production.blue-leaf-056f.winnifred34538.workers.dev

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3037::ac43:a5a4, located in United States and belongs to CLOUDFLARENET, US. The main domain is production.blue-leaf-056f.winnifred34538.workers.dev.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 19th 2021. Valid for: a year.

This is the only time production.blue-leaf-056f.winnifred34538.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.118.28 167.89.118.28	11377 (SENDGRID) (SENDGRID)
1	2606:4700:303... 2606:4700:3037::ac43:a5a4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3033::ac43:d3fc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:7aaf	() ()
6	5

1 167.89.118.28 (Las Vegas, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789118x28.outbound-mail.sendgrid.net

u24013767.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::ac43:a5a4 (United States)

ASN13335 (CLOUDFLARENET, US)

production.blue-leaf-056f.winnifred34538.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:d3fc (United States)

ASN13335 (CLOUDFLARENET, US)

vadcx.quatiappcn.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

kiamptitizvux.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7aaf (None, )

ASN- ()

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	web.app kiamptitizvux.web.app	123 KB
1	unpkg.com unpkg.com	11 KB
1	quatiappcn.pw vadcx.quatiappcn.pw	5 KB
1	workers.dev production.blue-leaf-056f.winnifred34538.workers.dev	4 KB
1	sendgrid.net 1 redirects u24013767.ct.sendgrid.net	279 B
6	5

	Domain	Requested by
2	kiamptitizvux.web.app	production.blue-leaf-056f.winnifred34538.workers.dev
1	unpkg.com	production.blue-leaf-056f.winnifred34538.workers.dev
1	vadcx.quatiappcn.pw	production.blue-leaf-056f.winnifred34538.workers.dev
1	production.blue-leaf-056f.winnifred34538.workers.dev
1	u24013767.ct.sendgrid.net	1 redirects
6	5

This site contains no links.

Subject Issuer	Validity	Valid
winnifred34538.workers.dev Cloudflare Inc ECC CA-3	`2021-11-19` - `2022-11-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-12` - `2022-03-11`	a year	crt.sh
web.app GTS CA 1D4	`2021-09-20` - `2021-12-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz
Frame ID: 7819AE977D7DF17D118C5F870D2872EA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u24013767.ct.sendgrid.net/ls/click?upn=fR60D0w5Wstqf2vLU4cJ-2Fs972Gp2PMeYap-2FnS90D3vujqbYGaPwNOdDRy91... HTTP 302
https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz Page URL

Page Statistics

6
Requests

83 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

143 kB
Transfer

985 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u24013767.ct.sendgrid.net/ls/click?upn=fR60D0w5Wstqf2vLU4cJ-2Fs972Gp2PMeYap-2FnS90D3vujqbYGaPwNOdDRy917ZQxMEEi8ZmrCfThfc-2FgoyhcI58k-2FKasWhpAkj58Bx5TvReTH-2BGi2LuMSh6qRvG1Hq53KLuYr_4eaqPeiy2x730QQ3-2BL7QH2l2wh4Hx-2FYwlBsli-2BbPxunQgzZt1GxTp1lS-2FgMyF7hUrlRtncDD2tovt2X2zN-2BwgQPK2772uAFST1y9Xe-2Ff96OnUhwLsfm1Gc2URUKY8u1EGAX74cQCMSCYRSBm2NvuzQvCA6yIvLpYBwrijt3VZhONk-2F0UiP9U45VXNgeu0Fmc-2BTMtW5sdbb1ZHbw0ubk1dQ-3D-3D HTTP 302
https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
production.blue-leaf-056f.winnifred34538.workers.dev/
Redirect Chain

https://u24013767.ct.sendgrid.net/ls/click?upn=fR60D0w5Wstqf2vLU4cJ-2Fs972Gp2PMeYap-2FnS90D3vujqbYGaPwNOdDRy917ZQxMEEi8ZmrCfThfc-2FgoyhcI58k-2FKasWhpAkj58Bx5TvReTH-2BGi2LuMSh6qRvG1Hq53KLuYr_4eaqPei...
https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz

5 KB
4 KB

59ms
21ms

Document
text/html

2606:4700:3037::ac43:a5a4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:a5a4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b3e2502542fdf70ced0a154f1a803ecd892839d44024b70cd75dce03157f71c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 27 Nov 2021 12:05:23 GMT
content-type: text/html;charset=UTF-8
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zX4466VtVIfXGEsMdn%2FYThHeKqKAMynJCGgAR4J51TOv99xpm%2F6%2FXOsF%2FZwn5q8Q5l%2FZTjjYmawq%2BVOOOCgEhlfPBzin5vmARmSDXQ8Ax91Y0xB512RqUEr5GKIdBofBgejEHRzMBThd7UCSVvUL2jRerKEqqYkYhoJhDP7WSqayAdsBnivCMKNds5dFhlVoFV%2BD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6b4b3974cd1c05ed-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Server: nginx
Date: Sat, 27 Nov 2021 12:05:23 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 99
Connection: keep-alive
Location: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz
X-Robots-Tag: noindex, nofollow

GET
H2 200 6197d0f0febf846b7805957a.js Show response
vadcx.quatiappcn.pw/ 7 KB
5 KB 420ms
387ms Script
application/javascript 2606:4700:3033::ac43:d3fc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vadcx.quatiappcn.pw/6197d0f0febf846b7805957a.js
Requested by: Host: production.blue-leaf-056f.winnifred34538.workers.dev
URL: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:d3fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 190e618f3a3e0406dc3f267a7b2b46fc6c65f51b8418a1f07b7fff5380796df3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://production.blue-leaf-056f.winnifred34538.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 27 Nov 2021 12:05:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache-status: BYPASS
access-control-allow-methods: GET, POST, DELETE, PUT, PATCH, OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=99kDUk2tZEuE0j8BLwSmRRRiNMSmN85dhfHuw4ghqPl8U8GmvofxzfahWt809CeBn7bgXvlgLn%2F90KKyoyNNnL5a5ImGVldi2JErUJylhaPArMy6488RAkXPZ7S6PRZo3szYbpnPzeoJIrpdHOA85HAp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: vadcx.quatiappcn.pw
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 6b4b39755c7b431b-FRA
access-control-allow-headers: authkey , authvalue, Authorization, User-Agent, Keep-Alive, Content-Type, X-Requested-With
expires: Mon, 25 Jul 1997 05:00:00 GMT

GET
H2 200 4fcb42cb3774adea30d878f7d17eec7enbr1637339374.css
kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/css/ 755 KB
107 KB 1920ms
1576ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/css/4fcb42cb3774adea30d878f7d17eec7enbr1637339374.css

Requested by

Host: production.blue-leaf-056f.winnifred34538.workers.dev
URL: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

a898b155ae841e7f6ba6a9a0c2b84b2eda6c156ea317ebc3643321c88f25ea7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://production.blue-leaf-056f.winnifred34538.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Fri, 26 Nov 2021 12:59:34 GMT
x-timer: S1638014724.258728,VS0,VE1413
etag: "0ce43a52f97f2dc0d9c305bf83e963c8fbd8dd4368cbc2439bc06fc0cd33f843-br"
x-served-by: cache-del21746-DEL
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Sat, 27 Nov 2021 12:05:25 GMT
accept-ranges: bytes
content-length: 109154
x-cache-hits: 0

GET
H2 200 9ef5fa29d1a8dfcc0c1ae2c7904c9442nbr1637339375.css
kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/css/ 183 KB
16 KB 1594ms
1594ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/css/9ef5fa29d1a8dfcc0c1ae2c7904c9442nbr1637339375.css

Requested by

Host: production.blue-leaf-056f.winnifred34538.workers.dev
URL: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

830d49516c579564e0200cf73204350345b6f6d40b53418ad5e17fd8a4a23731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://production.blue-leaf-056f.winnifred34538.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Fri, 26 Nov 2021 12:59:34 GMT
x-timer: S1638014726.248491,VS0,VE1416
etag: "4694d0f158954346f324279afd5416e04bb61e7e2025c3011448a15f19f888aa-br"
x-served-by: cache-del21746-DEL
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=3600
date: Sat, 27 Nov 2021 12:05:27 GMT
accept-ranges: bytes
content-length: 16212
x-cache-hits: 0

GET
H2 200 axios.min.js Show response
unpkg.com/axios@0.16.1/dist/ 34 KB
11 KB 34ms
18ms Script
application/javascript 2606:4700::6810:7aaf

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/axios@0.16.1/dist/axios.min.js

Requested by

Host: production.blue-leaf-056f.winnifred34538.workers.dev
URL: https://production.blue-leaf-056f.winnifred34538.workers.dev/?bbre=zxodsuzxz

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7aaf -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

6b2114a050aed49f4a24237d4d1f437b75ca10c6fc8623eae23c0558c53a7e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://production.blue-leaf-056f.winnifred34538.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 27 Nov 2021 12:05:27 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18935641
fly-request-id: 01F3WA4DWH9N4YFFSWYNJD2Y5E
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 08 Apr 2017 18:51:20 GMT
server: cloudflare
etag: W/"879a-StlLhYX39Pj2Qvz0O98NQPjvG9U"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6b4b3990b8932bad-FRA

GET d6958ee71e1f44da4c57f2c91ff23de5nbr1637339375.js
kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: kiamptitizvux.web.app
URL: https://kiamptitizvux.web.app/dagzsxzxvdgvzxxz/themes/d6958ee71e1f44da4c57f2c91ff23de5nbr1637339375.js

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kiamptitizvux.web.app
production.blue-leaf-056f.winnifred34538.workers.dev
u24013767.ct.sendgrid.net
unpkg.com
vadcx.quatiappcn.pw
kiamptitizvux.web.app
167.89.118.28
2606:4700:3033::ac43:d3fc
2606:4700:3037::ac43:a5a4
2606:4700::6810:7aaf
2620:0:890::100
0b3e2502542fdf70ced0a154f1a803ecd892839d44024b70cd75dce03157f71c
190e618f3a3e0406dc3f267a7b2b46fc6c65f51b8418a1f07b7fff5380796df3
6b2114a050aed49f4a24237d4d1f437b75ca10c6fc8623eae23c0558c53a7e21
830d49516c579564e0200cf73204350345b6f6d40b53418ad5e17fd8a4a23731
a898b155ae841e7f6ba6a9a0c2b84b2eda6c156ea317ebc3643321c88f25ea7b

production.blue-leaf-056f.winnifred34538.workers.dev Open in urlscan Pro 2606:4700:3037::ac43:a5a4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

83 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

143 kBTransfer

985 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

0 Cookies

Indicators

production.blue-leaf-056f.winnifred34538.workers.dev Open in urlscan Pro
2606:4700:3037::ac43:a5a4 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

143 kB
Transfer

985 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions