/x-www-form-urlencoded
Referer
https://korotko-web.pages.dev/

Response headers

access-control-expose-headers
x-client-wire-protocol,x-http-session-id
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 30 Nov 2024 20:23:31 GMT
content-type
text/plain; charset=utf-8
vary
origin
x-http-session-id
PlC_6Gf0lLRvpPi3b_UBtlw_sulPKb7uAcmE5bJ3piw
x-frame-options
SAMEORIGIN
cache-control
private
access-control-allow-credentials
true
x-client-wire-protocol
h2
access-control-allow-origin
https://korotko-web.pages.dev
content-length
71
x-xss-protection
0
server
ESF
channel
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/
8 MB
0
Fetch
General
Full URL
https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?gsessionid=PlC_6Gf0lLRvpPi3b_UBtlw_sulPKb7uAcmE5bJ3piw&VER=8&database=projects%2Falgesnews%2Fdatabases%2F(default)&RID=rpc&SID=QdkaGEUCrwA-Epy8HJZ16g&AID=0&CI=0&TYPE=xmlhttp&zx=2ln2b9adge6x&t=1
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/static/js/main.8c049424.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lcfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

x-debug-tracking-id
866826266607436206;o=0
cache-control
private, max-age=0
content-encoding
gzip
access-control-allow-credentials
true
x-content-type-options
nosniff
access-control-allow-origin
https://korotko-web.pages.dev
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 30 Nov 2024 20:23:31 GMT
x-xss-protection
0
content-type
text/plain; charset=utf-8
vary
Referer, origin
server
ESF
x-frame-options
SAMEORIGIN
channel
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/
13 B
53 B
Fetch
General
Full URL
https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?VER=8&database=projects%2Falgesnews%2Fdatabases%2F(default)&gsessionid=PlC_6Gf0lLRvpPi3b_UBtlw_sulPKb7uAcmE5bJ3piw&SID=QdkaGEUCrwA-Epy8HJZ16g&RID=879&AID=206&zx=y5iob5jp4m5d&t=1
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/static/js/main.8c049424.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lcfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
52ff27e2dc610257452ec297c4059f1aa9003cca02000538725fa11f2503767b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type
application/x-www-form-urlencoded
Referer
https://korotko-web.pages.dev/

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
x-content-type-options
nosniff
access-control-allow-origin
https://korotko-web.pages.dev
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33
date
Sat, 30 Nov 2024 20:23:32 GMT
x-xss-protection
0
content-type
text/plain; charset=utf-8
vary
origin
server
ESF
x-frame-options
SAMEORIGIN
TELEMMGLPICT000387890787_17225362945090_trans_NvBQzQNjv4BqtQDwr_sedNJVv0bm9GPmGFOZgXky5jWZAzYy_iULiGo.jpeg
www.telegraph.co.uk/content/dam/news/2024/08/01/
75 KB
75 KB
Image
General
Full URL
https://www.telegraph.co.uk/content/dam/news/2024/08/01/TELEMMGLPICT000387890787_17225362945090_trans_NvBQzQNjv4BqtQDwr_sedNJVv0bm9GPmGFOZgXky5jWZAzYy_iULiGo.jpeg?impolicy=logo-overlay
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.75.65.39 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-75-65-39.deploy.static.akamaitechnologies.com
Software
Akamai Image Manager /
Resource Hash
940b713d31aff06239d685858aaea8e90b520e6a4cd0b195ae20a9ab2b0a90a1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.telegraph.co.uk;
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

content-security-policy
frame-ancestors 'self' *.telegraph.co.uk;
cache-control
no-transform, max-age=43200
etag
W/"d6a9-61ea35552db0e"
akamai-x-true-cache-ttl
31536000
x-tmg-pref-exists
false
x-geo-header
NL
content-length
76757
date
Sat, 30 Nov 2024 20:23:32 GMT
last-modified
Thu, 01 Aug 2024 18:25:22 GMT
content-type
image/avif
server
Akamai Image Manager
x-frame-options
SAMEORIGIN
81866411-0-image-a-62_1709204975909.jpg
i.dailymail.co.uk/1s/2024/02/29/11/
157 KB
158 KB
Image
General
Full URL
https://i.dailymail.co.uk/1s/2024/02/29/11/81866411-0-image-a-62_1709204975909.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
88.221.168.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-168-178.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
db026a9a3a0b7b4757dedb65ceaf5ebed1eb6c8c765b1fd3eac9f54e5a0a6ced

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

etag
"280cea9631507a0913b8370265e43647"
x-amz-version-id
ehzN97kPqw806JjqDE0wER_mcEEjwDBk
x-mol-img
avif
x-amz-storage-class
INTELLIGENT_TIERING
expires
Mon, 30 Dec 2024 20:23:32 GMT
x-origin
cloudfront
x-amz-cf-id
_PQqEG4VMjD_IQH_2rSOrdUumgAQP_TaeQ92crAdecG_-Xk1tuE4Tw==
date
Sat, 30 Nov 2024 20:23:32 GMT
last-modified
Thu, 29 Feb 2024 11:09:39 GMT
content-type
image/avif
x-amz-replication-status
COMPLETED
edge-cache-tag
/1s/2024/02/29/11/81866411-0-image-a-62_1709204975909.jpg
cache-control
max-age=2592000
timing-allow-origin
*
accept-ranges
bytes
content-length
160816
x-amz-cf-pop
FRA50-C1
server
AmazonS3
x-amz-server-side-encryption
AES256
channel
firestore.googleapis.com/google.firestore.v1.Firestore/Listen/
19 B
0
Fetch
General
Full URL
https://firestore.googleapis.com/google.firestore.v1.Firestore/Listen/channel?gsessionid=PlC_6Gf0lLRvpPi3b_UBtlw_sulPKb7uAcmE5bJ3piw&VER=8&database=projects%2Falgesnews%2Fdatabases%2F(default)&RID=rpc&SID=QdkaGEUCrwA-Epy8HJZ16g&AID=207&CI=0&TYPE=xmlhttp&zx=j9fn641fqh7n&t=1
Requested by
Host: korotko-web.pages.dev
URL: https://korotko-web.pages.dev/static/js/main.8c049424.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.42 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lcfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://korotko-web.pages.dev/

Response headers

cache-control
private, max-age=0
content-encoding
gzip
access-control-allow-credentials
true
x-content-type-options
nosniff
access-control-allow-origin
https://korotko-web.pages.dev
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 30 Nov 2024 20:23:36 GMT
x-xss-protection
0
content-type
text/plain; charset=utf-8
vary
origin
server
ESF
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkkorotko_web

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff