preferringtunexs.z13.web.core.windows.net Open in urlscan Pro
57.150.87.132 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://preferringtunexs.z13.web.core.windows.net/
Submission: On December 11 via api (December 11th 2024, 10:58:11 am UTC) from JP — Scanned from JP

Summary HTTP 31 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 31 HTTP transactions. The main IP is 57.150.87.132, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is preferringtunexs.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on October 27th 2024. Valid for: 6 months.

This is the only time preferringtunexs.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
28	57.150.87.132 57.150.87.132	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	65.9.37.128 65.9.37.128	16509 (AMAZON-02) (AMAZON-02)
1	44.193.236.243 44.193.236.243	14618 (AMAZON-AES) (AMAZON-AES)
1	104.21.53.38 104.21.53.38	13335 (CLOUDFLAR...) (CLOUDFLARENET)
31	5

28 57.150.87.132 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

preferringtunexs.z13.web.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.37.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-37-128.nrt12.r.cloudfront.net

d2fuc4clr7gvcn.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.193.236.243 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-193-236-243.compute-1.amazonaws.com

track.gaug.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.53.38 (None, )

ASN13335 (CLOUDFLARENET, US)

userstatics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	windows.net preferringtunexs.z13.web.core.windows.net	2 MB
1	userstatics.com userstatics.com — Cisco Umbrella Rank: 190222	916 B
1	gaug.es track.gaug.es — Cisco Umbrella Rank: 278607	389 B
1	cloudfront.net d2fuc4clr7gvcn.cloudfront.net	2 KB
31	4

	Domain	Requested by
28	preferringtunexs.z13.web.core.windows.net	preferringtunexs.z13.web.core.windows.net
1	userstatics.com	preferringtunexs.z13.web.core.windows.net
1	track.gaug.es	preferringtunexs.z13.web.core.windows.net
1	d2fuc4clr7gvcn.cloudfront.net	preferringtunexs.z13.web.core.windows.net
31	4

This site contains no links.

Subject Issuer	Validity	Valid
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 08	`2024-10-27` - `2025-04-25`	6 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
*.gaug.es Sectigo RSA Domain Validation Secure Server CA	`2024-03-03` - `2025-04-03`	a year	crt.sh
userstatics.com WE1	`2024-11-19` - `2025-02-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://preferringtunexs.z13.web.core.windows.net/
Frame ID: 20F673448F40B9C63961A79EA3A5CDBA
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

セキュリティセンター

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

31
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1738 kB
Transfer

1730 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

31 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
preferringtunexs.z13.web.core.windows.net/ 22 KB
22 KB 665ms
166ms Document
text/html 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f13840c053a2ed9fd86710c2852a8f98bebbb73e17faf6a89a9163b7a6208aec

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Content-Length: 22252
Content-MD5: gRynOVO4a3KTjc4OTGNiAg==
Content-Type: text/html
Date: Wed, 11 Dec 2024 10:58:04 GMT
ETag: "0x8DD19D14FFA9E0D"
Last-Modified: Wed, 11 Dec 2024 10:48:13 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: e870a3f0-101e-008e-52bb-4b33cc000000
x-ms-version: 2018-03-28

GET
H/1.1 404
The requested content does not exist. script.html
preferringtunexs.z13.web.core.windows.net/ 0
0 171ms
165ms Script
text/html 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/script.html
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

x-ms-request-id: e870a4bd-101e-008e-19bb-4b33cc000000
Content-Length: 321
x-ms-version: 2018-03-28
Date: Wed, 11 Dec 2024 10:58:04 GMT
Content-Type: text/html
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound

GET
H/1.1 200
OK tapa.css
preferringtunexs.z13.web.core.windows.net/css/ 21 KB
21 KB 337ms
166ms Stylesheet
text/css 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/css/tapa.css
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 07fc524217d5c583d668173ff0c6437631317a949824c6d58dd93b2971490705

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: VGt4qbCcgGQaskzbhA3dIA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D14FD71182"
x-ms-request-id: e870a563-101e-008e-37bb-4b33cc000000
Accept-Ranges: bytes
Content-Length: 21423
Date: Wed, 11 Dec 2024 10:58:04 GMT
Content-Type: text/css
Last-Modified: Wed, 11 Dec 2024 10:48:13 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK bootstrap.min.css
preferringtunexs.z13.web.core.windows.net/css/ 216 KB
216 KB 508ms
167ms Stylesheet
text/css 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/css/bootstrap.min.css
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0cfd94f6df34dc8ea6b0bf28cfdb2541582fb1c843c1437963ee0c1b7c4abf1a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: JR2j2IcYBt1ZCUI0taJMMw==
x-ms-version: 2018-03-28
ETag: "0x8DD19D150A81C16"
x-ms-request-id: e870a61e-101e-008e-69bb-4b33cc000000
Accept-Ranges: bytes
Content-Length: 220820
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/css
Last-Modified: Wed, 11 Dec 2024 10:48:14 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK jquery.min.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 83 KB
83 KB 648ms
162ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/jquery.min.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: IMEpvttKJtsC/A9U0CbD9Q==
x-ms-version: 2018-03-28
ETag: "0x8DD19D154480907"
x-ms-request-id: fe465f38-d01e-0017-0ebb-4b4c71000000
Accept-Ranges: bytes
Content-Length: 84817
Date: Wed, 11 Dec 2024 10:58:04 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK bootstrap.min.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 59 KB
59 KB 651ms
163ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/bootstrap.min.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://preferringtunexs.z13.web.core.windows.net
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: AtIjOT4AwnPv3LGt6PT4sQ==
x-ms-version: 2018-03-28
ETag: "0x8DD19D153BD5520"
x-ms-request-id: 9cd93932-f01e-00cb-1dbb-4be62f000000
Accept-Ranges: bytes
Content-Length: 60044
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK font-awesome.min.css
preferringtunexs.z13.web.core.windows.net/css/ 27 KB
27 KB 633ms
162ms Stylesheet
text/css 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/css/font-awesome.min.css
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: /RYJ65fnOWg6zyMSD9b2yQ==
x-ms-version: 2018-03-28
ETag: "0x8DD19D14FD675E5"
x-ms-request-id: 1b40c571-e01e-00b5-15bb-4b7668000000
Accept-Ranges: bytes
Content-Length: 27428
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/css
Last-Modified: Wed, 11 Dec 2024 10:48:13 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK esc.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 99 B
474 B 658ms
165ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/esc.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 36c93ecca4ea10ed850a8b04465a4141f6afc135419d644181e63a98da87a376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: iUrzbsNhGSYaNc4F36ax0A==
x-ms-version: 2018-03-28
ETag: "0x8DD19D153EF9E35"
x-ms-request-id: c1953815-301e-0052-05bb-4b9992000000
Accept-Ranges: bytes
Content-Length: 99
Date: Wed, 11 Dec 2024 10:58:04 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK flscn.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 269 B
645 B 659ms
166ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/flscn.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 34ccdb50687c38ca7f6f04c46aaba862b1e93f6bd1ab158915a4ae1034f2e65e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: xjjfoiycBhbF11wUIQo4gQ==
x-ms-version: 2018-03-28
ETag: "0x8DD19D154329D48"
x-ms-request-id: ded0367b-501e-008f-5bbb-4b6c10000000
Accept-Ranges: bytes
Content-Length: 269
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK main.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 2 KB
3 KB 826ms
166ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/main.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 3616cf46b53ecac41813d66874380a99715b0b31baf1c27c5db0ba320b9369c8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: 4P0SSm59PAXFMP9OdrB0ZA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D154479454"
x-ms-request-id: c195385b-301e-0052-43bb-4b9992000000
Accept-Ranges: bytes
Content-Length: 2193
Date: Wed, 11 Dec 2024 10:58:04 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK customone.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 1 KB
1 KB 827ms
166ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/customone.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 50bcea5aaf56d024c4d6741671a5e0c4175fe157e91ad2c95c802de28952aa77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: H0lsQW23cGuHO0XFgq+UfQ==
x-ms-version: 2018-03-28
ETag: "0x8DD19D153B45E81"
x-ms-request-id: ded03710-501e-008f-69bb-4b6c10000000
Accept-Ranges: bytes
Content-Length: 1095
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:19 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK customtwo.js Show response
preferringtunexs.z13.web.core.windows.net/js/ 1 KB
1 KB 945ms
157ms Script
text/javascript 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/js/customtwo.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 6ae72c7eba732fb11211c91a5225a55df7922429b4cf972580dd606139c802fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: ZESRhB/rQ8V8jKzHECS4Gw==
x-ms-version: 2018-03-28
ETag: "0x8DD19D153C6C069"
x-ms-request-id: 1b40c66b-e01e-00b5-7cbb-4b7668000000
Accept-Ranges: bytes
Content-Length: 1071
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: text/javascript
Last-Modified: Wed, 11 Dec 2024 10:48:20 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK f24.png
preferringtunexs.z13.web.core.windows.net/images/ 435 KB
436 KB 168ms
167ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/f24.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c0dc29d9f2dda9337b4f64ad32a18910301e16a3b5e510b2dc50fc3aa6856a05

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: FwMeNdYGQWMItsTAeBOEnA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D152539C9F"
x-ms-request-id: 9cd93a19-f01e-00cb-6fbb-4be62f000000
Accept-Ranges: bytes
Content-Length: 445900
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:17 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK mnc.png
preferringtunexs.z13.web.core.windows.net/images/ 187 B
557 B 167ms
166ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/mnc.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: JxAhz6RZQJeBhL4EiYQf0w==
x-ms-version: 2018-03-28
ETag: "0x8DD19D152441DA8"
x-ms-request-id: c19538b2-301e-0052-15bb-4b9992000000
Accept-Ranges: bytes
Content-Length: 187
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:17 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK msmm.png
preferringtunexs.z13.web.core.windows.net/images/ 168 B
538 B 165ms
164ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/msmm.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: rLBevNX0iPyZFpz/ArbdBA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D1527AA7B3"
x-ms-request-id: c1953935-301e-0052-13bb-4b9992000000
Accept-Ranges: bytes
Content-Length: 168
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:17 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK set.png
preferringtunexs.z13.web.core.windows.net/images/ 364 B
734 B 161ms
160ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/set.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: 4UTDN4CQCHyM4SmjDLbLTg==
x-ms-version: 2018-03-28
ETag: "0x8DD19D153086563"
x-ms-request-id: fe466071-d01e-0017-2abb-4b4c71000000
Accept-Ranges: bytes
Content-Length: 364
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:18 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK vsc.png
preferringtunexs.z13.web.core.windows.net/images/ 722 B
1 KB 158ms
157ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/vsc.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: QtjyzBrldZwjafJV8268Aw==
x-ms-version: 2018-03-28
ETag: "0x8DD19D15385BAD7"
x-ms-request-id: 1b40c72d-e01e-00b5-30bb-4b7668000000
Accept-Ranges: bytes
Content-Length: 722
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:19 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK scn.png
preferringtunexs.z13.web.core.windows.net/images/ 6 KB
6 KB 166ms
165ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/scn.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 9e3f599d1db72217010598a7411f62b877558b5f023db4754333a32328b8f893

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: qqM40Edog1JLsf0NAhKy7Q==
x-ms-version: 2018-03-28
ETag: "0x8DD19D152AF5F01"
x-ms-request-id: e870a8e9-101e-008e-0abb-4b33cc000000
Accept-Ranges: bytes
Content-Length: 6015
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:18 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK bg1.jpg
preferringtunexs.z13.web.core.windows.net/images/ 280 KB
280 KB 168ms
167ms Image
image/jpeg 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/bg1.jpg
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: e8576535330b0db1f9a66189966f34766019a4fa9e93bc6dacce0f26d8d34bc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: yxl6trGq6HHwc+uAIegNVA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D151CB093B"
x-ms-request-id: ded03867-501e-008f-25bb-4b6c10000000
Accept-Ranges: bytes
Content-Length: 286787
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/jpeg
Last-Modified: Wed, 11 Dec 2024 10:48:16 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK bel.png
preferringtunexs.z13.web.core.windows.net/images/ 276 B
646 B 158ms
157ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/bel.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4c1606563842cce5f1788329d4417ae3618b33c6365c56a7122439b6ab45c977

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: dhbZbDiDAeORZTZH4fXwVw==
x-ms-version: 2018-03-28
ETag: "0x8DD19D15154D7A1"
x-ms-request-id: 1b40c79e-e01e-00b5-19bb-4b7668000000
Accept-Ranges: bytes
Content-Length: 276
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:15 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK dfs.png
preferringtunexs.z13.web.core.windows.net/images/ 35 KB
35 KB 161ms
161ms Image
image/png 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/dfs.png
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 426eec34428ca37958c3697503680648f7d9658ae0fe6300e80ddc17797ceb85

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: JfsbA2pljTsso1kDFIO3sg==
x-ms-version: 2018-03-28
ETag: "0x8DD19D151AEA07F"
x-ms-request-id: fe4660d9-d01e-0017-08bb-4b4c71000000
Accept-Ranges: bytes
Content-Length: 35689
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/png
Last-Modified: Wed, 11 Dec 2024 10:48:16 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK re.gif
preferringtunexs.z13.web.core.windows.net/images/ 14 KB
15 KB 165ms
165ms Image
image/gif 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/re.gif
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: b8t44M15M6cO6izwcfghGA==
x-ms-version: 2018-03-28
ETag: "0x8DD19D152B82EB9"
x-ms-request-id: e870a9a7-101e-008e-37bb-4b33cc000000
Accept-Ranges: bytes
Content-Length: 14751
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/gif
Last-Modified: Wed, 11 Dec 2024 10:48:18 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 200
OK console.gif
preferringtunexs.z13.web.core.windows.net/images/ 47 KB
47 KB 305ms
165ms Image
image/gif 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferringtunexs.z13.web.core.windows.net/images/console.gif
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 550aa050af2cb6f17795cf53e94df6acba687b7312e41db48a6adf55cbf707f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Content-MD5: fwve/uyKKBLlIJa0se5v5Q==
x-ms-version: 2018-03-28
ETag: "0x8DD19D1519395D0"
x-ms-request-id: c195398f-301e-0052-62bb-4b9992000000
Accept-Ranges: bytes
Content-Length: 48081
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: image/gif
Last-Modified: Wed, 11 Dec 2024 10:48:16 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
DATA 200
OK truncated
/ 349 B
0 Image
text/plain

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/plain;charset=US-ASCII

GET
H/1.1 206
Partial Content beep.mp3
preferringtunexs.z13.web.core.windows.net/media/ 8 KB
9 KB 162ms
161ms Media
audio/mpeg 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/media/beep.mp3
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Request headers

Referer: https://preferringtunexs.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

x-ms-version: 2018-03-28
ETag: "0x8DD19D1545D4DD0"
Content-Range: bytes 0-8404/8405
x-ms-request-id: 9cd93bdb-f01e-00cb-18bb-4be62f000000
Accept-Ranges: bytes
Content-Length: 8405
Date: Wed, 11 Dec 2024 10:58:06 GMT
Content-Type: audio/mpeg
Last-Modified: Wed, 11 Dec 2024 10:48:21 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H/1.1 206
Partial Content apked.mp4
preferringtunexs.z13.web.core.windows.net/media/ 466 KB
467 KB 162ms
161ms Media
video/mp4 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/media/apked.mp4
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 8be187ec77c0ddac06c26655d88e78b255950f0b24fa084d306a10be19fe4113

Request headers

Referer: https://preferringtunexs.z13.web.core.windows.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

x-ms-version: 2018-03-28
ETag: "0x8DD19D154A6AE55"
Content-Range: bytes 0-477352/477353
x-ms-request-id: 1b40c82b-e01e-00b5-1ebb-4b7668000000
Accept-Ranges: bytes
Content-Length: 477353
Date: Wed, 11 Dec 2024 10:58:05 GMT
Content-Type: video/mp4
Last-Modified: Wed, 11 Dec 2024 10:48:21 GMT
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0

GET
H2 200 track.js Show response
d2fuc4clr7gvcn.cloudfront.net/ 4 KB
2 KB 20ms
4ms Script
application/javascript 65.9.37.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2fuc4clr7gvcn.cloudfront.net/track.js
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.37.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-37-128.nrt12.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

content-encoding: gzip
etag: W/"65f04ae5-ef5"
age: 85518
via: 1.1 e6b8e88b8ad705f6b48fe421dbc555ee.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: VEeMTMWblQpilYHBRkwqQ46B0DLJOfwBQykS47q5fEF7UNDZR3QLCQ==
date: Tue, 10 Dec 2024 11:12:49 GMT
content-type: application/javascript
last-modified: Tue, 12 Mar 2024 12:30:29 GMT
server: nginx/1.10.3 (Ubuntu)
x-amz-cf-pop: NRT12-C5
vary: Accept-Encoding

GET
H/1.1 200
OK track.gif
track.gaug.es/ 35 B
389 B 682ms
173ms Image
image/gif 44.193.236.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.gaug.es/track.gif?h[site_id]=6753a70a01dba119064517a7&h[resource]=https%3A%2F%2Fpreferringtunexs.z13.web.core.windows.net%2F&h[referrer]=&h[title]=%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3%E3%82%BB%E3%83%B3%E3%82%BF%E3%83%BC&h[user_agent]=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F131.0.0.0%20Safari%2F537.36&h[unique]=1&h[unique_hour]=1&h[unique_day]=1&h[unique_month]=1&h[unique_year]=1&h[screenx]=1600&h[browserx]=1600&h[browsery]=1200&timestamp=1733914686148

Requested by

Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.193.236.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-193-236-243.compute-1.amazonaws.com

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
Connection: keep-alive
X-Content-Type-Options: nosniff
Expires: Sat, 25 Nov 2000 05:00:00 GMT
Content-Length: 35
Date: Wed, 11 Dec 2024 10:58:06 GMT
Content-Type: image/gif
Last-Modified: Wed, 11 Dec 2024 10:58:06 GMT
Server: nginx/1.10.3 (Ubuntu)

GET
H/1.1 404
The requested content does not exist. w3
preferringtunexs.z13.web.core.windows.net/ 321 B
629 B 166ms
165ms Other
text/html 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/w3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 50e806703066d2cf867707c6504505ab5f4b8fa72dcfa517039763a488b575e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

x-ms-request-id: ded03a64-501e-008f-04bb-4b6c10000000
Content-Length: 321
x-ms-version: 2018-03-28
Date: Wed, 11 Dec 2024 10:58:06 GMT
Content-Type: text/html
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound

GET
H3 200 script.js Show response
userstatics.com/get/ 133 B
916 B 294ms
274ms Script
text/javascript 104.21.53.38
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://userstatics.com/get/script.js?referrer=https://preferringtunexs.z13.web.core.windows.net/
Requested by: Host: preferringtunexs.z13.web.core.windows.net
URL: https://preferringtunexs.z13.web.core.windows.net/js/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.53.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.2.1
Resource Hash: df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s5altMs8U%2BG5vbiSkrf2znSkYgZCTqiHqdj%2BQS8hCzBEmDdLzg3sJqQjorOi9XOi7mZS2xMJwq1Agn4gYI508hBdrxD2P0k8UL9Y9IEwur2Rynj1ngPCQGNYrjeFBrYPCXA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1794&min_rtt=1241&rtt_var=822&sent=13&recv=12&lost=0&retrans=0&sent_bytes=4248&recv_bytes=5728&delivery_rate=991&cwnd=12000&unsent_bytes=0&cid=df3231fa18ad12a7&ts=281&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 11 Dec 2024 10:58:07 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
priority: u=3,i=?0
access-control-allow-headers: X-Requested-With,content-type
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8f04f52a2a83f67d-NRT
access-control-allow-origin: https://preferringtunexs.z13.web.core.windows.net
x-powered-by: PHP/8.2.1
server: cloudflare

GET
H/1.1 404
The requested content does not exist. w3.html
preferringtunexs.z13.web.core.windows.net/ 321 B
629 B 165ms
165ms Other
text/html 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/w3.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2bc7863746def2ac1986bff7aea7004e94efd68c9dc360f1c1e0f54aa29a23cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

x-ms-request-id: ded03ad2-501e-008f-6dbb-4b6c10000000
Content-Length: 321
x-ms-version: 2018-03-28
Date: Wed, 11 Dec 2024 10:58:06 GMT
Content-Type: text/html
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound

GET
H/1.1 404
The requested content does not exist. w1.html
preferringtunexs.z13.web.core.windows.net/ 321 B
629 B 167ms
166ms Other
text/html 57.150.87.132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://preferringtunexs.z13.web.core.windows.net/w1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 57.150.87.132 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: e1d7e596447727d58fec26a8c2183945e62e82d09fc2e70e1d684e3b7eedb425

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://preferringtunexs.z13.web.core.windows.net/

Response headers

x-ms-request-id: ded03d45-501e-008f-32bb-4b6c10000000
Content-Length: 321
x-ms-version: 2018-03-28
Date: Wed, 11 Dec 2024 10:58:07 GMT
Content-Type: text/html
Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code: WebContentNotFound

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
preferringtunexs.z13.web.core.windows.net/	1970-01-21 01:39:14	Name: PHPREFS Value: full
preferringtunexs.z13.web.core.windows.net/	1970-01-21 01:38:38	Name: _gauges_unique_hour Value: 1
preferringtunexs.z13.web.core.windows.net/	1970-01-21 01:40:01	Name: _gauges_unique_day Value: 1
preferringtunexs.z13.web.core.windows.net/	1970-01-21 02:23:13	Name: _gauges_unique_month Value: 1
preferringtunexs.z13.web.core.windows.net/	1970-01-21 10:24:10	Name: _gauges_unique_year Value: 1
preferringtunexs.z13.web.core.windows.net/	1970-01-21 10:24:10	Name: _gauges_unique Value: 1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://preferringtunexs.z13.web.core.windows.net/script.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
network	error	URL: https://preferringtunexs.z13.web.core.windows.net/w3 Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
network	error	URL: https://preferringtunexs.z13.web.core.windows.net/w3.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)
network	error	URL: https://preferringtunexs.z13.web.core.windows.net/w1.html Message: Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d2fuc4clr7gvcn.cloudfront.net
preferringtunexs.z13.web.core.windows.net
track.gaug.es
userstatics.com
104.21.53.38
44.193.236.243
57.150.87.132
65.9.37.128
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
07fc524217d5c583d668173ff0c6437631317a949824c6d58dd93b2971490705
0cfd94f6df34dc8ea6b0bf28cfdb2541582fb1c843c1437963ee0c1b7c4abf1a
1ab5ef4e7e196cb1ff39df44e1a0a39f6880b906ef6fd6da3cfdbb92ffd33115
2bc7863746def2ac1986bff7aea7004e94efd68c9dc360f1c1e0f54aa29a23cd
31c6dbe9d867436244f38566adad57e3870f4c8489c6804280eb564bfac5c1bd
34ccdb50687c38ca7f6f04c46aaba862b1e93f6bd1ab158915a4ae1034f2e65e
3616cf46b53ecac41813d66874380a99715b0b31baf1c27c5db0ba320b9369c8
36c93ecca4ea10ed850a8b04465a4141f6afc135419d644181e63a98da87a376
426eec34428ca37958c3697503680648f7d9658ae0fe6300e80ddc17797ceb85
436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
4b436b0b6a47db85c88f83dc3fe3fd9a96c0a4018b28832165df929dffe0bc86
4c1606563842cce5f1788329d4417ae3618b33c6365c56a7122439b6ab45c977
50bcea5aaf56d024c4d6741671a5e0c4175fe157e91ad2c95c802de28952aa77
50e806703066d2cf867707c6504505ab5f4b8fa72dcfa517039763a488b575e2
550aa050af2cb6f17795cf53e94df6acba687b7312e41db48a6adf55cbf707f3
6ae72c7eba732fb11211c91a5225a55df7922429b4cf972580dd606139c802fc
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8be187ec77c0ddac06c26655d88e78b255950f0b24fa084d306a10be19fe4113
9e3f599d1db72217010598a7411f62b877558b5f023db4754333a32328b8f893
b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a
c0dc29d9f2dda9337b4f64ad32a18910301e16a3b5e510b2dc50fc3aa6856a05
c5a324f181af16879b6c4c52b731b23392f2816def159b157c4de620cff1cd41
ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04
df2698e6cf74ed890afa92da10051f880df2ce0b3257b73c5d9ae2f6bea82d3c
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e1d7e596447727d58fec26a8c2183945e62e82d09fc2e70e1d684e3b7eedb425
e8576535330b0db1f9a66189966f34766019a4fa9e93bc6dacce0f26d8d34bc4
f13840c053a2ed9fd86710c2852a8f98bebbb73e17faf6a89a9163b7a6208aec

preferringtunexs.z13.web.core.windows.net Open in urlscan Pro 57.150.87.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

31 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

1738 kBTransfer

1730 kBSize

6 Cookies

0 Outgoing links

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

preferringtunexs.z13.web.core.windows.net Open in urlscan Pro
57.150.87.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1738 kB
Transfer

1730 kB
Size

6
Cookies

31 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!