pub-41bd2945a75e4a608d621f664b0202fc.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request outlook-web-app.html Show response pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/	287 B 549 B	933ms 864ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/outlook-web-app.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b2357eb92dac8654232996332cb4921d3b598af337dca5daf737bc388f0f3d51 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers CF-RAY 8030b904a81b83bb-MXP Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 07 Sep 2023 17:37:59 GMT ETag W/"d919274cf074094c1b911e5e8c7cb998" Last-Modified Tue, 08 Aug 2023 09:00:24 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Show response eu.starton-ipfs.com/ipfs/	378 KB 89 KB	145ms 94ms	Script text/plain	2606:4700:3035::6815:2610 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Requested by Host: pub-41bd2945a75e4a608d621f664b0202fc.r2.dev URL: https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/outlook-web-app.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:2610 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b54201b200475a2c73e1550db4c8b8f6cd3b81c022cd578223736b752dffff7 Request headers accept-language it-IT,it;q=0.9 Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 17:37:59 GMT via kong/3.2.2.1-enterprise-edition content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-kong-proxy-latency 0 x-kong-upstream-latency 5 alt-svc h3=":443"; ma=86400 server cloudflare x-ipfs-roots bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq etag W/"bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq" access-control-allow-methods GET content-type text/plain; charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AQko%2Bj%2FoItpkspMjz%2FST%2BmuhjrndMF5lc%2FXt8ImbAqCuafQqv6eS84IL1i5DpuBsag3rocc4mCuPJd0rw%2F89vS%2B04Z22RsUGQKQntmUaiBINspFgn%2BpCST7weu7VcX1HUux0gPt17FhFFqjZLrQsL2BN"}],"group":"cf-nel","max_age":604800} access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control public, max-age=29030400, immutable x-ipfs-path /ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq cf-ray 8030b90a6b34ba92-MXP access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With
GET H2	200	bafkreihlkegs4jfrn5nsdzbgagozg3yeqwvj7lfudzehgq2ovnnapwdhyy Show response eu.starton-ipfs.com/ipfs/	93 KB 36 KB	142ms 91ms	Script text/plain	2606:4700:3035::6815:2610 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://eu.starton-ipfs.com/ipfs/bafkreihlkegs4jfrn5nsdzbgagozg3yeqwvj7lfudzehgq2ovnnapwdhyy Requested by Host: pub-41bd2945a75e4a608d621f664b0202fc.r2.dev URL: https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/outlook-web-app.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:2610 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb510d2e24b16f5b21e426019d936f0485aa9facb41e4873434eab5a07d867c6 Request headers accept-language it-IT,it;q=0.9 Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers date Thu, 07 Sep 2023 17:37:59 GMT via kong/3.2.2.1-enterprise-edition content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-kong-proxy-latency 0 x-kong-upstream-latency 7 alt-svc h3=":443"; ma=86400 server cloudflare x-ipfs-roots bafkreihlkegs4jfrn5nsdzbgagozg3yeqwvj7lfudzehgq2ovnnapwdhyy etag W/"bafkreihlkegs4jfrn5nsdzbgagozg3yeqwvj7lfudzehgq2ovnnapwdhyy" access-control-allow-methods GET content-type text/plain; charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7%2B0Ess79YDkwFUcB7KGaZZUrYSesY%2Bo7xu8x6qTxYNOkgpls8IFH4yPEE0kWKt1eoo8yltVGLzAxsG6KVEhydgj2PZI%2BLj5vl0KrIbuyinyI%2FJQF0UxKNW%2Bxuh9%2FSpzOWgqPVgry36aq1Q4EMTs1mmQc"}],"group":"cf-nel","max_age":604800} access-control-expose-headers Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control public, max-age=29030400, immutable x-ipfs-path /ipfs/bafkreihlkegs4jfrn5nsdzbgagozg3yeqwvj7lfudzehgq2ovnnapwdhyy cf-ray 8030b90a6b37ba92-MXP access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	59ms 19ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-1538f" vary Accept-Encoding x-hw 1694108279.dop007.ml1.t,1694108279.cds020.ml1.hn,1694108279.cds213.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30288
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/	20 KB 7 KB	66ms 27ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1898004 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6459 last-modified Thu, 22 Jun 2023 11:16:21 GMT server cloudflare cf-cdnjs-via cfworker/r2 etag "64942d85-193b" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLYQoCUYcOJ%2FLZ21WwtVoeq%2BFLxW5zRjx3vigFnPx2ia6Zo%2Bi%2FYa%2BW6M08f%2FiABqG0IieU%2FRqZi6qbzMxT2m%2Ff2PPa9aeDDazX8ch%2FIQBK%2B%2BbbGILdJ6aOBam234h9ivgKbqotyoWJsNVrAeNeJEC70h"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8030b90c5e3b4c51-MXP expires Tue, 27 Aug 2024 17:37:59 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/	49 KB 15 KB	98ms 53ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS content-encoding br cdn-edgestorageid 1054 cdn-cachedat 08/05/2023 17:30:32 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:05 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"ce6e785579ae4cb555c9de311d1b9271" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 11aff93874097dad75524e5877b2fa7a timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 8030b90c5c99374e-MXP cdn-requestpullsuccess True
GET H2	200	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	59ms 21ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-1111d" vary Accept-Encoding x-hw 1694108279.dop009.ml1.t,1694108279.cds223.ml1.hn,1694108279.cds003.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24038
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/	36 KB 11 KB	80ms 41ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 1053 cdn-cachedat 11/15/2022 10:30:01 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:00 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag W/"5869c96cc8f19086aee625d670d741f9" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 10d07b669dd52dd9a19dc2fe99bf5946 timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 8030b90c5e6f0d6c-MXP cdn-requestpullsuccess True
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 23 KB	69ms 32ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-10fdd" vary Accept-Encoding x-hw 1694108279.dop009.ml1.t,1694108279.cds223.ml1.hn,1694108279.cds202.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	60ms 23ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 85975 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6157 last-modified Thu, 22 Jun 2023 11:16:21 GMT server cloudflare cf-cdnjs-via cfworker/r2 etag "64942d85-180d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LK7punB3qKhqtwPautbRX1feOEBS3smralKNfrn0vDQ10jMdzjc%2BNWd%2BovXqU5pq2L8P0yHHhfI%2F%2F0vn3j0llY7e06h%2FLh4AQNPEHQsmwBVgQHQb9Hek8vuwO3dIJRQq9TQrrOSAlyejeWRiEXY1BxCl"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8030b90c5e3e4c51-MXP expires Tue, 27 Aug 2024 17:37:59 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 13 KB	80ms 43ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 865 cdn-cachedat 11/25/2022 23:23:38 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.03 cdn-requestpullcode 200 server cloudflare etag W/"14d449eb8876fa55e1ef3c2cc52b0c17" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 051b1a51ec2f9929fd6cd8b981c9490c timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 8030b90c5e710d6c-MXP cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	89ms 24ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 13:48:59 GMT content-encoding gzip x-content-type-options nosniff age 13740 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 06 Sep 2024 13:48:59 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	70ms 28ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: eu.starton-ipfs.com URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/ accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Sep 2023 17:37:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 674, 718, 718 age 1701905 cdn-cachedat 2021-06-08 05:11:08 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid d57b249fbc897a386cb949167a1340aa timing-allow-origin * cdn-requestcountrycode US cf-ray 8030b90c5c434bea-MXP cdn-requestpullsuccess True
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6 Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415 Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	segoeui-regular.ttf pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/owa/auth/15.1.1591/themes/resources/	0 0	94ms 93ms	Font text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf Requested by Host: pub-41bd2945a75e4a608d621f664b0202fc.r2.dev URL: https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/outlook-web-app.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/outlook-web-app.html Origin https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36 Response headers Date Thu, 07 Sep 2023 17:37:59 GMT Content-Encoding gzip Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/html Connection keep-alive CF-RAY 8030b90c2a8c83bb-MXP

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _0x389149 function| _0x1575 function| _0x3270 object| mainLogonDiv function| $ function| jQuery function| Popper object| bootstrap function| _0xe523a function| _0x2a943f function| _0x347a7d function| _0x20e882 function| _0x2ca66a function| _0x6977 function| _0x5d83df function| _0x2088 function| _0x59b219

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://eu.starton-ipfs.com/ipfs/bafybeiaw3kx4lwjs7aohbuqt6gttme2gdter6aq6zxvgywhzyhi2z3epzq Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://pub-41bd2945a75e4a608d621f664b0202fc.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
eu.starton-ipfs.com
maxcdn.bootstrapcdn.com
pub-41bd2945a75e4a608d621f664b0202fc.r2.dev
stackpath.bootstrapcdn.com
2001:4de0:ac18::1:a:2b
2606:4700:3035::6815:2610
2606:4700::6811:190e
2606:4700::6812:323
2606:4700::6812:acf
2606:4700::6812:bcf
2a00:1450:4001:80f::200a
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9b54201b200475a2c73e1550db4c8b8f6cd3b81c022cd578223736b752dffff7
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
b2357eb92dac8654232996332cb4921d3b598af337dca5daf737bc388f0f3d51
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
eb510d2e24b16f5b21e426019d936f0485aa9facb41e4873434eab5a07d867c6