gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net Open in urlscan Pro
20.60.244.173 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Submission: On July 08 via api (July 8th 2024, 7:28:21 pm UTC) from US — Scanned from DE

Summary HTTP 26 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 26 HTTP transactions. The main IP is 20.60.244.173, located in Des Moines, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on March 27th 2024. Valid for: a year.

This is the only time gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	20.60.244.173 20.60.244.173	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.65.229 151.101.65.229	54113 (FASTLY) (FASTLY)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.23.104 172.217.23.104	15169 (GOOGLE) (GOOGLE)
13	91.108.98.237 91.108.98.237	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1 2	184.30.20.112 184.30.20.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	216.239.32.36 216.239.32.36	15169 (GOOGLE) (GOOGLE)
26	9

2 20.60.244.173 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.229 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.104 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 91.108.98.237 (Meppel, Netherlands)

ASN47583 (AS-HOSTINGER, CY)

nerdinthebrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.20.112 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-112.deploy.static.akamaitechnologies.com

support.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.32.36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	nerdinthebrain.com nerdinthebrain.com	314 KB
2	microsoft.com 1 redirects support.microsoft.com — Cisco Umbrella Rank: 12495	344 B
2	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4404 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1780	24 KB
2	windows.net gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net	215 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2949
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 110	102 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 331	27 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 423	33 KB
26	8

	Domain	Requested by
13	nerdinthebrain.com	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
2	support.microsoft.com	1 redirects gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
2	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
1	region1.google-analytics.com	www.googletagmanager.com
1	www.googletagmanager.com	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
1	maxcdn.bootstrapcdn.com	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
1	stackpath.bootstrapcdn.com	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
1	cdnjs.cloudflare.com	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
1	cdn.jsdelivr.net	gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
26	9

This site contains no links.

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 04	`2024-03-27` - `2025-03-22`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-05-25` - `2024-08-23`	3 months	crt.sh
*.google-analytics.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
nerdinthebrain.com R3	`2024-05-28` - `2024-08-26`	3 months	crt.sh
support.microsoft.com Microsoft Azure ECC TLS Issuing CA 04	`2024-05-01` - `2025-04-26`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Frame ID: EE803C8F6D1C28A7417F3DA65B4166B0
Requests: 25 HTTP requests in this frame

Frame: https://support.microsoft.com/de-DE
Frame ID: D10E8736EBB39D9AAD3DC04672F606B9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft Support Final Warning

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

26
Requests

85 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

9
IPs

4
Countries

714 kB
Transfer

1215 kB
Size

21
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://support.microsoft.com/ HTTP 301
https://support.microsoft.com/de-DE

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/ 214 KB
214 KB 547ms
133ms Document
text/html 20.60.244.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.60.244.173 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 5275e7193d6446d7e74b1bc5f545d92e062b18e7edca1cb2207591b506a15440

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Content-Length: 219153
Content-MD5: MT1cGyqLgfXptFFqxqs5sg==
Content-Type: text/html
Date: Mon, 08 Jul 2024 19:28:15 GMT
ETag: "0x8DC9F736FB1C9B1"
Last-Modified: Mon, 08 Jul 2024 17:28:52 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 19aec785-901e-0001-2f6c-d1aa82000000
x-ms-version: 2018-03-28

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/ 216 KB
33 KB 335ms
8ms Stylesheet
text/css 151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Origin: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 08 Jul 2024 19:28:16 GMT
x-content-type-options: nosniff
content-encoding: br
age: 2306460
x-jsd-version: 5.3.0-alpha1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 33467
x-served-by: cache-fra-eddf8230031-FRA
x-jsd-version-type: version
etag: W/"35e6c-cZlWqlLbTIr9xcDPs8verWJYuKY"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ 82 KB
27 KB 57ms
28ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1561850
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 26660
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-14983"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EetvRu8lpHm7%2BGQwKLcnT0NE2Ua6KwvNiMmitQFAnyK47WErezvZD%2FGZcpZZdY94KH95cXTi27WvLpA5DnrfA3ybSZ8CIBCH5MRZhLKZExqNpBMJiVNmtxcvi8K60dCkteJRcq09"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a0279f28bc94d79-FRA
expires: Sat, 28 Jun 2025 19:28:15 GMT

GET
H3 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 59 KB
17 KB 69ms
39ms Script
application/javascript 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Origin: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1053
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2227
cdn-cachedat: 03/25/2024 22:48:44
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:11 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"02d223393e00c273efdcb1ade8f4f8b1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 135c33a1cc0af4c278049c7d07716c27
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8a0279f28dd09a2a-FRA
cdn-requestpullsuccess: True

GET
H3 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ 27 KB
7 KB 52ms
22ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1075
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1714469
cdn-cachedat: 03/18/2024 12:51:16
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"4fbd15cb6047af93373f4f895639c8bf"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: efea42d10a667386e92ecd00121703e9
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8a0279f2886f4d9c-FRA
cdn-requestpullsuccess: True

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 307 KB
102 KB 482ms
69ms Script
application/javascript 172.217.23.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

cdbcf0288c30a9c5595356e841e7417939c6f2f6643444c96621e41ca333060b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 104169
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 08 Jul 2024 19:28:16 GMT

GET
H2 200 minimize.jpeg
nerdinthebrain.com/poor/castrol/ 1 KB
1 KB 408ms
18ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/minimize.jpeg
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 1bf2d147ce393f4dd577d7ce2f03ab5cc1005b84870b567002646977bbcdbb32

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: fd2bdef94f039820557c6956197a0cac-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1178

GET kxFy-clip.png
nerdinthebrain.com/poor/castrol/ 0
0

GET qsbs-firewall.png
nerdinthebrain.com/poor/castrol/ 0
0

GET s-S4-acc.png
nerdinthebrain.com/poor/castrol/ 0
0

GET Z5BR-network.png
nerdinthebrain.com/poor/castrol/ 0
0

GET
H2 200 uZbx-si.png
nerdinthebrain.com/poor/castrol/ 3 KB
3 KB 62ms
30ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/uZbx-si.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 2857f63364af66a66a12d15d4bf9f536769f489e9080d7a0514b313a771fb161

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 138e006f87d28be667f0e8676c9fac37-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2680

GET
H2 200 okPE-vs.png
nerdinthebrain.com/poor/castrol/ 620 B
858 B 33ms
31ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/okPE-vs.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 87e1e97f8193d0c91c59f17dd99254819b70b31f606f7708553a2bb5c39c56e6

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 37ce1697373a0f411f0d966b60ffeb7c-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 620

GET
H2 200 -EBq-current.png
nerdinthebrain.com/poor/castrol/ 620 B
858 B 27ms
26ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/-EBq-current.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 64717fb39bb1e506645bf1dcfaed16410737e89c5b8b102a6436bea0c2b18722

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 2f5275b92e24f716fa32074a8ee99ef5-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 620

GET
H2 200 nOxp-sett.png
nerdinthebrain.com/poor/castrol/ 694 B
932 B 28ms
26ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/nOxp-sett.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 38966ad4737cccc1ba6d65402250dcc6a0ac3a742dafff6ba5d13455265f0c38

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 7e36ad002c5d40a380f6503fd95607a6-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 694

GET
H2 200 def.png
nerdinthebrain.com/poor/castrol/ 2 KB
2 KB 28ms
27ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/def.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: f674866044b3bb79ef21edd3ecd89bb0eb849ee2f1439d0ce7e6fc3d5cd9d626

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 15f8a84d12d06976f52a73a50a6d3c43-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1622

GET
H2 200 cross.png
nerdinthebrain.com/poor/castrol/ 88 KB
88 KB 30ms
28ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/cross.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: ebf0674ce9dbac3587282b46bbfd7ce4340273ef6f02f5240ed2d1087a9700b2

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6554
x-hcdn-request-id: df15feb0bf5a4fd89d0d521caecf4cb3-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 89718

GET
H2 200 virus-images.jpeg
nerdinthebrain.com/poor/castrol/ 2 KB
2 KB 30ms
29ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/virus-images.jpeg
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 2487850348dd29c6f7e190529a27dc1ea67a0085eac7a26f6837fe0012ce052e

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 1ff637a0d90befcd13687a6782ec1ee8-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2106

GET
H2 200 t.png
nerdinthebrain.com/poor/castrol/ 542 B
781 B 30ms
29ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/t.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 9d5c5fd7edfe78091f468edaeee3fc8e0ac021e6099c96e7a833b4fee1502433

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 64aa3e8ddf24ae787f54b8f2bcbf25f3-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 542

GET
H2 200 stop.png
nerdinthebrain.com/poor/castrol/ 9 KB
9 KB 30ms
29ms Image
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nerdinthebrain.com/poor/castrol/stop.png
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 8f2acb7a211912e9312a0653a37f40de2ba9d817baf4d0e051b872c8a1e41abc

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: a9ebd1c0948b5f4a50e0775db9b05a45-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 8716

GET
H2

200

de-DE
support.microsoft.com/ Frame D10E
Redirect Chain

https://support.microsoft.com/
https://support.microsoft.com/de-DE

0
0

48ms
46ms

Document
text/html

184.30.20.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://support.microsoft.com/de-DE

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.112 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-20-112.deploy.static.akamaitechnologies.com

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 25967
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
date: Mon, 08 Jul 2024 19:28:16 GMT
expires: Mon, 08 Jul 2024 19:28:16 GMT
pragma: no-cache
request-context: appId=
server: Kestrel
strict-transport-security: max-age=86400 ; includeSubDomains
vary: Accept-Encoding
x-correlationid: 0HN4RNRK36F82:000000EE
x-operationid: 108f5f1c875541cc54407b6bd8976db2

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: max-age=0, no-cache, no-store
content-length: 0
critical-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
date: Mon, 08 Jul 2024 19:28:16 GMT
expires: Mon, 08 Jul 2024 19:28:16 GMT
location: https://support.microsoft.com/de-DE
pragma: no-cache
request-context: appId=
server: Kestrel
strict-transport-security: max-age=86400 ; includeSubDomains
x-correlationid: 0HN4RNRK36F82:000000ED
x-operationid: d58165d6d4edbf4ad6e96f1bd5d079a6

GET
H2 206 _Fm7-alert.mp3
nerdinthebrain.com/poor/castrol/ 196 KB
197 KB 40ms
38ms Media
audio/mpeg 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/poor/castrol/_Fm7-alert.mp3

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: HIT
last-modified: Sat, 06 Jul 2024 18:16:46 GMT
server: hcdn
age: 6555
etag: "31080-66898a0e-86eaca80ffb4b289;;;"
x-hcdn-request-id: d9a41a45010e3cb47820c586643192ff-srv-edge5
content-type: audio/mpeg
Content-Range: bytes 0-200831/200832
x-turbo-charged-by: LiteSpeed
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 200832

GET
H3 206 beeps.mp3
nerdinthebrain.com/poor/castrol/ 8 KB
9 KB 544ms
515ms Media
audio/mpeg 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://nerdinthebrain.com/poor/castrol/beeps.mp3

Requested by

Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

hcdn /

Resource Hash

0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
content-security-policy: upgrade-insecure-requests
x-hcdn-cache-status: MISS
last-modified: Sat, 06 Jul 2024 18:16:46 GMT
server: hcdn
etag: "20d5-66898a0e-9d0cb2a606c59cb4;;;"
x-hcdn-request-id: a4bed7e80b0cfc330e3b0ed4f425842f-srv-edge4
content-type: audio/mpeg
Content-Range: bytes 0-8404/8405
x-turbo-charged-by: LiteSpeed
x-hcdn-upstream-rt: 0.443
platform: hostinger
alt-svc: h3=":443"; ma=86400
Content-Length: 8405

GET
H/1.1 404
The requested content does not exist. stars2.html
gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/images/ 321 B
321 B 134ms
131ms Image
text/html 20.60.244.173
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/images/stars2.html
Requested by: Host: gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.60.244.173 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 6ae3e15a8d9c200a33380657954eaa51c75ba2216d227869b60928e305397670

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-request-id: 19aec877-901e-0001-1a6c-d1aa82000000
Date: Mon, 08 Jul 2024 19:28:15 GMT
x-ms-version: 2018-03-28
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound
Content-Length: 321
Content-Type: text/html

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 365ms
27ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-F9ZFHN0DV3&gtm=45je4730v9182508741za200&_p=1720466896087&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=422291926.1720466897&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1720466896&sct=1&seg=0&dl=https%3A%2F%2Fgvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net%2F&dt=Microsoft%20Support%20Final%20Warning&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1584&_z=fetch
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-F9ZFHN0DV3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 08 Jul 2024 19:28:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t.png
nerdinthebrain.com/poor/castrol/ 542 B
0 37ms
37ms Other
image/webp 91.108.98.237
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL: https://nerdinthebrain.com/poor/castrol/t.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.108.98.237 Meppel, Netherlands, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software: hcdn /
Resource Hash: 9d5c5fd7edfe78091f468edaeee3fc8e0ac021e6099c96e7a833b4fee1502433

Request headers

Referer: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 19:28:16 GMT
x-hcdn-cache-status: HIT
server: hcdn
age: 6555
x-hcdn-request-id: 64aa3e8ddf24ae787f54b8f2bcbf25f3-srv-edge5
content-type: image/webp
cache-control: public, max-age=604800
x-hcdn-image-optimizer: f:webp q:85 w:1600
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 542

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/poor/castrol/kxFy-clip.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/poor/castrol/qsbs-firewall.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/poor/castrol/s-S4-acc.png

Domain: nerdinthebrain.com
URL: https://nerdinthebrain.com/poor/castrol/Z5BR-network.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
support.microsoft.com/signin-oidc	1970-01-20 21:54:27	Name: .AspNetCore.OpenIdConnect.Nonce.CfDJ8CiTzr73KWNFsUGcHEnPeJr-oFKC3N_iwZquDg5ayIxMaq8sEXS31oH8xFcyQP0JIQ3q-PjFCbIF4M9udXtQXKgVfbyUCGmGgY7CLJjWAbe9-HSBU_x-iad7m33Ml2TVGWWGInRm4lWHeNMGwb7uH5lx-Fsg7k1hHHbjNJNvIE-1RUnCO0UEi8wyHM2d63AqkqjuhiHFYRdAToGCOmmcvMRIurXy8zETM88wCalpBgieqCWQ_-nFFP8rjPQG3S4B-sMCKFAHKwrkzlmliNCWPi0 Value: N
support.microsoft.com/	1970-01-21 06:40:02	Name: EXPID Value: 30bdfb35-a1c6-4fa1-85fc-aceeccf30ce4
.windows.net/	1970-01-21 07:30:26	Name: _ga_F9ZFHN0DV3 Value: GS1.1.1720466896.1.0.1720466896.0.0.0
.windows.net/	1970-01-21 07:30:26	Name: _ga Value: GA1.1.422291926.1720466897
support.microsoft.com/	1970-01-21 06:40:02	Name: MicrosoftApplicationsTelemetryDeviceId Value: 05a8a971-0149-4df6-9250-d949dcd88c3e
support.microsoft.com/	1970-01-20 21:54:28	Name: ai_session Value: IswpSEs8gIpSfqgRWIZe7j\|1720466897935\|1720466897935
login.microsoftonline.com/	1970-01-20 22:37:38	Name: buid Value: 0.AU8AMe_N-B6jSkuT5F9XHpElWhkrJ-4RRD9DjyhcE8tv1AcBAAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMYCrE10NmUqHgRxWpfVoAYWtfqEmqOPUDQgm5yPrVGdX_SBGfXm5Jump5F2ynZ40aGBh82kM84zWOjZXc1DKCHRu6Z2zvnlfFbCzm_lwv_B-kgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMYhuOlFbKgqRopBHIVT4cmeb_bUEWCN7SKF4OsJF9_C6jNG0NjR1w-nQ1oJtQqaFo4MyUoV70dYKFujtDTTxlP3mmmXYldGaZi2ZsVK9L_kHLjOLCLUVRNuyNI6KxOmtz6VfXfbwgPgeESwBedmDhHlHnZF6Takr1T5WTjZV_9IXsgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-6lAq8OahpQ Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMYRuaGC9lzSu8rV8LKg5604Q1iIdO1A2gETVmgUGhvF3SFW9st5MM5Ff5FXRrNQBQlNR3BXwFAvXtmJr-LP20ZpsXu2cKcEpRXeYEvRPNjQ_BfFa_-c4VgPvILGlO82JraSZDpiTMNQLaUVIlGp8sQQSAA
login.microsoftonline.com/	1970-01-20 22:37:38	Name: fpc Value: Alt3soVSVqVPk6Ej5_4zDW5qwEtIAQAAANE0Ht4OAAAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
www.microsoft.com/	1970-01-21 00:04:02	Name: akacd_OneRF Value: 1728242898~rv=31~id=2677a6a573c77036059def9d73709331
.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: a22d42895b25429e8efe0b4de2cbd55e
.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=12&lt=1720466898&co=0
.login.live.com/	1969-12-31 23:59:59	Name: OParams Value: 11O.DoAieAeVB4eSxVMw7APKNds8KMIJfiL8PNYyZJXCZKmZDORcmMk28tG!nJ0hgytrlSMKgffXECuiReEdnVac71mloQUk2AXBgORIQNtlDX91XvlPIRgsFlCRd1iWiOgF6I8CjjQG3d4aLH07KoyE3gPf473rFY0EGwhM60oJGFpcsYPSqJjTXWh8x0SA!LQ4nLqFRe7U7g3uxviRADz2auhvZj2aNFV!h7kjfOgPZUmaqyrdaA4wvfB0YqRli!QhvXJXdewmUsJidTx9KRw$
www.microsoft.com/	1970-01-21 06:40:02	Name: MicrosoftApplicationsTelemetryDeviceId Value: 2a6412ab-d039-4e8a-b53f-f4ad03961aae
.microsoft.com/	1970-01-21 06:40:02	Name: MC1 Value: GUID=08e5b4a2c10945c483d0107bcb94c4da&HASH=08e5&LV=202407&V=4&LU=1720466899189
.microsoft.com/	1970-01-20 21:54:28	Name: MS0 Value: 8068b98f1ac3466db6816ce3625d216b
www.microsoft.com/	1970-01-20 21:54:28	Name: ai_session Value: ZKwdbygfIqMPXBhLENnrG/\|1720466900053\|1720466900053
support.microsoft.com/	1970-01-21 06:40:02	Name: MSFPC Value: GUID=08e5b4a2c10945c483d0107bcb94c4da&HASH=08e5&LV=202407&V=4&LU=1720466899189

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net/images/stars2.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
security	error	Message: Refused to frame 'https://support.microsoft.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".
security	error	Message: Refused to frame 'https://mem.gfx.ms/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://support.microsoft.com".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net
maxcdn.bootstrapcdn.com
nerdinthebrain.com
region1.google-analytics.com
stackpath.bootstrapcdn.com
support.microsoft.com
www.googletagmanager.com
nerdinthebrain.com
104.17.25.14
104.18.11.207
151.101.65.229
172.217.23.104
184.30.20.112
20.60.244.173
216.239.32.36
91.108.98.237
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
1bf2d147ce393f4dd577d7ce2f03ab5cc1005b84870b567002646977bbcdbb32
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
2487850348dd29c6f7e190529a27dc1ea67a0085eac7a26f6837fe0012ce052e
2857f63364af66a66a12d15d4bf9f536769f489e9080d7a0514b313a771fb161
38966ad4737cccc1ba6d65402250dcc6a0ac3a742dafff6ba5d13455265f0c38
5275e7193d6446d7e74b1bc5f545d92e062b18e7edca1cb2207591b506a15440
64717fb39bb1e506645bf1dcfaed16410737e89c5b8b102a6436bea0c2b18722
6ae3e15a8d9c200a33380657954eaa51c75ba2216d227869b60928e305397670
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
87e1e97f8193d0c91c59f17dd99254819b70b31f606f7708553a2bb5c39c56e6
8f2acb7a211912e9312a0653a37f40de2ba9d817baf4d0e051b872c8a1e41abc
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
9d5c5fd7edfe78091f468edaeee3fc8e0ac021e6099c96e7a833b4fee1502433
cdbcf0288c30a9c5595356e841e7417939c6f2f6643444c96621e41ca333060b
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
ebf0674ce9dbac3587282b46bbfd7ce4340273ef6f02f5240ed2d1087a9700b2
f674866044b3bb79ef21edd3ecd89bb0eb849ee2f1439d0ce7e6fc3d5cd9d626
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net Open in urlscan Pro 20.60.244.173 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

26 Requests

85 %HTTPS

0 %IPv6

8 Domains

9 Subdomains

9 IPs

4 Countries

714 kBTransfer

1215 kBSize

21 Cookies

0 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

31 JavaScript Global Variables

21 Cookies

3 Console Messages

Indicators

gvuxm9sj483zn20ak6rd71o.z19.web.core.windows.net Open in urlscan Pro
20.60.244.173 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

85 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

9
IPs

4
Countries

714 kB
Transfer

1215 kB
Size

21
Cookies

26 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!