cloud-flare-pages.pages.dev Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://cloud-flare-pages.pages.dev/
Effective URL:
https://cloud-flare-pages.pages.dev/?wid=1731381339013
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On November 12 via api (November 12th 2024, 3:15:51 am UTC) from DE — Scanned from NL

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 23 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is cloud-flare-pages.pages.dev.
TLS certificate: Issued by WE1 on November 10th 2024. Valid for: 3 months.

This is the only time cloud-flare-pages.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	163.181.131.217 163.181.131.217	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
2	163.181.92.235 163.181.92.235	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
1	2408:8763:0:2... 2408:8763:0:2a2:36::2b	4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone)
1	47.246.46.229 47.246.46.229	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
23	6

7 188.114.96.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cloud-flare-pages.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.131.217 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

unpkg.byted-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 163.181.92.235 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

lf3-short.ibytedapm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2408:8763:0:2a2:36::2b (China)

ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)

mon.zijieapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 47.246.46.229 (Milan, Italy)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

sf3-cdn-tos.douyinstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pages.dev 1 redirects cloud-flare-pages.pages.dev	102 KB
2	ibytedapm.com lf3-short.ibytedapm.com — Cisco Umbrella Rank: 44095	25 KB
1	douyinstatic.com sf3-cdn-tos.douyinstatic.com — Cisco Umbrella Rank: 19927	9 KB
1	zijieapi.com mon.zijieapi.com — Cisco Umbrella Rank: 24481
1	byted-static.com unpkg.byted-static.com — Cisco Umbrella Rank: 128827	27 KB
0	bcebos.com Failed hao123-static.cdn.bcebos.com Failed
0	bdstatic.com Failed code.bdstatic.com Failed dgss0.bdstatic.com Failed dss2.bdstatic.com Failed dgss3.bdstatic.com Failed
0	bytedance.com Failed ttwid.bytedance.com Failed
23	8

	Domain	Requested by
7	cloud-flare-pages.pages.dev	1 redirects cloud-flare-pages.pages.dev
2	lf3-short.ibytedapm.com	cloud-flare-pages.pages.dev lf3-short.ibytedapm.com
1	sf3-cdn-tos.douyinstatic.com
1	mon.zijieapi.com	lf3-short.ibytedapm.com
1	unpkg.byted-static.com	cloud-flare-pages.pages.dev
0	dgss3.bdstatic.com Failed	cloud-flare-pages.pages.dev
0	hao123-static.cdn.bcebos.com Failed	cloud-flare-pages.pages.dev
0	dss2.bdstatic.com Failed	cloud-flare-pages.pages.dev
0	dgss0.bdstatic.com Failed	cloud-flare-pages.pages.dev
0	code.bdstatic.com Failed	cloud-flare-pages.pages.dev
0	ttwid.bytedance.com Failed	lf3-short.ibytedapm.com
23	11

This site contains no links.

Subject Issuer	Validity	Valid
cloud-flare-pages.pages.dev WE1	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.byted-static.com RapidSSL TLS RSA CA G1	`2024-05-21` - `2025-05-21`	a year	crt.sh
*.ibytedapm.com RapidSSL TLS RSA CA G1	`2024-05-21` - `2025-05-21`	a year	crt.sh
*.zijieapi.com RapidSSL TLS RSA CA G1	`2024-05-21` - `2025-05-21`	a year	crt.sh
*.douyinstatic.com RapidSSL TLS RSA CA G1	`2024-05-21` - `2025-05-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cloud-flare-pages.pages.dev/?wid=1731381339013
Frame ID: ED990473BCC6BE4060062D75574099BB
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

hao123_上网从这里开始

Page URL History Show full URLs

http://cloud-flare-pages.pages.dev/ HTTP 307
https://cloud-flare-pages.pages.dev/ Page URL
https://cloud-flare-pages.pages.dev/cdn-cgi/phish-bypass?atok=isARO4jCz74TzyX4c5WQ1Q2pTwaKv2OmNrimilEbYJI-173138... HTTP 301
https://cloud-flare-pages.pages.dev/ Page URL
https://cloud-flare-pages.pages.dev/?wid=1731381339013 Page URL

Page Statistics

23
Requests

48 %
HTTPS

20 %
IPv6

8
Domains

11
Subdomains

6
IPs

4
Countries

163 kB
Transfer

696 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://cloud-flare-pages.pages.dev/ HTTP 307
https://cloud-flare-pages.pages.dev/ Page URL
https://cloud-flare-pages.pages.dev/cdn-cgi/phish-bypass?atok=isARO4jCz74TzyX4c5WQ1Q2pTwaKv2OmNrimilEbYJI-1731381329-0.0.1.1-%2F HTTP 301
https://cloud-flare-pages.pages.dev/ Page URL
https://cloud-flare-pages.pages.dev/?wid=1731381339013 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cloud-flare-pages.pages.dev/ HTTP 307
https://cloud-flare-pages.pages.dev/

Request Chain 4

https://cloud-flare-pages.pages.dev/cdn-cgi/phish-bypass?atok=isARO4jCz74TzyX4c5WQ1Q2pTwaKv2OmNrimilEbYJI-1731381329-0.0.1.1-%2F HTTP 301
https://cloud-flare-pages.pages.dev/

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

/ Show response
cloud-flare-pages.pages.dev/
Redirect Chain

http://cloud-flare-pages.pages.dev/
https://cloud-flare-pages.pages.dev/

4 KB
2 KB

74ms
20ms

Document
text/html

188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud-flare-pages.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

968c4cc94735666437a05f4daa75a5979c6440a7e6dceefa7a83e57396800278

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e135ba06ef79fc0-AMS
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 12 Nov 2024 03:15:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3D7EQEqcypIv7mvf3DrJhfxZcTcdHmyEG77v1J1YB79LaqcVmhtVXP0sytyG55Gg9p2KZStuFNVqjZImZuUqnlEV21TaQhvYRZ0J9nE3mbVFy6kt4OyEEK96THU7kyJZ2Nzs2ZZMQgJpHIu1aEk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://cloud-flare-pages.pages.dev/
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
cloud-flare-pages.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 20ms
20ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud-flare-pages.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: cloud-flare-pages.pages.dev
URL: https://cloud-flare-pages.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cloud-flare-pages.pages.dev/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"672b8dd6-5df3"
x-content-type-options: nosniff
cf-ray: 8e135ba0cf2a9fc0-AMS
expires: Tue, 12 Nov 2024 05:15:30 GMT
date: Tue, 12 Nov 2024 03:15:30 GMT
content-type: text/css
last-modified: Wed, 06 Nov 2024 15:40:06 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
cloud-flare-pages.pages.dev/cdn-cgi/images/ 452 B
635 B 18ms
17ms Image
image/png 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloud-flare-pages.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: cloud-flare-pages.pages.dev
URL: https://cloud-flare-pages.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cloud-flare-pages.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "672b8dd6-1c4"
x-content-type-options: nosniff
cf-ray: 8e135ba378ce9fc0-AMS
expires: Tue, 12 Nov 2024 05:15:30 GMT
accept-ranges: bytes
content-length: 452
date: Tue, 12 Nov 2024 03:15:30 GMT
content-type: image/png
last-modified: Wed, 06 Nov 2024 15:40:06 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 403 favicon.ico
cloud-flare-pages.pages.dev/ 44 B
629 B 1233ms
1232ms Other
text/plain 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud-flare-pages.pages.dev/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d12a27253dfda80192317f0e509a6deadcdd7d21fd3c139fabb7b8b9cfce39a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cloud-flare-pages.pages.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mh2vqoCiWMJTNUmNn61tOfdK%2B%2BGg8GKWMYQlgzHpRrwQVULv%2Bra0kNbc7W7t3bc%2FzaxpulfBhTNZU1jusBNmr5QFjI8Kr5Kbsxp9nE7qWoQnRiws5%2FVGW6afDZJh2YY02VlEWjkuNTyTSXm9xCE%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e135ba3c9019fc0-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=15837&sent=23&recv=17&lost=0&retrans=0&sent_bytes=11979&recv_bytes=5754&delivery_rate=16206&cwnd=12000&unsent_bytes=0&cid=a6394c76e0a44969&ts=1787&x=1", cfHdrFlush;dur=0
content-length: 44
date: Tue, 12 Nov 2024 03:15:31 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H3

200

/ Show response
cloud-flare-pages.pages.dev/
Redirect Chain

https://cloud-flare-pages.pages.dev/cdn-cgi/phish-bypass?atok=isARO4jCz74TzyX4c5WQ1Q2pTwaKv2OmNrimilEbYJI-1731381329-0.0.1.1-%2F
https://cloud-flare-pages.pages.dev/

5 KB
6 KB

296ms
295ms

Document
text/html

188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud-flare-pages.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75d86fe3ebcf06ae66b1062661a885e63c86a5321d23bd271e2743597f504b76

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-eval' 'wasm-unsafe-eval' 'report-sample' 'strict-dynamic' 'nonce-WRzzsBeScRyoIcf89m8hW' .bytescm.com .bytednsdoc.com .ibytedapm.com .snssdk.com .yhgfb-cn-static.com .bytetos.com .byte-gslb.com .bytegoofy.com .bytecdn.cn .toutiaostatic.com;style-src 'self' 'unsafe-inline' .toutiaoimg.com .bdxiguaimg.com .bytescm.com .bytegoofy.com .douyinstatic.com .toutiao.com .toutiaostatic.com .bytedance.net cdn.bootcss.com;upgrade-insecure-requests;frame-ancestors 'self' .bytedance.net .snssdk.com shiqu.cn .shiqu.cn zhan.vivo.com wukong.vivo.com.cn .feishuapp.cn .toutiao.com .bytescm.com .jiyunhudong.com .bytedance.com *.feishu.cn;report-uri https://mon.zijieapi.com/log/sentry/v2/api/slardar/main/?ev_type=csp&bid=toutiao_web_pc;report-to main-endpoint
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cloud-flare-pages.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e135bbe6a379fc0-AMS
content-encoding: br
content-security-policy: script-src 'unsafe-eval' 'wasm-unsafe-eval' 'report-sample' 'strict-dynamic' 'nonce-WRzzsBeScRyoIcf89m8hW' *.bytescm.com *.bytednsdoc.com *.ibytedapm.com *.snssdk.com *.yhgfb-cn-static.com *.bytetos.com *.byte-gslb.com *.bytegoofy.com *.bytecdn.cn *.toutiaostatic.com;style-src 'self' 'unsafe-inline' *.toutiaoimg.com *.bdxiguaimg.com *.bytescm.com *.bytegoofy.com *.douyinstatic.com *.toutiao.com *.toutiaostatic.com *.bytedance.net cdn.bootcss.com;upgrade-insecure-requests;frame-ancestors 'self' *.bytedance.net *.snssdk.com shiqu.cn *.shiqu.cn zhan.vivo.com wukong.vivo.com.cn *.feishuapp.cn *.toutiao.com *.bytescm.com *.jiyunhudong.com *.bytedance.com *.feishu.cn;report-uri https://mon.zijieapi.com/log/sentry/v2/api/slardar/main/?ev_type=csp&bid=toutiao_web_pc;report-to main-endpoint
content-security-policy-report-only: script-src 'unsafe-eval' 'wasm-unsafe-eval' 'report-sample' 'strict-dynamic' 'nonce-WRzzsBeScRyoIcf89m8hW' *.bytescm.com *.bytednsdoc.com *.ibytedapm.com *.snssdk.com *.yhgfb-cn-static.com *.bytetos.com *.byte-gslb.com *.bytegoofy.com *.bytecdn.cn *.toutiaostatic.com;style-src 'self' 'unsafe-inline' *.toutiaoimg.com *.bdxiguaimg.com *.bytescm.com *.bytegoofy.com *.douyinstatic.com *.toutiao.com *.toutiaostatic.com *.bytedance.net cdn.bootcss.com;connect-src 'self' wss: ws: data: blob: http://localhost:* toutiao.govwza.cn *.bytedance.net *.bytedance.com *.snssdk.com *.toutiaostatic.com *.bytescm.com *.toutiao.com *.bytetcc.com *.zijieapi.com *.yhgfb-cn-static.com *.toutiaovod.com *.bytednsdoc.com *.ibytedapm.com *.bytedanceapi.com *.google-analytics.com *.douyinstatic.com *.douyinvod.com *.bytegoofy.com *.bytetos.com *.toutiaoimg.com *.huoshanstatic.com *.idouyinvod.com:* *.volcsiriusbd.com:* *.volcsirius.com:* *.tt.x.bsgslb.cn:* *.dy.zzcdnx.com:* *.qc.bsccdn.net:* *.smtcdns.com:* *.ugslb.com:* *.livehwc3.cn:* *.smtcdns.net:* *.bytefcdnrd.com:* *.ksyungslb.com:* *.ksyungslb2.com:* *.ourdvsss.com:* *.tbcache.com:* *.jomodns.com:* *.douyincdn.com:* *.ixigua.com:* *.bdxigualive.com:* *.pstatp.com:* *.douyinliving.com:* *.picovr.com:* *.huoshanlive.com:* *.ihuoshanlive.com:* *.volccdn.com:* *.bestv.com.cn:* *.bytefcdn.com:* *.qnqcdn.net:* *.jomoxc.com *.jomoxd.com *.a.bdycdn.cn *.hiecheimaetu.com:* *.ppio.cloud:* *.weilayun.com:* *.saxysec.com:* *.saxyit.com:* *.saxydc.com:* *.sjxysec.com:* *.sjxydc.com:* *.vegslb.com:*;upgrade-insecure-requests;frame-ancestors 'self' *.bytedance.net *.snssdk.com shiqu.cn *.shiqu.cn zhan.vivo.com wukong.vivo.com.cn *.feishuapp.cn *.toutiao.com *.bytescm.com *.jiyunhudong.com *.bytedance.com *.feishu.cn;report-uri https://mon.zijieapi.com/log/sentry/v2/api/slardar/main/?ev_type=csp&bid=toutiao_web_pc;report-to main-endpoint
content-type: text/html; charset=utf-8
date: Tue, 12 Nov 2024 03:15:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VG6VRXToWZigqLmNc3OY1lJxHhebTEhP3cRz83Lz0hdfW1Pk9xCA88Qu0CX%2FddZZWgFIc44jZuj%2FNIRx0nFsb67boghMwJMKTNKxyQmrAhoIxxetw1WMiAg%2BLW8bDR77jiiLlIWVVQ1lvfCucwQ%3D"}],"group":"cf-nel","max_age":604800}
reporting-endpoints: main-endpoint="https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=toutiao_web_pc", default="https://mon.zijieapi.com/monitor_browser/collect/batch/security/?bid=toutiao_web_pc"
server: cloudflare
server-timing: cdn-cache; desc=MISS, edge; dur=200, origin; dur=36 inner; dur=28,tt_agw; dur=18 cfL4;desc="?proto=QUIC&rtt=15909&sent=28&recv=22&lost=0&retrans=0&sent_bytes=13138&recv_bytes=6845&delivery_rate=719&cwnd=12000&unsent_bytes=0&cid=a6394c76e0a44969&ts=5109&x=1" cfHdrFlush;dur=0
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-agw-info: skkjVb0qLkWKlYdYqXcqo-o7Iff7xXGW6eRrW9LyIO9C6lilu1KsgIM03o_5SVvHAzNvHwAO6-6zUfiwnuq-MMscqb3KLvYwajGAA75sonNSwkLlF5dF5mGiAOsuf6y4y5mEGffdjTQxqu9iqNwv9KWow6wCFbl4hvYBZg==
x-akamai-request-id: bd33eb4.f142f83.1ce28800
x-cache: TCP_MISS from a2-18-120-27.deploy.akamaitechnologies.com (AkamaiGHost/11.7.0.1-02978ab5588da6405be9084889a03f78) (-)
x-cache-remote: TCP_MISS from a23-54-207-23.deploy.akamaitechnologies.com (AkamaiGHost/11.7.0.1-02978ab5588da6405be9084889a03f78) (-)
x-content-type-options: nosniff
x-download-options: noopen
x-origin-response-time: 36,221.194.158.131
x-parent-response-time: 227,23.54.207.23 236,2.18.120.27
x-tt-agw-login: 0
x-tt-logid: 20241112111534C487B821CF126E186AD6
x-tt-trace-host: 01ae3485c412db67097a2fefa88ba0f9729d3076ce3bee20ec3cd4fdf77d283377f03a5712d74f1bf958e1c5d04f8f383a3615d5d32cdf0776b72c00cba043e1698e997a24bfaa97b5817a6c85cc8e356b97deaf4e40032bf5778edd6205a5471e1d6c8aa3cce028db47192516b74e410f72d6095a816461ac341127e2a69a7b8f
x-tt-trace-id: 00-241112111534C487B821CF126E186AD6-53EA1EE89C4BC5FD-00
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-xss-protection: 1; mode=block

Redirect headers

cache-control: private, no-cache
cf-ray: 8e135bbe4a1d9fc0-AMS
content-length: 167
content-type: text/html
date: Tue, 12 Nov 2024 03:15:34 GMT
location: https://cloud-flare-pages.pages.dev/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 index.umd.production.js Show response
unpkg.byted-static.com/byted-ucenter/ttwid-js/1.0.1/dist/ 102 KB
27 KB 1483ms
23ms Script
application/javascript 163.181.131.217
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://unpkg.byted-static.com/byted-ucenter/ttwid-js/1.0.1/dist/index.umd.production.js
Requested by: Host: cloud-flare-pages.pages.dev
URL: https://cloud-flare-pages.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 163.181.131.217 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 8ca93806242fcf868f434ee49ae71ec7c72e86a8f946f42567a0746cd5b1491a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cloud-flare-pages.pages.dev/

Response headers

x-request-ip: fdbd:dc02:22:591::151
content-md5: tSH+3Yv8+H8EPSD59VGDlw==
x-bdcdn-cache-status: TCP_MISS
content-encoding: gzip
etag: W/"b521fedd8bfcf87f043d20f9f5518397"
age: 2650752
x-tos-request-id: 1f8fdf0a55d83f1d670a55d8-ad411a8-ad316d0
server-timing: cdn-cache;desc=HIT,edge;dur=1
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
date: Sat, 12 Oct 2024 10:56:24 GMT
x-kfc-cachekey: http://pinner-imgserver.byted.org/unpkg/byted-ucenter/ttwid-js/1.0.1/dist/index.umd.production.js
content-type: application/javascript
vary: Accept-Encoding
last-modified: Tue, 29 Mar 2022 14:33:02 GMT
x-tos-storage-class: STANDARD
x-tt-trace-host: 019dcadfa85d8eeba8cd991134f4b9623cca993616806d640d10b51bbf9f01195c8afefa75f5e4a08764e5e71f55190fe721974b861c29a98c786886aa768864d3529e19ac23bbbf61c1e63ccecccf22e5adfd4e2b347091bac9c8406435ada5c9
cache-control: max-age=3153600
x-swift-cachetime: 933369
timing-allow-origin: *
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
via: n204-099-021, ens-cache9.l2de3[0,0,206-0,H], ens-cache14.l2de3[1,0], ens-cache5.de7[0,0,200-0,H], ens-cache7.de7[1,0]
ali-swift-global-savetime: 1728730584
x-tos-response-time: Sat, 12 Oct 2024 10:56:24 GMT
x-swift-savetime: Thu, 07 Nov 2024 03:40:15 GMT
access-control-allow-origin: *
x-tt-trace-id: 00-241012185624FF6D9B5C8244B1D82BEC-23E803D01D4EE939-00
eagleid: a3b5839b17313813365553705e
x-response-cache: edge_hit
server: Tengine
x-response-cinfo: fdbd:dc02:22:591::151
x-tt-logid: 20241012185624FF6D9B5C8244B1D82BEC

GET
H2 200 browser.cn.js Show response
lf3-short.ibytedapm.com/slardar/fe/sdk-web/ 42 KB
16 KB 181ms
26ms Script
application/javascript 163.181.92.235
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://lf3-short.ibytedapm.com/slardar/fe/sdk-web/browser.cn.js?bid=toutiao_web_pc&globalName=Slardar
Requested by: Host: cloud-flare-pages.pages.dev
URL: https://cloud-flare-pages.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 163.181.92.235 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: de8dc0a904961f156a431eba835832429fafada565dac0e7152e5be289cab239

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://cloud-flare-pages.pages.dev
Referer: https://cloud-flare-pages.pages.dev/

Response headers

content-md5: 6JSh+y1prShcLeq0SB5BRg==
content-encoding: br
etag: W/"e894a1fb2d69ad285c2deab4481e4146"
age: 51
x-tos-request-id: 517a3b32c824ae016732c824-a943129
server-timing: cdn-cache;desc=HIT,edge;dur=1
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 06:27:00 GMT
x-server: goofy
x-tt-trace-host: 0167681cc3b61affcac815c9cb80cc4103ace686406f649f3329ea8f6b977faf0d2342fdaa506eedb62c96f7f149e78b49088b6c3c6816112f714877f5a2597ff56e8dd463477ec670236099f28a5ae1bf9b5a6b0a47f4b4a29415e4401c6ae3fd
cache-control: max-age=300
access-control-request-methods: OPTIONS, HEAD, GET
x-swift-cachetime: 300
ali-swift-global-savetime: 1731381284
x-swift-savetime: Tue, 12 Nov 2024 03:14:44 GMT
x-tt-trace-id: 00-24111211144469D66B7A9CB072F7472C-2FEC339134AC36B7-00
content-length: 15740
eagleid: a3b55ca117313813352605359e
x-response-cache: edge_hit
server: Tengine
access-control-allow-methods: OPTIONS, HEAD, GET
date: Tue, 12 Nov 2024 03:14:44 GMT
x-tos-storage-class: STANDARD
vary: Accept-Encoding
timing-allow-origin: *
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
via: ens-cache1.l2de3[229,229,304-0,M], ens-cache5.l2de3[230,0], ens-cache13.de5[0,0,200-0,H], ens-cache13.de5[1,0]
x-tos-response-time: Tue, 12 Nov 2024 03:14:44 GMT
x-tos-hash-crc64ecma: 12338591081625040781
access-control-allow-origin: *
x-tt-logid: 2024111211144469D66B7A9CB072F7472C

OPTIONS
H2 200 browser-settings
mon.zijieapi.com/monitor_web/settings/ 0
0 4846ms
328ms Preflight
application/json 2408:8763:0:2a2:36::2b
CHINA169-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://mon.zijieapi.com/monitor_web/settings/browser-settings?bid=toutiao_web_pc&store=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2408:8763:0:2a2:36::2b , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software: TLB /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://cloud-flare-pages.pages.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-origin: https://cloud-flare-pages.pages.dev
access-control-max-age: 600
access-control-request-method: POST,GET,OPTIONS
cache-control: public, max-age=600
content-encoding: br
content-type: application/json; charset=utf-8
date: Tue, 12 Nov 2024 03:15:39 GMT
server: TLB
server-timing: inner; dur=9 cdn-cache;desc=miss, edge;dur=1, origin;dur=51
vary: Accept-Encoding Origin
x-tt-logid: 202411121115398CAD0F5D7792E631A740
x-tt-trace-host: 01ab984f797473338f6484ebf54ff1b094b80a17acac0a7e68467281cd97e8bfeabb565437725500ed93aa4f035f661fc6438c0c17a45ff4b740f3bdd11ca5fcd5a70e4977abbd5e128a9a82c01d218dbfa1dc1171063ec0e608e7c3488004b2fe
x-tt-trace-id: 00-2411121115398CAD0F5D7792E631A740-358DA10B1B8F94F5-00
x-tt-trace-tag: id=11;cdn-cache=miss;type=dyn

GET browser-settings
mon.zijieapi.com/monitor_web/settings/ 0
0

POST /
ttwid.bytedance.com/ttwid/union/register/ 0
0

GET
H2 200 common-monitors.1.14.0.js Show response
lf3-short.ibytedapm.com/slardar/fe/sdk-web/plugins/ 22 KB
9 KB 29ms
29ms Script
application/javascript 163.181.92.235
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://lf3-short.ibytedapm.com/slardar/fe/sdk-web/plugins/common-monitors.1.14.0.js
Requested by: Host: lf3-short.ibytedapm.com
URL: https://lf3-short.ibytedapm.com/slardar/fe/sdk-web/browser.cn.js?bid=toutiao_web_pc&globalName=Slardar
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 163.181.92.235 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: a37ccd355cc2221d46aa8bd3230a6197872972dc2c27810cdcd12bd31c31e5f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://cloud-flare-pages.pages.dev
Referer: https://cloud-flare-pages.pages.dev/

Response headers

content-md5: El76ckxx455z2z33BLqDgQ==
content-encoding: br
etag: W/"125efa724c71e39e73db3df704ba8381"
age: 16
x-tos-request-id: 72938b32c84802026732c848-a924c2e
server-timing: cdn-cache;desc=HIT,edge;dur=2
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 06:27:00 GMT
x-server: goofy
x-tt-trace-host: 011d90d43812f728be2e4bb622729ab7618068754f41437c3f0e6db43861260c3c57f907e1c26428ee788e74a5e0dede6b54c4265a53ea25b822314d51516dd641650dce04efd0f496bab2b74135020332c42e54d03cf38bc029e39c8910ae8fb2
cache-control: max-age=300
access-control-request-methods: OPTIONS, HEAD, GET
x-swift-cachetime: 300
ali-swift-global-savetime: 1731381320
x-swift-savetime: Tue, 12 Nov 2024 03:15:20 GMT
x-tt-trace-id: 00-241112111520469E406B632A9BF44FF7-1B8E1396320386ED-00
content-length: 8716
eagleid: a3b55ca117313813366001512e
x-response-cache: edge_hit
server: Tengine
access-control-allow-methods: OPTIONS, HEAD, GET
date: Tue, 12 Nov 2024 03:15:20 GMT
x-tos-storage-class: STANDARD
vary: Accept-Encoding
timing-allow-origin: *
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
via: ens-cache9.l2de3[0,0,304-0,H], ens-cache6.l2de3[2,0], ens-cache13.de5[0,0,200-0,H], ens-cache13.de5[2,0]
x-tos-response-time: Tue, 12 Nov 2024 03:15:20 GMT
x-tos-hash-crc64ecma: 8323589054140192178
access-control-allow-origin: *
x-tt-logid: 20241112111520469E406B632A9BF44FF7

GET
H2 200 toutiao_favicon.ico
sf3-cdn-tos.douyinstatic.com/obj/eden-cn/uhbfnupkbps/ 8 KB
9 KB 1196ms
33ms Other
image/vnd.microsoft.icon 47.246.46.229
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://sf3-cdn-tos.douyinstatic.com/obj/eden-cn/uhbfnupkbps/toutiao_favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 47.246.46.229 Milan, Italy, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: dc7b9705741e9fbc9a1a201cdc29d5e4de01329d09403df0a537f3c9599e0f85

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://cloud-flare-pages.pages.dev/

Response headers

x-request-ip: fdbd:dc02:19:483::163
content-md5: bSQP3ZBtDIvp/g12+a/ZIA==
x-bdcdn-cache-status: TCP_MISS
etag: "6d240fdd906d0c8be9fe0d76f9afd920"
age: 759277
x-tos-request-id: 9d821227326c5b226727326c-a9e9124-a181885
server-timing: cdn-cache;desc=HIT,edge;dur=1
x-cache: HIT TCP_MEM_HIT dirn:-2:-2
content-type: image/vnd.microsoft.icon
last-modified: Fri, 13 May 2022 02:54:54 GMT
x-tt-trace-host: 016c2a5c2400a23658c2b8d4dc5655327d9d7f55aa6df742f3fc7194f60bcd4057e5b9088d97f57ce9e2fcf50444862c5c334609cd6227b39658e703838210183a97c6c9e91ba322259faaed99266185228b482c41dea2539c25a676faa28f574a
cache-control: max-age=2592000
x-swift-cachetime: 2591970
ali-swift-global-savetime: 1730622060
x-swift-savetime: Sun, 03 Nov 2024 08:21:30 GMT
accept-ranges: bytes
x-tt-trace-id: 00-241103162100D3F344566147AFB74714-3A71B65D450A64A8-00
content-length: 7888
eagleid: 2ff62e9c17313813377913267e
x-response-cache: edge_hit
server: Tengine
x-response-cinfo: 31.204.150.110
access-control-allow-methods: GET, POST, OPTIONS, HEAD
date: Sun, 03 Nov 2024 08:21:00 GMT
x-kfc-cachekey: http://sf3-cdn-tos.douyinstatic.com/eden-cn/uhbfnupkbps/toutiao_favicon.ico
x-tos-storage-class: STANDARD
access-control-allow-headers: *
timing-allow-origin: *
x-tt-trace-tag: id=03;cdn-cache=hit;type=static
via: fdbd:dc02:d:590::20, ens-cache3.l2de3[0,0,304-0,H], ens-cache16.l2de3[1,0], ens-cache16.l2de3[2,0], ens-cache1.it4[0,0,200-0,H], ens-cache8.it4[1,0]
x-tos-response-time: Sun, 03 Nov 2024 08:21:00 GMT
access-control-allow-origin: *
x-tt-logid: 20241103162100D3F344566147AFB74714

POST /
ttwid.bytedance.com/ttwid/union/register/ 0
0

GET
H3 200 Primary Request / Show response
cloud-flare-pages.pages.dev/ 488 KB
89 KB 1688ms
1687ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud-flare-pages.pages.dev/?wid=1731381339013
Requested by: Host: cloud-flare-pages.pages.dev
URL: https://cloud-flare-pages.pages.dev/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c9431be134c6dfc84464bcc9358330ba21ab54df2e83829822535d95e30338b

Request headers

Referer: https://cloud-flare-pages.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8e135bd8eb029fc0-AMS
content-encoding: br
content-security-policy-report-only: default-src https: 'unsafe-inline' 'unsafe-eval' data: blob: ; report-uri https://reports.baidu.com/csp-report
content-type: text/html;charset=UTF-8
cxy_all: +2063bc3948fb2bfe64729f001423ab1b
date: Tue, 12 Nov 2024 03:15:40 GMT
lfy: gzbh.77547
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
p3p: CP=" OTI DSP COR IVA OUR IND COM "
public-key-pins-report-only: max-age=300;pin-sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q=";pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4=";report-uri="https://reports.baidu.com/pkp-report/"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ur1AuzB0DccTvpRTX3nlWS4VES6JZwyqxEXFLvUxqnjzV5Lb6xD5%2BYXyyw5jFgw0zCCKhjMiikL7XjL6Mjh%2FY3mWZtHO7gADQNlJ98Ht2st%2F6h2s8HGx5JEsXzRyg1eZi3c0fWp3%2Bva31zwu1zc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=15827&sent=38&recv=28&lost=0&retrans=0&sent_bytes=19071&recv_bytes=7546&delivery_rate=409867&cwnd=12000&unsent_bytes=0&cid=a6394c76e0a44969&ts=10747&x=1" cfHdrFlush;dur=0
tracecode: 09401530072553536778111211
vary: Accept-Encoding

GET spy-head.min.js
code.bdstatic.com/npm/spy-client@2.1.8/dist/ 0
0

GET spy-client.min.js
code.bdstatic.com/npm/spy-client@2.1.8/dist/ 0
0

GET 297f5edb1e984613083a2d3cc0c5bb36.png
dgss0.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/r/image/2017-09-27/ 0
0

GET hao123%20logo.png
dss2.bdstatic.com/5bVYsj_p_tVS5dKfpU_Y_D3/res/r/image/2021-3-4/ 0
0

GET loading.e12a19f.gif
hao123-static.cdn.bcebos.com/fe-res/her/static/indexnew/component/hotsearch/ 0
0

GET d5fecbd5239db7cbc8d7939a75e4d830.png
dgss0.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/r/image/2020-05-14/ 0
0

GET es5-shim.min.js
dgss3.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/js/polyfill/ 0
0

GET main.cf91835.js
hao123-static.cdn.bcebos.com/fe-res/her/static/indexnew/lib/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mon.zijieapi.com
URL: https://mon.zijieapi.com/monitor_web/settings/browser-settings?bid=toutiao_web_pc&store=1

Domain: ttwid.bytedance.com
URL: https://ttwid.bytedance.com/ttwid/union/register/

Domain: ttwid.bytedance.com
URL: https://ttwid.bytedance.com/ttwid/union/register/

Domain: ttwid.bytedance.com
URL: https://ttwid.bytedance.com/ttwid/union/register/

Domain: code.bdstatic.com
URL: https://code.bdstatic.com/npm/spy-client@2.1.8/dist/spy-head.min.js

Domain: code.bdstatic.com
URL: https://code.bdstatic.com/npm/spy-client@2.1.8/dist/spy-client.min.js

Domain: dgss0.bdstatic.com
URL: https://dgss0.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/r/image/2017-09-27/297f5edb1e984613083a2d3cc0c5bb36.png

Domain: dss2.bdstatic.com
URL: https://dss2.bdstatic.com/5bVYsj_p_tVS5dKfpU_Y_D3/res/r/image/2021-3-4/hao123%20logo.png

Domain: hao123-static.cdn.bcebos.com
URL: https://hao123-static.cdn.bcebos.com/fe-res/her/static/indexnew/component/hotsearch/loading.e12a19f.gif

Domain: dgss0.bdstatic.com
URL: https://dgss0.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/r/image/2020-05-14/d5fecbd5239db7cbc8d7939a75e4d830.png

Domain: dgss3.bdstatic.com
URL: https://dgss3.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/js/polyfill/es5-shim.min.js

Domain: hao123-static.cdn.bcebos.com
URL: https://hao123-static.cdn.bcebos.com/fe-res/her/static/indexnew/lib/main.cf91835.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| HAO

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.cloud-flare-pages.pages.dev/	1970-01-21 00:57:47	Name: __cf_mw_byp Value: isARO4jCz74TzyX4c5WQ1Q2pTwaKv2OmNrimilEbYJI-1731381329-0.0.1.1-/
.bytedance.com/	1970-01-21 09:41:57	Name: ttwid Value: 1%7CKExckIYEoQgIhQoxGdeq6AIaZulLvLjHG0Y3gCxJpsE%7C1731381338%7C020a615f5059cc99a320941020b410e4d7c58e49c4be5e32fb3930cc9288c887
cloud-flare-pages.pages.dev/	1970-01-21 00:57:07	Name: ft Value: 1
cloud-flare-pages.pages.dev/	1969-12-31 23:59:59	Name: v_pg Value: normal

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloud-flare-pages.pages.dev/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://cloud-flare-pages.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
security	error	URL: https://cloud-flare-pages.pages.dev/ Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
javascript	error	URL: https://cloud-flare-pages.pages.dev/ Message: Access to XMLHttpRequest at 'https://ttwid.bytedance.com/ttwid/union/register/' from origin 'https://cloud-flare-pages.pages.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ttwid.bytedance.com/ttwid/union/register/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://cloud-flare-pages.pages.dev/ Message: Access to XMLHttpRequest at 'https://ttwid.bytedance.com/ttwid/union/register/' from origin 'https://cloud-flare-pages.pages.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ttwid.bytedance.com/ttwid/union/register/ Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://cloud-flare-pages.pages.dev/ Message: Access to XMLHttpRequest at 'https://ttwid.bytedance.com/ttwid/union/register/' from origin 'https://cloud-flare-pages.pages.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://ttwid.bytedance.com/ttwid/union/register/ Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud-flare-pages.pages.dev
code.bdstatic.com
dgss0.bdstatic.com
dgss3.bdstatic.com
dss2.bdstatic.com
hao123-static.cdn.bcebos.com
lf3-short.ibytedapm.com
mon.zijieapi.com
sf3-cdn-tos.douyinstatic.com
ttwid.bytedance.com
unpkg.byted-static.com
code.bdstatic.com
dgss0.bdstatic.com
dgss3.bdstatic.com
dss2.bdstatic.com
hao123-static.cdn.bcebos.com
mon.zijieapi.com
ttwid.bytedance.com
163.181.131.217
163.181.92.235
188.114.96.3
2408:8763:0:2a2:36::2b
47.246.46.229
0d12a27253dfda80192317f0e509a6deadcdd7d21fd3c139fabb7b8b9cfce39a
6c9431be134c6dfc84464bcc9358330ba21ab54df2e83829822535d95e30338b
75d86fe3ebcf06ae66b1062661a885e63c86a5321d23bd271e2743597f504b76
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8ca93806242fcf868f434ee49ae71ec7c72e86a8f946f42567a0746cd5b1491a
968c4cc94735666437a05f4daa75a5979c6440a7e6dceefa7a83e57396800278
a37ccd355cc2221d46aa8bd3230a6197872972dc2c27810cdcd12bd31c31e5f3
dc7b9705741e9fbc9a1a201cdc29d5e4de01329d09403df0a537f3c9599e0f85
de8dc0a904961f156a431eba835832429fafada565dac0e7152e5be289cab239
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

cloud-flare-pages.pages.dev Open in urlscan Pro 188.114.96.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

23 Requests

48 %HTTPS

20 %IPv6

8 Domains

11 Subdomains

6 IPs

4 Countries

163 kBTransfer

696 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

4 Cookies

9 Console Messages

Security Headers

Indicators

cloud-flare-pages.pages.dev Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

48 %
HTTPS

20 %
IPv6

8
Domains

11
Subdomains

6
IPs

4
Countries

163 kB
Transfer

696 kB
Size

4
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!