urlscan.io logo urlscan.io
SecurityTrails logo

pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev Open in urlscan Pro
2a06:98c1:58::eb  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Submission: On November 15 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main IP is 2a06:98c1:58::eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev.
TLS certificate: Issued by E5 on September 29th 2024. Valid for: 3 months.
This is the only time pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

Domain & IP information

IP Address AS Autonomous System
3 2a06:98c1:58::eb 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a04:4e42:200... 54113 (FASTLY)
2 104.17.25.14 13335 (CLOUDFLAR...)
4 104.18.10.207 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 142.250.186.163 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 172.217.18.3 15169 (GOOGLE)
18 11
3    2a06:98c1:58::eb (United States)

ASN13335 (CLOUDFLARENET, US)
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
translate.google.com
3    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
4    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net
www.gstatic.com
1    2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
translate.googleapis.com
1    172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f3.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
4 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3697
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1436
55 KB
3 gstatic.com
www.gstatic.com
fonts.gstatic.com
9 KB
3 jquery.com
code.jquery.com — Cisco Umbrella Rank: 923
77 KB
3 r2.dev
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
177 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 478
translate.googleapis.com — Cisco Umbrella Rank: 1240
104 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 275
14 KB
1 google.com
translate.google.com — Cisco Umbrella Rank: 1491
29 KB
18 7
Domain Requested by
3 code.jquery.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
3 pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 www.gstatic.com www.gstatic.com
2 maxcdn.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 stackpath.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 cdnjs.cloudflare.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 fonts.gstatic.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.googleapis.com
1 ajax.googleapis.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.google.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
18 10

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E5		 2024-09-29 -
2024-12-28		 3 months crt.sh
*.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.gstatic.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Frame ID: A7932678C72EF1D49B55D027AFB5992E
Requests: 24 HTTP requests in this frame

Frame: data://truncated
Frame ID: 303B731963BD77883F7F1D860B89B3A6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Credentials

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

56 %
IPv6

7
Domains

10
Subdomains

11
IPs

3
Countries

466 kB
Transfer

1051 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request owasecure.htm
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		150 KB
151 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8e2eac90e8e7a01b-FRA
Connection
keep-alive
Content-Length
153823
Content-Type
text/html
Date
Fri, 15 Nov 2024 10:49:20 GMT
ETag
"09b3347f28753600d23d1d97dbf7db98"
Last-Modified
Tue, 15 Oct 2024 00:34:43 GMT
Server
cloudflare
Vary
Accept-Encoding
element.js
translate.google.com/translate_a/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f606caf76f9c2e9ef2e89de9e58b170d932f3ebc5949ae17e4f22f3c41d32688
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin-allow-popups
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 10:49:21 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-1538f"
age
2674260
x-cache
HIT, HIT
date
Fri, 15 Nov 2024 10:49:21 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
32, 94881
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga13622-LGA, cache-cph2320037-CPH
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731667761.092180,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30288
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-500f"
age
62171
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X1OewHYmUQ9%2B8%2Bqtzt6lxx2pH3Q2O2%2FMcfPPZnlxHWZj1gah5LVp7D7D2vcIq9OaFh6u%2B6g7IAkThrnho5eQP6aKy2quT%2BQcHXDojSbkDWeqEg4aUn%2B5BZKVzzF36Oaxkoe1znHB"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 05 Nov 2025 10:49:21 GMT
alt-svc
h3=":443"; ma=86400
date
Fri, 15 Nov 2024 10:49:21 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2eac929e6cdbeb-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
6458
server
cloudflare
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"ce6e785579ae4cb555c9de311d1b9271"
age
129490
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 15 Nov 2024 10:49:21 GMT
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
09/26/2024 10:32:53
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
d9761adaac5341ea1778ff82bc06efeb
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2eac928f63e50e-TXL
access-control-allow-origin
*
cdn-edgestorageid
995
server
cloudflare
cdn-requestcountrycode
US
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-1111d"
age
3813386
x-cache
HIT, HIT
date
Fri, 15 Nov 2024 10:49:21 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
18, 3135
x-served-by
cache-lga21982-LGA, cache-cph2320059-CPH
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731667761.092526,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
24038
server
nginx
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"5869c96cc8f19086aee625d670d741f9"
age
129490
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 15 Nov 2024 10:49:21 GMT
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
10/09/2024 17:15:56
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
2eae5dd636060d2c453d9e92c928a90c
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2eac929f7fe50e-TXL
access-control-allow-origin
*
cdn-edgestorageid
1109
server
cloudflare
cdn-requestcountrycode
US
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-10fdd"
age
1999783
x-cache
HIT, HIT
date
Fri, 15 Nov 2024 10:49:21 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
25, 1411
x-served-by
cache-lga21963-LGA, cache-cph2320059-CPH
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731667761.092604,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
23856
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-4af4"
age
147769
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUV9qd46ZsXVVF%2Fvf0b4FroG7Z0gjhoaNLL2dsXntBJM%2F%2FnmVhEssBrkmXwpOo0hz4tNyNF2yA1Rs87PEk0USGwV5BeRIT08QKDsjmBHQ5a%2FbOsZLLjsl0JqKuR7QC7DCzw8GO%2Bn"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 05 Nov 2025 10:49:21 GMT
alt-svc
h3=":443"; ma=86400
date
Fri, 15 Nov 2024 10:49:21 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2eac929e68dbeb-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"14d449eb8876fa55e1ef3c2cc52b0c17"
age
96555
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
cdn-cachedat
09/26/2024 11:59:36
cdn-cache
HIT
priority
u=1,i=?0
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-pullzone
252412
cdn-proxyver
1.04
cdn-triggerededgerule
572817ab-2873-4760-8981-0132b6a2299e, cf31a005-2e3c-44f6-b953-b8e290a7a46a, c1a973b5-a84a-4683-8b33-9ecca22c4b68, a9841ad5-01f0-4e2a-8f0b-b2757cb10c8c, 3bfb2eee-3581-4a9c-8162-a4adf5fe8e3e, ae1df8d8-8ccd-4986-a814-6c70053e3c56, aa9d6962-b964-45ba-9961-53d19a1d79f9, fce06edf-465b-445b-839a-48b8ac604776
cdn-edgestorageid
1001
server
cloudflare
cdn-requestcountrycode
US
date
Fri, 15 Nov 2024 10:49:21 GMT
vary
Accept-Encoding
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cdn-requesttime
1
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8a023ffd75e06a9c7cb3715cb58dcb12
cross-origin-resource-policy
cross-origin
cf-ray
8e2eac929f85e50e-TXL
access-control-allow-origin
*
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
53927
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Fri, 14 Nov 2025 19:50:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 19:50:34 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
W/"67176c242e1bdc20603c878dee836df3"
age
1732701
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 15 Nov 2024 10:49:21 GMT
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding, Accept-Encoding
cdn-cache
HIT
cdn-cachedat
08/04/2024 20:14:54
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
d111e32d511363007c6323c1993605f3
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2eac92cac04528-TXL
access-control-allow-origin
*
cdn-edgestorageid
1029
server
cloudflare
cdn-requestcountrycode
US
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.jlqaz1to678.O/am=GAw/d=1/rs=AN8SPfoyhs0Mp2DFQPN0mYc4sqTdYjz69g/m=el_conf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f3.1e100.net
Software
sffe /
Resource Hash
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
29356
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 02:40:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 02:40:05 GMT
last-modified
Thu, 04 Apr 2024 07:26:25 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
4144
x-xss-protection
0
server
sffe
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.jlqaz1to678.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfq-inm1KPkdBn0G3p_sGyd2C7rNJg/ 		214 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.jlqaz1to678.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfq-inm1KPkdBn0G3p_sGyd2C7rNJg/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.jlqaz1to678.O/am=GAw/d=1/rs=AN8SPfoyhs0Mp2DFQPN0mYc4sqTdYjz69g/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
1638
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 10:22:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 10:22:03 GMT
last-modified
Wed, 13 Nov 2024 22:15:54 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
75181
x-xss-protection
0
server
sffe
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
segoeui-regular.ttf
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv

Response headers

CF-RAY
8e2eac93bb6aa01b-FRA
Content-Length
27150
Date
Fri, 15 Nov 2024 10:49:21 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare
truncated
/ Frame 303B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Content-Type
text/html;charset=UTF-8
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 		6 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f3.1e100.net
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
556304
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 00:17:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 09 Nov 2024 00:17:37 GMT
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
3340
x-xss-protection
0
server
sffe
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f3.1e100.net
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css

Response headers

age
3451
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Sat, 15 Nov 2025 09:51:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 15 Nov 2024 09:51:50 GMT
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
1842
x-xss-protection
0
server
sffe
favicon.ico
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		27 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv

Response headers

CF-RAY
8e2eac95ad53a01b-FRA
Content-Length
27150
Date
Fri, 15 Nov 2024 10:49:21 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| setCookie function| getLanguageCode function| googleTranslateElementInit function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| mainLogonDiv function| $ function| jQuery function| Popper object| bootstrap object| closure_lm_61792

1 Cookies

Domain/Path Name / Value
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ Name: googtrans
Value: /en/de

16 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=f**************@w*****.j**.dv
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
stackpath.bootstrapcdn.com
translate.google.com
translate.googleapis.com
www.gstatic.com
104.17.25.14
104.18.10.207
142.250.186.163
172.217.18.3
2a00:1450:4001:800::200a
2a00:1450:4001:809::200a
2a00:1450:4001:82a::200e
2a04:4e42:200::649
2a06:98c1:58::eb
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f606caf76f9c2e9ef2e89de9e58b170d932f3ebc5949ae17e4f22f3c41d32688