wordpress-1291242-4735129.cloudwaysapps.com Open in urlscan Pro
64.225.49.90 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://arsupport-id0033548854.bubbleapps.io/
Effective URL:
https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
Submission: On July 25 via manual (July 25th 2024, 5:25:17 am UTC) from KW — Scanned from US

Summary HTTP 33 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 6 domains to perform 33 HTTP transactions. The main IP is 64.225.49.90, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is wordpress-1291242-4735129.cloudwaysapps.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 5th 2024. Valid for: a year.

This is the only time wordpress-1291242-4735129.cloudwaysapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aramex (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700::68... 2606:4700::6812:f618	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:400d:c09::5f	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:400d:c07::5e	15169 (GOOGLE) (GOOGLE)
15	64.225.49.90 64.225.49.90	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
33	5

8 2606:4700::6812:f618 (United States)

ASN13335 (CLOUDFLARENET, US)

arsupport-id0033548854.bubbleapps.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c09::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c07::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 64.225.49.90 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 1291242.cloudwaysapps.com

wordpress-1291242-4735129.cloudwaysapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	cloudwaysapps.com wordpress-1291242-4735129.cloudwaysapps.com	130 KB
8	bubbleapps.io arsupport-id0033548854.bubbleapps.io	804 KB
2	gstatic.com fonts.gstatic.com	60 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	3 KB
0	cloudwp.dev Failed demo2.cloudwp.dev Failed
0	cloudfront.net Failed d1muf25xaso8hp.cloudfront.net Failed
33	6

	Domain	Requested by
15	wordpress-1291242-4735129.cloudwaysapps.com	arsupport-id0033548854.bubbleapps.io wordpress-1291242-4735129.cloudwaysapps.com
8	arsupport-id0033548854.bubbleapps.io	arsupport-id0033548854.bubbleapps.io
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	arsupport-id0033548854.bubbleapps.io client
0	demo2.cloudwp.dev Failed
0	d1muf25xaso8hp.cloudfront.net Failed
33	6

This site contains no links.

Subject Issuer	Validity	Valid
bubbleapps.io GTS CA 1P5	`2024-06-02` - `2024-08-31`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.cloudwaysapps.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-05` - `2025-05-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
Frame ID: 2BFA0607937DAB0A761D270C8C992650
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

| Aramex

Page URL History Show full URLs

https://arsupport-id0033548854.bubbleapps.io/ Page URL
https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

33
Requests

82 %
HTTPS

75 %
IPv6

6
Domains

6
Subdomains

5
IPs

1
Countries

997 kB
Transfer

3831 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://arsupport-id0033548854.bubbleapps.io/ Page URL
https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://demo2.cloudwp.dev/trial-tv1uuvz0/aramex/assets/imgs/favicon.png HTTP 301
https://demo2.cloudwp.dev/inactive.htm

Request Chain 22

https://demo2.cloudwp.dev/trial-tv1uuvz0/aramex/assets/imgs/favicon.png HTTP 301
https://demo2.cloudwp.dev/inactive.htm

33 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
arsupport-id0033548854.bubbleapps.io/ 13 KB
4 KB 439ms
335ms Document
text/html 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://arsupport-id0033548854.bubbleapps.io/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

1f5b42f681c4122d1c34a8938b50551d0af7921c5e1519f8f8d5ad3da5baba0c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none';
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 8a89ba61cb45c3f8-EWR
content-encoding: br
content-security-policy: frame-ancestors 'none';
content-type: text/html
date: Thu, 25 Jul 2024 05:25:12 GMT
referrer-policy: origin
server: cloudflare
vary: Accept-Encoding
x-bubble-capacity-limit: 0 ms slower
x-bubble-capacity-used: 0.108 unit-seconds used
x-bubble-perf: {"total":221.2,"percents":{"top":{"bubble_cpu":21.1,"block":78.7,"capacity_rl":0,"other_pause":0,"pre_fiber":0.7},"sub":{"pp_userdb":0,"pp_wait_userdb":0,"http_request":0,"serverjson":61.9,"appserver_cache_misses_time":0,"redis":77.5,"fiber_queue":5.2,"capacity_wait":1.9}},"counts":{"pp_userdb":0,"http_request":0,"derived_build":0,"derived_cache_attempts":8,"derived_cache_memory_misses":8,"derived_cache_redis_misses":7,"serverjson":28,"appserver_cache_attempts":1,"appserver_mem_cache_hits":0,"appserver_cache_hits":0,"appserver_cache_misses":1,"redis":135,"fiber_queue":122,"blocks":121},"misc":{"userdb_results":1,"userdb_data":206,"spent_time":7013041}}
x-frame-options: DENY
x-powered-by: Express

GET
H3 200 early.js Show response
arsupport-id0033548854.bubbleapps.io/package/early_js/05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b/ 24 KB
9 KB 35ms
34ms Script
application/javascript 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/early_js/05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b/early.js
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 450e62180e870526d437f065fa76a5d4e31517905e37a98184ef79b0fc2abd5b

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: gzip
cf-cache-status: HIT
x-bubble-perf: {"total":11.7,"percents":{"top":{"bubble_cpu":39.7,"block":43.6,"capacity_rl":0,"other_pause":0,"pre_fiber":14.4},"sub":{"pp_userdb":0,"pp_wait_userdb":0,"http_request":0,"serverjson":20.8,"appserver_cache_misses_time":0,"redis":25,"fiber_queue":4.7,"capacity_wait":11.5}},"counts":{"pp_userdb":0,"http_request":0,"derived_build":0,"serverjson":2,"appserver_cache_attempts":0,"appserver_mem_cache_hits":0,"appserver_cache_hits":0,"appserver_cache_misses":0,"redis":7,"fiber_queue":10,"blocks":9},"misc":{"userdb_results":0,"userdb_data":0,"spent_time":694162}}
age: 338034
x-powered-by: Express
x-bubble-capacity-used: 0.011 unit-seconds used
alt-svc: h3=":443"; ma=86400
content-length: 8817
server: cloudflare
etag: 05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a89ba63ed71c3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H3 200 run.css
arsupport-id0033548854.bubbleapps.io/package/run_css/f30cf233104dbb2fbbe12ad8db82c07918690a07989e956ca0ad1517924e0c7d/arsupport-id0033548854/live/index/xfalse/xfalse/ 43 KB
7 KB 35ms
34ms Stylesheet
text/css 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/run_css/f30cf233104dbb2fbbe12ad8db82c07918690a07989e956ca0ad1517924e0c7d/arsupport-id0033548854/live/index/xfalse/xfalse/run.css
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fa432447d8bca3387caac469b67984517a4e65a6ee5a842b5d5d6910215cfa55

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: br
cf-cache-status: HIT
x-bubble-perf: {"total":92.6,"percents":{"top":{"bubble_cpu":24,"block":72.2,"capacity_rl":0,"other_pause":0,"pre_fiber":1.9},"sub":{"pp_userdb":3.2,"pp_wait_userdb":0,"http_request":0,"serverjson":6.2,"appserver_cache_misses_time":0,"redis":16.8,"fiber_queue":9.5,"capacity_wait":2.6}},"counts":{"pp_userdb":1,"http_request":0,"derived_build":0,"derived_cache_attempts":2,"derived_cache_memory_misses":2,"serverjson":13,"appserver_cache_attempts":1,"appserver_mem_cache_hits":0,"appserver_cache_hits":1,"appserver_cache_misses":0,"redis":26,"fiber_queue":31,"blocks":30},"misc":{"userdb_results":1,"userdb_data":4,"spent_time":4331863}}
age: 143557
cf-polished: origSize=57620
x-powered-by: Express
x-bubble-capacity-used: 0.067 unit-seconds used
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
cf-ray: 8a89ba63ed76c3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H3 200 pre_run_jquery.js Show response
arsupport-id0033548854.bubbleapps.io/package/pre_run_jquery_js/dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff/ 88 KB
31 KB 26ms
25ms Script
application/javascript 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/pre_run_jquery_js/dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff/pre_run_jquery.js
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: gzip
cf-cache-status: HIT
x-bubble-perf: {"total":12.8,"percents":{"top":{"bubble_cpu":26.9,"block":63.2,"capacity_rl":0,"other_pause":0,"pre_fiber":8.1},"sub":{"pp_userdb":0,"pp_wait_userdb":0,"http_request":0,"serverjson":64.8,"appserver_cache_misses_time":0,"redis":30.9,"fiber_queue":4.9,"capacity_wait":10.6}},"counts":{"pp_userdb":0,"http_request":0,"derived_build":0,"serverjson":2,"appserver_cache_attempts":0,"appserver_mem_cache_hits":0,"appserver_cache_hits":0,"appserver_cache_misses":0,"redis":11,"fiber_queue":14,"blocks":13},"misc":{"userdb_results":0,"userdb_data":0,"spent_time":517573}}
age: 338034
x-powered-by: Express
x-bubble-capacity-used: 0.008 unit-seconds used
alt-svc: h3=":443"; ma=86400
content-length: 31083
server: cloudflare
etag: dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a89ba63ed77c3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H3 200 run.js Show response
arsupport-id0033548854.bubbleapps.io/package/run_js/425205a248d6bec556ddbc611c7e08929d15ed0d1818fff950a8f6a8b28714dd/xfalse/x29/ 3 MB
740 KB 43ms
42ms Script
application/javascript 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/run_js/425205a248d6bec556ddbc611c7e08929d15ed0d1818fff950a8f6a8b28714dd/xfalse/x29/run.js
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 13bb16c81d55e8538a04c8319a138b01bc90df9511cd7403f2929065f2782d6f

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: gzip
cf-cache-status: HIT
x-bubble-perf: {"total":30.7,"percents":{"top":{"bubble_cpu":27,"block":64.7,"capacity_rl":0,"other_pause":0,"pre_fiber":4.7},"sub":{"pp_userdb":13,"pp_wait_userdb":0,"http_request":0,"serverjson":7.2,"appserver_cache_misses_time":0,"redis":34.8,"fiber_queue":3.2,"capacity_wait":4.7}},"counts":{"pp_userdb":2,"http_request":0,"derived_build":0,"derived_cache_attempts":1,"derived_cache_memory_misses":1,"serverjson":2,"appserver_cache_attempts":0,"appserver_mem_cache_hits":0,"appserver_cache_hits":0,"appserver_cache_misses":0,"redis":16,"fiber_queue":23,"blocks":22},"misc":{"userdb_results":1,"userdb_data":4,"spent_time":7243763}}
age: 19008
x-powered-by: Express
x-bubble-capacity-used: 0.111 unit-seconds used
alt-svc: h3=":443"; ma=86400
content-length: 757164
server: cloudflare
etag: 425205a248d6bec556ddbc611c7e08929d15ed0d1818fff950a8f6a8b28714dd
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a89ba63ed79c3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H3 200 static.js Show response
arsupport-id0033548854.bubbleapps.io/package/static_js/78cbaa15d5334d81e4722211230e5684b255634f3fa26f697f5cee79468eb812/arsupport-id0033548854/live/index/xnull/xfalse/xfalse/xfalse/ 15 KB
6 KB 86ms
85ms Script
application/javascript 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/static_js/78cbaa15d5334d81e4722211230e5684b255634f3fa26f697f5cee79468eb812/arsupport-id0033548854/live/index/xnull/xfalse/xfalse/xfalse/static.js
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9f28eaa237d7292325ee2636614d16942710ccb81b6faab05b13eb2096c33ab6

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: gzip
cf-cache-status: HIT
x-bubble-perf: {"total":150.8,"percents":{"top":{"bubble_cpu":12.2,"block":87,"capacity_rl":0,"other_pause":0,"pre_fiber":0.9},"sub":{"pp_userdb":2,"pp_wait_userdb":0,"http_request":0,"serverjson":12.3,"appserver_cache_misses_time":0,"redis":34.5,"fiber_queue":1.2,"capacity_wait":1.2}},"counts":{"pp_userdb":2,"http_request":0,"derived_build":0,"derived_cache_attempts":4,"derived_cache_memory_misses":4,"derived_cache_redis_misses":1,"serverjson":16,"appserver_cache_attempts":1,"appserver_mem_cache_hits":0,"appserver_cache_hits":1,"appserver_cache_misses":0,"redis":34,"fiber_queue":35,"blocks":34},"misc":{"userdb_results":1,"userdb_data":4,"spent_time":7769638}}
age: 143557
x-powered-by: Express
x-bubble-capacity-used: 0.12 unit-seconds used
alt-svc: h3=":443"; ma=86400
content-length: 5393
server: cloudflare
etag: 78cbaa15d5334d81e4722211230e5684b255634f3fa26f697f5cee79468eb812
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a89ba63ed7bc3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H3 200 dynamic.js Show response
arsupport-id0033548854.bubbleapps.io/package/dynamic_js/3afbba620ff7febe976e09cfc498210c2bc8391f36de411220111546316d124e/arsupport-id0033548854/live/index/xnull/xfalse/xfalse/en_us/xfalse/xfalse/ 9 KB
5 KB 86ms
86ms Script
application/javascript 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/package/dynamic_js/3afbba620ff7febe976e09cfc498210c2bc8391f36de411220111546316d124e/arsupport-id0033548854/live/index/xnull/xfalse/xfalse/en_us/xfalse/xfalse/dynamic.js
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d46b9f926fa9f81d0ed7352a19c5f198934cf145697d2896e6997afd241aa97b

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:12 GMT
content-encoding: gzip
cf-cache-status: HIT
x-bubble-perf: {"total":66.2,"percents":{"top":{"bubble_cpu":13.3,"block":83.8,"capacity_rl":0,"other_pause":0,"pre_fiber":3},"sub":{"pp_userdb":0,"pp_wait_userdb":0,"http_request":0,"serverjson":7.5,"appserver_cache_misses_time":0,"redis":69.4,"fiber_queue":5.1,"capacity_wait":7.7}},"counts":{"pp_userdb":0,"http_request":0,"derived_build":0,"derived_cache_attempts":2,"derived_cache_memory_misses":2,"serverjson":4,"appserver_cache_attempts":1,"appserver_mem_cache_hits":0,"appserver_cache_hits":1,"appserver_cache_misses":0,"redis":12,"fiber_queue":15,"blocks":14},"misc":{"userdb_results":0,"userdb_data":0,"spent_time":1318965}}
age: 143557
x-powered-by: Express
x-bubble-capacity-used: 0.02 unit-seconds used
alt-svc: h3=":443"; ma=86400
content-length: 3891
server: cloudflare
etag: 3afbba620ff7febe976e09cfc498210c2bc8391f36de411220111546316d124e
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a89ba63ed7dc3f8-EWR
x-bubble-capacity-limit: 0 ms slower

GET
H2 200 css
fonts.googleapis.com/ 16 KB
2 KB 79ms
31ms Stylesheet
text/css 2607:f8b0:400d:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:regular%7COpen+Sans:600%7COpen+Sans:700

Requested by

Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/package/early_js/05ae9fe83d6b755291132aab9d325d70918aafd336da1bd91a41a31c8b25734b/early.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3ff27e82d78a471905edf58f54d412011e0f3b07cb596b50d425151e7df84404

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 25 Jul 2024 04:44:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 Jul 2024 05:25:13 GMT

GET
H3 200 data Show response
arsupport-id0033548854.bubbleapps.io/api/1.1/init/ 283 B
1006 B 178ms
178ms XHR
text/plain 2606:4700::6812:f618
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://arsupport-id0033548854.bubbleapps.io/api/1.1/init/data?location=https%3A%2F%2Farsupport-id0033548854.bubbleapps.io%2F
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:f618 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 65da7dbe8c2606f07f8026ab05c2232d5108c336f950bc85381955023f80e0a5

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
cf-cache-status: DYNAMIC
x-bubble-perf: {"total":72.1,"percents":{"top":{"bubble_cpu":10.7,"block":87.5,"capacity_rl":0,"other_pause":0,"pre_fiber":1.7},"sub":{"pp_userdb":1.4,"pp_wait_userdb":0,"http_request":0,"serverjson":17.3,"appserver_cache_misses_time":0,"redis":22.1,"fiber_queue":1.7,"capacity_wait":2}},"counts":{"pp_userdb":1,"http_request":0,"derived_build":0,"derived_cache_attempts":1,"derived_cache_memory_misses":1,"derived_cache_redis_misses":1,"serverjson":4,"appserver_cache_attempts":0,"appserver_mem_cache_hits":0,"appserver_cache_hits":0,"appserver_cache_misses":0,"redis":22,"fiber_queue":26,"blocks":25},"misc":{"userdb_results":0,"userdb_data":0,"spent_time":6151769}}
server: cloudflare
x-powered-by: Express
x-bubble-capacity-used: 0.095 unit-seconds used
cf-ray: 8a89ba643da3c3f8-EWR
alt-svc: h3=":443"; ma=86400
x-bubble-capacity-limit: 0 ms slower

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 143ms
23ms Font
font/woff2 2607:f8b0:400d:c07::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:regular%7COpen+Sans:600%7COpen+Sans:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c07::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://arsupport-id0033548854.bubbleapps.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:55:37 GMT
x-content-type-options: nosniff
age: 23376
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Jul 2025 22:55:37 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

POST hi
arsupport-id0033548854.bubbleapps.io/user/ 0
0

GET
H2 200 Primary Request / Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/ 634 B
585 B 52ms
19ms Document
text/html 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
Requested by: Host: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/package/pre_run_jquery_js/dee903a9e36db713e4c86d0cdd96d921e37be0c1293ed8dee29e2e4d7713b9ff/pre_run_jquery.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 36eca8c152234c9df98fb97c9abae4e3d44f6fcc6e00147a94d250ae4e55f378

Request headers

Referer: https://arsupport-id0033548854.bubbleapps.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=0, s-maxage=2592000
content-encoding: gzip
content-length: 345
content-type: text/html; charset=UTF-8
date: Thu, 25 Jul 2024 05:25:13 GMT
expires: Thu, 25 Jul 2024 05:25:13 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
x-robots-tag: noindex, nofollow

GET https%3A%2F%2F6daeedfa54258a94cb70720b81ca127f.cdn.bubble.io%2Ff1530294839424x143528842134401200%2FIcon-no-clearspace.png
d1muf25xaso8hp.cloudfront.net/ 0
0

GET
H2 200 main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 197 KB
66 KB 23ms
22ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 6be58f750389ffc8ab515ff2ab02b4f4bddc1cde0a09613fa123b86353df2dfc

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:41 GMT
server: nginx
etag: W/"6697f0fd-312aa"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
905 B 77ms
32ms Stylesheet
text/css 2607:f8b0:400d:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Titillium+Web:wght@200;300;400;600;700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c09::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

217db71d5a2827c2f4ffab9114c84aacbddb59825c3713a537b4fda604a0c706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 25 Jul 2024 04:06:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 25 Jul 2024 05:25:13 GMT

GET
H2 200 755.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 88 KB
31 KB 15ms
14ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/755.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: ee1aecfa9469f4bd2eb39f877fcc31e52ef73b7ba4e387042ef0075a58b3b931

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-1603f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 373.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 3 KB
1 KB 16ms
16ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/373.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 0fffff6cb43b14abdcae68d2cc56ebfeefa2428da9acf9ee81f563a8e9c4997a

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-d9e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 main.json Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/ 2 KB
942 B 16ms
15ms XHR
application/json 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/main.json
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/755.main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 089ff2b8a32512d26c49f3ff17ed6afeba40de9eea3e532bb946759dfcb27684

Request headers

Accept: */*
Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:47 GMT
server: nginx
age: 0
etag: "9fe-61d73f14c06c0-gzip"
vary: Accept-Encoding
x-cache: MISS
content-type: application/json
cache-control: max-age=0, s-maxage=2592000
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 651
expires: Thu, 25 Jul 2024 05:25:13 GMT

GET
H2 404 ar.json Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/lang/ 16 B
141 B 16ms
15ms XHR
text/html 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/lang/ar.json
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/755.main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41

Request headers

Accept: */*
Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
server: nginx
age: 0
x-robots-tag: noindex, nofollow
content-length: 16
x-cache: MISS
content-type: text/html; charset=UTF-8

GET
H2 200 NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
fonts.gstatic.com/s/titilliumweb/v17/ 12 KB
13 KB 68ms
23ms Font
font/woff2 2607:f8b0:400d:c07::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v17/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Titillium+Web:wght@200;300;400;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c07::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://wordpress-1291242-4735129.cloudwaysapps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 24 Jul 2024 22:49:17 GMT
x-content-type-options: nosniff
age: 23756
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12372
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 20:30:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Jul 2025 22:49:17 GMT

GET

inactive.htm
demo2.cloudwp.dev/
Redirect Chain

https://demo2.cloudwp.dev/trial-tv1uuvz0/aramex/assets/imgs/favicon.png
https://demo2.cloudwp.dev/inactive.htm

0
0

GET
H2 200 en.json Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/lang/ 2 KB
935 B 14ms
14ms XHR
application/json 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/lang/en.json
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/755.main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 97800bd73acdc5559e315389590d3ca69bbe021c70692ef11ac556c68e8682ac

Request headers

Accept: */*
Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:13 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:41 GMT
server: nginx
age: 0
etag: "78a-61d73f0f07940-gzip"
vary: Accept-Encoding
x-cache: MISS
content-type: application/json
cache-control: max-age=0, s-maxage=2592000
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 644
expires: Thu, 25 Jul 2024 05:25:13 GMT

GET

inactive.htm
demo2.cloudwp.dev/
Redirect Chain

https://demo2.cloudwp.dev/trial-tv1uuvz0/aramex/assets/imgs/favicon.png
https://demo2.cloudwp.dev/inactive.htm

0
0

GET
H2 200 390.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 4 KB
2 KB 11ms
10ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/390.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: de6a55092cba78e1d149ad8c5859cba2d9fabefa2df040fbe495ae47e9f0515e

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-10b1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 62.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 59 KB
12 KB 12ms
11ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/62.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 8041d8259f8406dec8916bf08ff0ec0d601e187f0d15a4e315415fa758e1654c

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-ec0d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 673.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 2 KB
1 KB 20ms
19ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/673.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 685310e8af07d887161079d7059804cca2422c82c8e755f8d164f18c3dc2c6a5

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-9f3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 825.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 17 KB
6 KB 21ms
20ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/825.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: ac0f714c47fd74bf6d790035e2fd96911311e0c1609502c600640569a438170e

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:41 GMT
server: nginx
etag: W/"6697f0fd-42b9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 789.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 6 KB
2 KB 21ms
21ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/789.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: a299d125fd86893e8b4c547db5f9431518d45594e5596583a4f3f37fba69f39d

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-1678"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 352.main.min.js Show response
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/ 3 KB
2 KB 21ms
21ms Script
application/javascript 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/352.main.min.js
Requested by: Host: wordpress-1291242-4735129.cloudwaysapps.com
URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/js/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 6670db93276fd9cad301be3295d57e478da3b19a7746d86c167b369f0cadf52b

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-c13"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 Logo.svg
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/image/ 7 KB
2 KB 11ms
11ms Image
image/svg+xml 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/image/Logo.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: e0447aa04943d0d047baf922ce6f286da4e50d62113aa19505f75705a9a46773

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:47 GMT
server: nginx
etag: W/"6697f103-1c70"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET
H2 200 schedule_pickup.svg
wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/image/ 2 KB
1 KB 11ms
10ms Image
image/svg+xml 64.225.49.90
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/app-assets/image/schedule_pickup.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 64.225.49.90 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: 1291242.cloudwaysapps.com
Software: nginx /
Resource Hash: 2a5e1fdc8e264327be71c3063cc6bf1dd8a618576310a5d26dc31ba8d6f83616

Request headers

Referer: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 05:25:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Jul 2024 16:27:46 GMT
server: nginx
etag: W/"6697f102-6ef"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000
x-robots-tag: noindex, nofollow

GET NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v17/ 0
0

GET NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v17/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: arsupport-id0033548854.bubbleapps.io
URL: https://arsupport-id0033548854.bubbleapps.io/user/hi

Domain: d1muf25xaso8hp.cloudfront.net
URL: https://d1muf25xaso8hp.cloudfront.net/https%3A%2F%2F6daeedfa54258a94cb70720b81ca127f.cdn.bubble.io%2Ff1530294839424x143528842134401200%2FIcon-no-clearspace.png?w=128&h=&auto=compress&dpr=1&fit=max

Domain: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/inactive.htm

Domain: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/inactive.htm

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/titilliumweb/v17/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/titilliumweb/v17/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aramex (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkpostal

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
arsupport-id0033548854.bubbleapps.io/	1970-01-20 22:22:24	Name: arsupport-id0033548854_live_u2main Value: bus\|1721885112724x531634775432470140\|1721885112760x449717994560748540
arsupport-id0033548854.bubbleapps.io/	1970-01-20 22:22:24	Name: arsupport-id0033548854_live_u2main.sig Value: 7T1O3zz1b9RCuYwwJ5mNZO7hnwE
arsupport-id0033548854.bubbleapps.io/	1969-12-31 23:59:59	Name: arsupport-id0033548854_u1main Value: 1721885112724x531634775432470140

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://wordpress-1291242-4735129.cloudwaysapps.com/aramex/ar/includes/lang/ar.json Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'none';
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

arsupport-id0033548854.bubbleapps.io
d1muf25xaso8hp.cloudfront.net
demo2.cloudwp.dev
fonts.googleapis.com
fonts.gstatic.com
wordpress-1291242-4735129.cloudwaysapps.com
arsupport-id0033548854.bubbleapps.io
d1muf25xaso8hp.cloudfront.net
demo2.cloudwp.dev
fonts.gstatic.com
2606:4700::6812:f618
2607:f8b0:400d:c07::5e
2607:f8b0:400d:c09::5f
64.225.49.90
089ff2b8a32512d26c49f3ff17ed6afeba40de9eea3e532bb946759dfcb27684
0fffff6cb43b14abdcae68d2cc56ebfeefa2428da9acf9ee81f563a8e9c4997a
13bb16c81d55e8538a04c8319a138b01bc90df9511cd7403f2929065f2782d6f
1f5b42f681c4122d1c34a8938b50551d0af7921c5e1519f8f8d5ad3da5baba0c
217db71d5a2827c2f4ffab9114c84aacbddb59825c3713a537b4fda604a0c706
2a5e1fdc8e264327be71c3063cc6bf1dd8a618576310a5d26dc31ba8d6f83616
36eca8c152234c9df98fb97c9abae4e3d44f6fcc6e00147a94d250ae4e55f378
3ff27e82d78a471905edf58f54d412011e0f3b07cb596b50d425151e7df84404
450e62180e870526d437f065fa76a5d4e31517905e37a98184ef79b0fc2abd5b
557f6d0883db85be712c3a77baa38875ddf99ecbdfd6fec98e5c0b1f7a0e1532
65da7dbe8c2606f07f8026ab05c2232d5108c336f950bc85381955023f80e0a5
6670db93276fd9cad301be3295d57e478da3b19a7746d86c167b369f0cadf52b
685310e8af07d887161079d7059804cca2422c82c8e755f8d164f18c3dc2c6a5
6be58f750389ffc8ab515ff2ab02b4f4bddc1cde0a09613fa123b86353df2dfc
8041d8259f8406dec8916bf08ff0ec0d601e187f0d15a4e315415fa758e1654c
8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41
97800bd73acdc5559e315389590d3ca69bbe021c70692ef11ac556c68e8682ac
9f28eaa237d7292325ee2636614d16942710ccb81b6faab05b13eb2096c33ab6
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
a299d125fd86893e8b4c547db5f9431518d45594e5596583a4f3f37fba69f39d
ac0f714c47fd74bf6d790035e2fd96911311e0c1609502c600640569a438170e
d46b9f926fa9f81d0ed7352a19c5f198934cf145697d2896e6997afd241aa97b
de6a55092cba78e1d149ad8c5859cba2d9fabefa2df040fbe495ae47e9f0515e
e0447aa04943d0d047baf922ce6f286da4e50d62113aa19505f75705a9a46773
ee1aecfa9469f4bd2eb39f877fcc31e52ef73b7ba4e387042ef0075a58b3b931
fa432447d8bca3387caac469b67984517a4e65a6ee5a842b5d5d6910215cfa55

wordpress-1291242-4735129.cloudwaysapps.com Open in urlscan Pro 64.225.49.90 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

33 Requests

82 %HTTPS

75 %IPv6

6 Domains

6 Subdomains

5 IPs

1 Countries

997 kBTransfer

3831 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

wordpress-1291242-4735129.cloudwaysapps.com Open in urlscan Pro
64.225.49.90 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

82 %
HTTPS

75 %
IPv6

6
Domains

6
Subdomains

5
IPs

1
Countries

997 kB
Transfer

3831 kB
Size

3
Cookies

33 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!