throbbing-glitter-4d6f.salmonpink.workers.dev Open in urlscan Pro
2606:4700:3035::6815:1ac5  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://ashelford.net/ Page URL
2. https://wendallandinc.com/amm/live/facturation Page URL
3. https://throbbing-glitter-4d6f.salmonpink.workers.dev/?bbre=66ef7efbc8df8 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response ashelford.net/	14 KB 15 KB	137ms 69ms	Document text/html	199.204.248.133 WEBINT
General Check archive.org Show headers Download Go to Full URL https://ashelford.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.204.248.133 , United States, ASN11989 (WEBINT, US), Reverse DNS cp22.machighway.com Software Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 / Resource Hash fbf9d97e2b87a2989339aa754fb338992ffc7523484387312dc022b380320e74 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sun, 22 Sep 2024 02:20:43 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 Transfer-Encoding chunked
GET H3	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	38ms 16ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ashelford.net/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "603e8adc-15d9d" age 208693 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FY24FLo8GVjiDdYCPC6iYFEFMev41XvoTu%2Fl1XCoU4IR0jfjEYuMC1J5Az7ywTzldI1aI5g%2BczL%2FOlY9j8%2FWC0ou8BPwmzt5VA1bGTRMiWacaz%2FSVBPZ0hpWtUObYxkrAiXw6oFs6cPK1O9XUWRt%2Fv9I"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 12 Sep 2025 02:21:35 GMT date Sun, 22 Sep 2024 02:21:35 GMT content-type application/javascript; charset=utf-8 last-modified Tue, 02 Mar 2021 18:58:36 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8c6ed288ae4d43c8-EWR accept-ranges bytes access-control-allow-origin * content-length 27938 server cloudflare
GET H2	200	css2 fonts.googleapis.com/	21 KB 1 KB	47ms 24ms	Stylesheet text/css	2607:f8b0:4006:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ashelford.net/ Response headers content-encoding gzip x-content-type-options nosniff expires Sun, 22 Sep 2024 02:21:35 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 22 Sep 2024 02:21:35 GMT content-type text/css; charset=utf-8 last-modified Sun, 22 Sep 2024 01:32:09 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/shared/1.0/content/images/	17 KB 17 KB	32ms 9ms	Image image/x-icon	2606:2800:11f:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nyd/D13A) / Resource Hash 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://ashelford.net/ Response headers content-md5 EuPayFgGHQiAI7K9SOL6lg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked x-ms-version 2009-09-19 etag 0x8D8731240E548EB age 15618692 x-cache HIT date Sun, 22 Sep 2024 02:21:35 GMT content-type image/x-icon last-modified Sun, 18 Oct 2020 03:02:30 GMT cache-control public, max-age=31536000 x-ms-request-id a3f02d27-f01e-0034-1e89-7ed73f000000 accept-ranges bytes access-control-allow-origin * content-length 17174 x-ms-blob-type BlockBlob server ECAcc (nyd/D13A)
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H/1.1	200 OK	facturation Show response wendallandinc.com/amm/live/	575 B 855 B	491ms 308ms	Document text/html	199.204.248.133 WEBINT
General Check archive.org Show headers Download Go to Full URL https://wendallandinc.com/amm/live/facturation Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.204.248.133 , United States, ASN11989 (WEBINT, US), Reverse DNS cp22.machighway.com Software Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 / PHP/5.5.38 Resource Hash 3c37c0a1aaa98b7ec359d672919516637710b7c64a6ef36d0edd3e43c9cbb572 Request headers Referer https://ashelford.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html Date Sun, 22 Sep 2024 02:20:43 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 Transfer-Encoding chunked X-Powered-By PHP/5.5.38
GET DATA	200 OK	truncated /	187 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H/1.1	200 OK	ttxz.css wendallandinc.com/amm/live/imgsapp/	575 B 854 B	107ms 105ms	Stylesheet text/html	199.204.248.133 WEBINT
General Check archive.org Show headers Download Go to Full URL https://wendallandinc.com/amm/live/imgsapp/ttxz.css Requested by Host: wendallandinc.com URL: https://wendallandinc.com/amm/live/facturation Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.204.248.133 , United States, ASN11989 (WEBINT, US), Reverse DNS cp22.machighway.com Software Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 / PHP/5.5.38 Resource Hash 1314ab5ffb8cb8b1608dc8b348192ce5f1db17ba3560f8a5cadb8551d990cc56 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://wendallandinc.com/amm/live/facturation Response headers Transfer-Encoding chunked Keep-Alive timeout=5, max=99 Date Sun, 22 Sep 2024 02:20:43 GMT Content-Type text/html X-Powered-By PHP/5.5.38 Server Apache/2.4.51 (cPanel) OpenSSL/1.1.1l mod_bwlimited/1.4 Connection Keep-Alive
GET H3	200	Primary Request / Show response throbbing-glitter-4d6f.salmonpink.workers.dev/	6 KB 3 KB	56ms 29ms	Document text/html	2606:4700:3035::6815:1ac5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://throbbing-glitter-4d6f.salmonpink.workers.dev/?bbre=66ef7efbc8df8 Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1ac5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f5063fc0a0985e9f6c78dc93e9bec4410c9b691812450eec0ecbfdb43d3e0ff9 Request headers Referer https://wendallandinc.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cf-ray 8c6ed28cf9acc347-EWR content-encoding br content-type text/html;charset=UTF-8 date Sun, 22 Sep 2024 02:21:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ios0438CU2XI5tpSXTx2vHmpmG73hlzc8tUHq8WMFSsrqpfBDrZ6GBfTJzfcjEFR1WTi3S1C3iyypqw6vRujf35zgPs6B80xugiDkmRMIxlFQIFnJWxgmVTHwS4emABUyv4NYxxwpTeCRyr%2FRXA4pnGn8QDINCCQgFq4Bh8PSVjiIYTbKdzSRWxEcgU%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding
GET H3	200	speculation throbbing-glitter-4d6f.salmonpink.workers.dev/cdn-cgi/	128 B 609 B	14ms 14ms	Other application/speculationrules+json	2606:4700:3035::6815:1ac5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://throbbing-glitter-4d6f.salmonpink.workers.dev/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:1ac5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://throbbing-glitter-4d6f.salmonpink.workers.dev Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/?bbre=66ef7efbc8df8 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klQ6SmGOUxt8O2Xjtcn%2FxWJ7LNMiVRSkwJOXaEh%2FeQ%2FIyHaPlLpa3lUxa11u8bjktBD1KpinwZUbMrQuI6D2mgE5jIT6pG4HHs5gsfzNkcDQO2c9QfNRXrn6ecas6X1EA7cZp4CDD22kqB8WGVw8%2BI8o3LmAPi80MMfo0PTQqa%2F4NqqdmTLWv0MXZTE%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c6ed28d39dac347-EWR access-control-allow-origin https://throbbing-glitter-4d6f.salmonpink.workers.dev content-length 128 date Sun, 22 Sep 2024 02:21:36 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H3	200	66c4d7ef38047717ed31f22b-66c4d7e438047717ed31f22a.js Show response wispy-dawn-ea24.porschea50.workers.dev/	8 KB 4 KB	149ms 90ms	Script text/plain	2606:4700:3037::6815:3dc5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wispy-dawn-ea24.porschea50.workers.dev/66c4d7ef38047717ed31f22b-66c4d7e438047717ed31f22a.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::6815:3dc5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17c0dddddad05ddac18d1f40bd8a71b18ac6189860a7b556454f90fb99da71b8 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yt%2FzQmEh1r3UE7XIRQQ5dXqi4aCpIx%2F%2BsojEHji5%2FBT9ISXjiUOtZDd5L48%2FZOpE2UcdDabQ8xX2qEON3LIGB4l2cYDjKfeZrO82pipuLBlWApm0Fat%2Fq2c3%2BzGVM9%2BSMbSx1sKXkMNMMbLuH5WFUaWOtI35PdbtUTAZvzj78pLwmuoIHQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8c6ed28dd8bf4259-EWR date Sun, 22 Sep 2024 02:21:36 GMT content-type text/plain;charset=UTF-8 vary Accept-Encoding server cloudflare
GET H2	200	d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/	482 KB 80 KB	47ms 4ms	Stylesheet text/css	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 91d54cc09c1f690008bf45034d657d79d92cebda329c2c6584c51f3f25586422 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "4c3697048c724298284c7a8e89f9e111e36c789eb0ab34bdbc14da684a41cfe7-br" x-timer S1726971696.444312,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 81839 date Sun, 22 Sep 2024 02:21:36 GMT content-type text/css; charset=utf-8 last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21924-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H2	200	3fade337dd8b492a6cc8c2d6d53764ddnbr1724176366.css nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/	95 KB 13 KB	4ms 3ms	Stylesheet text/css	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/3fade337dd8b492a6cc8c2d6d53764ddnbr1724176366.css Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 7a03bd19e5612112d56f2bc0b4a4c00560270c8733bb357e588ee9e182ef1392 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "bb209b55ee001ad890a8877ea126a0d7abfc7ad8f4ec83483e2e0e53692db41b-br" x-timer S1726971696.471157,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 12858 date Sun, 22 Sep 2024 02:21:36 GMT content-type text/css; charset=utf-8 last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21924-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H2	200	axios.min.js Show response unpkg.com/axios@0.16.1/dist/	34 KB 14 KB	41ms 20ms	Script application/javascript	2606:4700::6811:f8cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/axios@0.16.1/dist/axios.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6b2114a050aed49f4a24237d4d1f437b75ca10c6fc8623eae23c0558c53a7e21 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding br cf-cache-status HIT etag "879a-StlLhYX39Pj2Qvz0O98NQPjvG9U" age 164208 x-content-type-options nosniff date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Sat, 08 Apr 2017 18:51:20 GMT fly-request-id 01J86VYDDTDAPX234ABGK1ME9D-lga vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 via 1.1 fly.io cf-ray 8c6ed28f2af80f88-EWR access-control-allow-origin * server cloudflare
GET H3	200	d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.js Show response nirikdakawao.web.app/avfdfafczxcfafxzas/themes/	74 KB 19 KB	4ms 3ms	Script text/javascript	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 74116901ac0ec12dd7af88a1e9ac55a5531f2dac5da8053cfa70042d738587e3 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "18436deb674b50728be198a9912eab2947b4e3b5a74daafe8daf6805d969d6cf-br" x-timer S1726971697.535253,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 18676 date Sun, 22 Sep 2024 02:21:36 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H2	200	vue.min.js Show response unpkg.com/vue@2.6.11/dist/	91 KB 47 KB	15ms 15ms	Script application/javascript	2606:4700::6811:f8cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/vue@2.6.11/dist/vue.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e0156dd49c03744e79bbea60eebbbb94b5811c1b71b91f5fb38a8270dedfbaf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding gzip cf-cache-status HIT etag "16de6-q9I58ClmstMksFEsIDvbr4Kk7Xo" age 16614010 x-content-type-options nosniff date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Sat, 26 Oct 1985 08:15:00 GMT fly-request-id 01HRWM66PNZVKDQ1GHMC8P51CP-lga vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 via 1.1 fly.io cf-ray 8c6ed28f6b380f88-EWR access-control-allow-origin * server cloudflare
GET H2	200	vue-router.min.js Show response unpkg.com/vue-router@2.7.0/dist/	23 KB 11 KB	18ms 17ms	Script application/javascript	2606:4700::6811:f8cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/vue-router@2.7.0/dist/vue-router.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5a01a4f435ae1e511d874f1abc960898902b1d6d4731c3cf0f3383b1ec3ffd1d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding gzip cf-cache-status HIT etag "5c5a-b2+xvLVNqK43WHk3Czwf1BAXaoI" age 16627357 x-content-type-options nosniff date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Thu, 29 Jun 2017 03:57:37 GMT fly-request-id 01HRW7EYZ1XWNKJX3Z1N21TFMS-lga vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 via 1.1 fly.io cf-ray 8c6ed28f9b5f0f88-EWR access-control-allow-origin * server cloudflare
GET H3	200	vuex.min.js Show response cdnjs.cloudflare.com/ajax/libs/vuex/2.3.1/	10 KB 4 KB	20ms 15ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/vuex/2.3.1/vuex.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5f1597d8c4ad4932102d5f5fbb0c35b827d7ccfc58a30ff6cdfe9dd0c3e5efa7 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb0402f-290d" age 134605 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BpqBeZl34uqCJGlhqgZQ2NE0vBSI4V7lvxh9%2B1HYMS%2FBGRTr7sg4ZdqcLf4L%2B5q6xpIjOFyYoagZbY5ZsUG%2FmMexESgZYCRR5FKnfEOTeOlsZcmwFvPdRt5ToE9Ed%2Bp9aGRVkW8KhCOBENE6pzmRiiLu"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 12 Sep 2025 02:21:36 GMT date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:17:51 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8c6ed28fbdf041e9-EWR accept-ranges bytes access-control-allow-origin * content-length 3106 server cloudflare
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	34ms 4ms	Script text/javascript	2607:f8b0:4006:816::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:816::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding gzip age 122887 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Sat, 20 Sep 2025 16:13:29 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 20 Sep 2024 16:13:29 GMT last-modified Tue, 03 Mar 2020 19:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30306 x-xss-protection 0 server sffe
GET H3	200	vee-validate.min.js Show response cdnjs.cloudflare.com/ajax/libs/vee-validate/2.0.0-rc.3/	42 KB 11 KB	17ms 17ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/vee-validate/2.0.0-rc.3/vee-validate.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7649e92aa760b806193241148e8b88f3bc12c4e6cffbc35622a99477db798242 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb04018-a668" age 162652 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=28xxkNHGa0llE6gbPm824EDCMkuMAJntEdnpG%2Br%2Bp26CSGTU4b%2B5M%2FQtDl5Xet4nheTe88C1hHrJktyUN%2Byt6ckRkQdIROvi4xG5wzxKj1KIMArGVmEphvZd3U5Rxfxd17qM9LA0U%2B%2FrZbXSY0BTusub"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 12 Sep 2025 02:21:36 GMT date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:17:28 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8c6ed2902e9441e9-EWR accept-ranges bytes access-control-allow-origin * content-length 10691 server cloudflare
GET H3	200	vue-i18n.min.js Show response cdnjs.cloudflare.com/ajax/libs/vue-i18n/7.0.3/	14 KB 4 KB	16ms 15ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/vue-i18n/7.0.3/vue-i18n.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 20527289ca6a43abafb1fa42079d6c68425c583d5f93960eae5b5737bf28493b Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb0402b-379c" age 272652 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dprSSWCAlMrw3tD81qfFV3c5qtSquFQ9DsOG2w8UMvBBxXlnlrx4xHQwWZW%2F%2BXOuNB5%2FCFkDCKA2phQ2C3GZFFQOkvpXRHLOCWH8VgbmU%2BGqxyLAV6Ttnag4UbefY1k8aP92hOKqxiRIHAZRGieoabkx"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 12 Sep 2025 02:21:36 GMT date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:17:47 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8c6ed2904ed341e9-EWR accept-ranges bytes access-control-allow-origin * content-length 3901 server cloudflare
GET H2	200	lodash.min.js Show response unpkg.com/lodash@4.17.4/	71 KB 33 KB	17ms 17ms	Script application/javascript	2606:4700::6811:f8cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/lodash@4.17.4/lodash.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f8cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding gzip cf-cache-status HIT etag "11c44-YN5uQ8SiwzJidasS1P/ZCyWCruk" age 16623136 x-content-type-options nosniff date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Sat, 31 Dec 2016 22:32:41 GMT fly-request-id 01HRWBFRZ9H9J29H8Z4B6GYBM3-lga vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 via 1.1 fly.io cf-ray 8c6ed2906c030f88-EWR access-control-allow-origin * server cloudflare
GET H3	200	mobile-detect.min.js Show response cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.3.6/	37 KB 14 KB	17ms 16ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/mobile-detect/1.3.6/mobile-detect.min.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fc8b081ba3d5a5270fb663b4856ce474277a52421f98a3b8aa385100c342a3d8 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb03f25-9341" age 166658 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pcs6hrcani1J0C8kk0owyWfquKm22iEg2GYHdYoOHGdG%2Bjcd1Ql%2BmpACJusr6fO6Q77b7%2Fj5%2F3WDT6IXVyX9SlgvupMsM9sz6ESdLhj%2FbbBOAm%2Bq%2Bk4rAgJhibazx6sehr1%2BR%2BA8Zl9Fbu8OVNDS4qdO"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Fri, 12 Sep 2025 02:21:36 GMT date Sun, 22 Sep 2024 02:21:36 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:13:25 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8c6ed2909f2a41e9-EWR accept-ranges bytes access-control-allow-origin * content-length 13328 server cloudflare
GET H3	200	8954e64e0df2146adf513af7483f4711.js Show response nirikdakawao.web.app/avfdfafczxcfafxzas/themes/	420 KB 157 KB	4ms 3ms	Script text/javascript	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/8954e64e0df2146adf513af7483f4711.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d766be134f46dc0fef205487fe16cf50ab57553698646a76d6a53d2c3ef5beaa Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "e6f43790a5acc588d1029635fd3c06ed4d6c46bc0a39f9cfc14045ea391106fc-br" x-timer S1726971697.758294,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 160871 date Sun, 22 Sep 2024 02:21:36 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	a3107e4d4ae0ea783cd1177c52f1e6301724176358.js Show response nirikdakawao.web.app/avfdfafczxcfafxzas/themes/js/	9 KB 4 KB	5ms 4ms	Script text/javascript	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/js/a3107e4d4ae0ea783cd1177c52f1e6301724176358.js Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 89fe0726eb66a18421f9441a304d3066f07d74d69ebfd54743e93066e41cf366 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "76a47ab14442c77401e93796812a3dfa60fe2e5477426e7218a11b4b5eeb0174-br" x-timer S1726971697.908214,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 4087 date Sun, 22 Sep 2024 02:21:36 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	backdrop.jpeg nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/	16 KB 15 KB	4ms 3ms	Image image/jpeg	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/backdrop.jpeg Requested by Host: throbbing-glitter-4d6f.salmonpink.workers.dev URL: https://throbbing-glitter-4d6f.salmonpink.workers.dev/9kGou7MjYWLklvYeHEiUY5aU23vVuxpXdqlhyDT-!@&RWU1laZp36YksGJm&!@hj21kwXMQaqF8JsGgzd&@!-OrwsZnbOGU5TY3odh7GTvIZrzPUO0gEPml0g8onHyj8yaTAlzskBajZbkw2TqSQWG677pmNt7nF1izm3x3csatU9mHgSqyo-Rttq4KBrS5JavsIDixahZ3XbTYgKer6LdFH22PjLtC75KIiSr9gEqKGZHr4SFv5EgusKZaNiEJ/jv4r7AD9EYRhl0LPSEzm3XLoiawuJZNo7SpTmdIZY1cekemcxJFillqelj27eJbKpS Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 12b9249174488540058a4fd868c1fec812766f2e17af520b29dd47fa22dd6f7a Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "51307f4f28fe9b78bc58283f7f408b4287daed136e337ce905bce57f4e46eca7-br" x-timer S1726971697.952281,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 15000 date Sun, 22 Sep 2024 02:21:36 GMT content-type image/jpeg last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	hero-poster.png nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/	74 KB 74 KB	5ms 4ms	Image image/png	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/hero-poster.png Requested by Host: throbbing-glitter-4d6f.salmonpink.workers.dev URL: https://throbbing-glitter-4d6f.salmonpink.workers.dev/9kGou7MjYWLklvYeHEiUY5aU23vVuxpXdqlhyDT-!@&RWU1laZp36YksGJm&!@hj21kwXMQaqF8JsGgzd&@!-OrwsZnbOGU5TY3odh7GTvIZrzPUO0gEPml0g8onHyj8yaTAlzskBajZbkw2TqSQWG677pmNt7nF1izm3x3csatU9mHgSqyo-Rttq4KBrS5JavsIDixahZ3XbTYgKer6LdFH22PjLtC75KIiSr9gEqKGZHr4SFv5EgusKZaNiEJ/jv4r7AD9EYRhl0LPSEzm3XLoiawuJZNo7SpTmdIZY1cekemcxJFillqelj27eJbKpS Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bd624f7ca80de7953c1b47d0ef30adab90b658a2c7c4c64f64405f0395c24ab7 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding gzip etag "97dd488cb488d29e886f8d7810b7bb39068b8b5732f9d84dcefc38ffb4468a86" x-timer S1726971697.952775,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 75262 date Sun, 22 Sep 2024 02:21:36 GMT content-type image/png last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	api.js Show response www.google.com/recaptcha/	1 KB 967 B	40ms 25ms	Script text/javascript	2607:f8b0:4006:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?hl=en Requested by Host: ashelford.net URL: https://ashelford.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 7cb7b3e07675cd1ed331968cdc8e63cade8b8cff7bb3a60a7b8d74129e8dbfda Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers cache-control private, max-age=300 content-encoding gzip cross-origin-resource-policy cross-origin report-to {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} x-content-type-options nosniff expires Sun, 22 Sep 2024 02:21:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" date Sun, 22 Sep 2024 02:21:36 GMT x-xss-protection 0 content-type text/javascript; charset=utf-8 server ESF x-frame-options SAMEORIGIN
GET H3	200	dropbox_logo_glyph_2015-vfl4ZOqXa.svg nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/	1 KB 750 B	5ms 5ms	Image image/svg+xml	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/dropbox_logo_glyph_2015-vfl4ZOqXa.svg Requested by Host: nirikdakawao.web.app URL: https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 24e3fcb3ad0dff75a380313470daaeda6a38319ec723e167995c464c3df3cf04 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "ecaeb5aabe1abbb98fb1316222d4e99e84a1833da96064d2f32932517d1d6a31-br" x-timer S1726971697.953785,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 416 date Sun, 22 Sep 2024 02:21:36 GMT content-type image/svg+xml last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	dropbox_logo_text_2015-vfld7_dJ8.svg nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/	3 KB 1 KB	6ms 6ms	Image image/svg+xml	2620:0:890::100 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/imgs/dropbox_logo_text_2015-vfld7_dJ8.svg Requested by Host: nirikdakawao.web.app URL: https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css Protocol H3 Security QUIC, , AES_256_GCM Server 2620:0:890::100 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 79bd621a88910759e37617b01a7488bd37fecfb6d718c90dae2a1b07e018c4c4 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://nirikdakawao.web.app/avfdfafczxcfafxzas/themes/css/d52b2b3c96d19ac1c644c98e73f1ecb5nbr1724176366.css Response headers strict-transport-security max-age=31556926; includeSubDomains; preload cache-control max-age=3600 content-encoding br etag "9665162e5f06fef7cb869e31e3f4e9b92bf5a59e0b62d6bbe38f0a4d13a5f913-br" x-timer S1726971697.953887,VS0,VE1 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT content-length 913 date Sun, 22 Sep 2024 02:21:36 GMT content-type image/svg+xml last-modified Fri, 23 Aug 2024 16:35:51 GMT x-served-by cache-lga21993-LGA x-cache-hits 0 vary x-fh-requested-host, accept-encoding
GET H3	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/	538 KB 212 KB	22ms 5ms	Script text/javascript	2607:f8b0:4006:816::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?hl=en Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:816::2003 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4943e91f7f53318d481ca07297395abbc52541c2be55d7276ecda152cd7ad9c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://throbbing-glitter-4d6f.salmonpink.workers.dev Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding gzip age 11732 report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} x-content-type-options nosniff expires Sun, 21 Sep 2025 23:06:05 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 21 Sep 2024 23:06:05 GMT last-modified Tue, 03 Sep 2024 02:00:38 GMT content-type text/javascript vary Accept-Encoding cache-control public, max-age=31536000 cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha accept-ranges bytes access-control-allow-origin * content-length 217247 x-xss-protection 0 server sffe
GET H3	200	anchor www.google.com/recaptcha/api2/ Frame 2187	0 0	44ms 35ms	Document text/html	2607:f8b0:4006:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeyEbwoAAAAAA0L8y2AkiF9_jqizDuZdrpL62la&co=aHR0cHM6Ly90aHJvYmJpbmctZ2xpdHRlci00ZDZmLnNhbG1vbnBpbmsud29ya2Vycy5kZXY6NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&theme=light&size=normal&cb=r5aumnkquawh Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-PVYXGrB10dxZ-9x_VbHGPA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-PVYXGrB10dxZ-9x_VbHGPA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" cross-origin-resource-policy cross-origin date Sun, 22 Sep 2024 02:21:37 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} server ESF x-content-type-options nosniff x-xss-protection 0
GET H3	200	favicon-vflUeLeeY.ico cfl.dropboxstatic.com/static/images/	387 B 692 B	73ms 40ms	Other image/vnd.microsoft.icon	2606:4700::6810:641d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cfl.dropboxstatic.com/static/images/favicon-vflUeLeeY.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6810:641d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 78f31552544922d7131fb218dd480a324e6ea9e9fa5e3134f446850b3238b103 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Response headers content-encoding br cf-cache-status HIT age 35258 x-content-type-options nosniff expires Sun, 22 Sep 2024 07:41:07 GMT date Sun, 22 Sep 2024 02:21:37 GMT content-type image/vnd.microsoft.icon last-modified Fri, 13 May 2022 17:26:58 GMT vary Accept-Encoding cache-control max-age=86400 timing-allow-origin https://www.dropbox.com cf-ray 8c6ed2941fd45e71-EWR access-control-allow-origin * x-dropbox-request-id 9947afe0dad11ae2b2fb368192f93f59 x-cached HIT server cloudflare
GET H3	200	bframe www.google.com/recaptcha/api2/ Frame FE07	0 0	32ms 31ms	Document text/html	2607:f8b0:4006:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=en&v=EGbODne6buzpTnWrrBprcfAY&k=6LeyEbwoAAAAAA0L8y2AkiF9_jqizDuZdrpL62la Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::2004 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-4mam1JKSoMWTD03KfVREcg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://throbbing-glitter-4d6f.salmonpink.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-4mam1JKSoMWTD03KfVREcg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy-report-only same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" cross-origin-resource-policy cross-origin date Sun, 22 Sep 2024 02:21:37 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} server ESF x-content-type-options nosniff x-xss-protection 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

336 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| _0x311f function| _0x55e7 function| _0x5ebb0c object| script34ssd object| _0x3e30 function| _0x315c function| _0x306b08 function| loadScript object| dml function| axios function| isnbrstoAvailable function| ES6Promise function| Vue function| VueRouter object| Vuex function| $ function| jQuery object| VeeValidate function| VueI18n function| _ function| MobileDetect object| _0x584c function| _0x5a60 function| _0x345f41 object| YAHOO object| CryptoJS string| b64map string| b64pad function| hex2b64 function| b64tohex function| b64toBA number| dbits number| canary boolean| j_lm function| BigInteger function| nbi function| am1 function| am2 function| am3 number| BI_FP string| BI_RM object| BI_RC number| rr number| vv function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnSquare function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse object| lowprimes number| lplim function| bnIsProbablePrime function| bnpMillerRabin function| Arcfour function| ARC4init function| ARC4next function| prng_newstate number| rng_psize object| rng_pool number| rng_pptr function| rng_seed_int function| rng_seed_time number| t object| ua function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| oaep_mgf1_arr function| oaep_pad function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| RSAEncryptOAEP function| pkcs1unpad2 function| oaep_mgf1_str function| oaep_unpad function| RSASetPrivate function| RSASetPrivateEx function| RSAGenerate function| RSADoPrivate function| RSADecrypt function| RSADecryptOAEP function| ECFieldElementFp function| feFpEquals function| feFpToBigInteger function| feFpNegate function| feFpAdd function| feFpSubtract function| feFpMultiply function| feFpSquare function| feFpDivide function| ECPointFp function| pointFpGetX function| pointFpGetY function| pointFpEquals function| pointFpIsInfinity function| pointFpNegate function| pointFpAdd function| pointFpTwice function| pointFpMultiply function| pointFpMultiplyTwo function| ECCurveFp function| curveFpGetQ function| curveFpGetA function| curveFpGetB function| curveFpEquals function| curveFpGetInfinity function| curveFpFromBigInteger function| curveFpDecodePointHex function| jsonParse object| ASN1HEX object| KJUR function| Base64x function| stoBA function| BAtos function| BAtohex function| stohex function| stob64 function| stob64u function| b64utos function| b64tob64u function| b64utob64 function| hextob64u function| b64utohex function| utf8tob64u function| b64utoutf8 function| utf8tob64 function| b64toutf8 function| utf8tohex function| hextoutf8 function| hextorstr function| rstrtohex function| hextob64 function| hextob64nl function| b64nltohex function| hextopem function| pemtohex function| hextoArrayBuffer function| ArrayBuffertohex function| zulutomsec function| zulutosec function| zulutodate function| datetozulu function| uricmptohex function| hextouricmp function| encodeURIComponentAll function| newline_toUnix function| newline_toDos function| hextoposhex function| intarystrtohex function| strdiffidx object| KEYUTIL object| _RE_HEXDECONLY function| _rsasign_getHexPaddedDigestInfoForString function| _zeroPaddingOfSignature function| pss_mgf1_str function| _rsasign_getDecryptSignatureBI function| _rsasign_getHexDigestInfoFromSig function| _rsasign_getAlgNameAndHashFromHexDisgestInfo function| X509 function| makeCRCNBR function| nbrenpnbry function| iluvutcnbr3062991 function| findPathbyName function| loadComponent function| load_recaptcha_bylang function| defaultReducer function| canWriteToLocalStorage function| _classCallCheck object| defaultStorage function| _typeofNBRPLUGIN function| creatNBRSystemStorage function| nbr_check_mobiledetect function| TouchMenuLA object| AOTS_VUE string| defaultLang object| store function| resetHeadersNBR function| changeLangtoURLNBR function| CancelToken object| nbrProcess function| instance function| instancesta function| randomId function| avoidreAU string| ch4kbat function| validrightrule function| requireAuth function| destroypageLogin function| scrollBehavior string| twnumoff string| LINKRE_RESULT string| TXT_RE string| EN_TXT_RE string| IMGE_TYPE_DR string| a_SH_GG string| a_SH_OFF string| a_SH_HM string| a_SH_YH string| a_SH_AL string| a_SH_IC string| a_SH_OT string| GrabEmailAPTS string| cus_link_off_app object| mapRoutes object| PAGE_TITLE string| validStepUlg function| closeOpenwinnbr object| router object| i18n function| i18nGobal object| configVeeValidate object| App object| LoadingBarVue function| ErrorReq object| __locale__ar function| VueTimeago object| __locale__fr object| __locale__it function| VueKeepScrollPosition function| Progressive object| __locale__ru function| Cookie object| __locale__vi object| __locale__zh_CN object| _0x1710 function| _0x5fe7 function| _0x37f2c6 object| grecaptcha object| ___grecaptcha_cfg string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_916084

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.