aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2f95  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://1944c992bfee4151402cb9d28.pages.dev/ Page URL
2. https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?fkenow=276b432d489cb3b249782b9ed63&c8swq=t3hfluz&a45rg=60160826bd84dca24f4779b4c&e2d784=0tpvmj6kw&3nmjb2=2kayfp&8o4dic6a3=032d0a1765345cc79cf3df9bb4f50358 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response 1944c992bfee4151402cb9d28.pages.dev/	21 KB 15 KB	404ms 304ms	Document text/html	2606:4700:310c::ac42:2f88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2f88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13e04ca239b4a41d5e79837e7e431ff85a25e7634a7214ee9356ab4cf926495d Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 84fee71a6bcf4c09-MIA content-encoding br content-type text/html; charset=utf-8 date Sun, 04 Feb 2024 00:47:31 GMT etag W/"888bb8e168f4b0ec97b5884c938f0549" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1NKjUwTZMRfmNDNZWEw8P7urkumDa0UKZcebfWIUYy6TyiUlNaaNq%2BXpJeLzKl4%2FTvXebeUVFuw1oK0ufgDL%2B6aHFWqBkjGRCMXlse%2FamEpKIbF41uY4RjUPcHQ0OaBLAoS3zll8hvLYQ4YdSX0c4FE2thMpkthgfz42FStyYrBEeg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.4/	88 KB 31 KB	270ms 70ms	Script text/javascript	2607:f8b0:4006:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://1944c992bfee4151402cb9d28.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Thu, 01 Feb 2024 09:30:12 GMT content-encoding gzip x-content-type-options nosniff age 227839 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31154 x-xss-protection 0 last-modified Tue, 04 Apr 2023 03:27:01 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 31 Jan 2025 09:30:12 GMT
GET DATA	200 OK	truncated /	13 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ff1197d661ec23e0e8ae066305396bc0d8fb478d2ded1e994249974f7fa6cb1f Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/png
POST H2	200	get.php fetchlnk.truesharingzone.site/	231 B 338 B	836ms 563ms	XHR text/html	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://fetchlnk.truesharingzone.site/get.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept text/html, */*; q=0.01 Referer https://1944c992bfee4151402cb9d28.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Sun, 04 Feb 2024 00:47:32 GMT content-encoding br server LiteSpeed x-powered-by PHP/8.0.30 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * x-turbo-charged-by LiteSpeed content-length 166
GET H2	200	Primary Request / Show response aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/	4 KB 2 KB	198ms 78ms	Document text/html	2606:4700:310c::ac42:2f95 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?fkenow=276b432d489cb3b249782b9ed63&c8swq=t3hfluz&a45rg=60160826bd84dca24f4779b4c&e2d784=0tpvmj6kw&3nmjb2=2kayfp&8o4dic6a3=032d0a1765345cc79cf3df9bb4f50358 Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2f95 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 086c52c9aa45fc98ed32f1e513aa82109b424752874ffa985e3ab0e1536baea9 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://1944c992bfee4151402cb9d28.pages.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 84fee724ad31748d-MIA content-encoding br content-type text/html; charset=utf-8 date Sun, 04 Feb 2024 00:47:32 GMT etag W/"05ba45d52901c683c4065de6f6fd5111" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YMFOIkMxUeKvwOo9L9w6bxSg3zUjpEwuj40yNOJgQ%2FP49W4EUD3On69WpEzruhGhR37vCA6JDvQgRvRTbXFUkuzanl1XzvCx15rfshRNkzu06pKhV50mztLB1%2FNZWkRGAbbVTzydGggi%2BTljbAIvwSEogm54o4phYhvdXEvDbeFDZsPtDOkQyJtuaQJjwBD%2BvNhlnSIZmGI%2B4O1GPNzWOXkJoQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.4/	88 KB 31 KB	66ms 65ms	Script text/javascript	2607:f8b0:4006:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Requested by Host: aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev URL: https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?fkenow=276b432d489cb3b249782b9ed63&c8swq=t3hfluz&a45rg=60160826bd84dca24f4779b4c&e2d784=0tpvmj6kw&3nmjb2=2kayfp&8o4dic6a3=032d0a1765345cc79cf3df9bb4f50358 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Thu, 01 Feb 2024 09:30:12 GMT content-encoding gzip x-content-type-options nosniff age 227840 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31154 x-xss-protection 0 last-modified Tue, 04 Apr 2023 03:27:01 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 31 Jan 2025 09:30:12 GMT
POST H2	200	ready-page.php Show response fetchlnk.truesharingzone.site/	325 KB 111 KB	209ms 207ms	XHR text/html	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://fetchlnk.truesharingzone.site/ready-page.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash 8fdbce3751aaae27b79d6ff129fb48a1dfe66393599d981cf1931b20c79eb480 Request headers Accept text/html, */*; q=0.01 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Sun, 04 Feb 2024 00:47:32 GMT content-encoding br server LiteSpeed x-powered-by PHP/8.0.30 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * x-turbo-charged-by LiteSpeed
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 22 KB	130ms 48ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ Origin https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 878 age 160776 cdn-cachedat 09/04/2022 07:20:45 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"450fc463b8b1a349df717056fbb3e078" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 9ff182e474ab8cc6d8e42dea2655c7a9 timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 84fee7320f8031de-MIA cdn-requestpullsuccess True
GET H2	400	css fonts.googleapis.com/	0 0	86ms 80ms	Stylesheet text/html	2607:f8b0:4006:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=SegeoUI&display=swap Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers
GET H2	200	one-drive-icon-28.png myexternalfls.realityresultsposter.store/oned2023/	14 KB 15 KB	1028ms 608ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/one-drive-icon-28.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 047cd04c0bf47796870a485d672f90f6b4ec54203957cd520022b46130102a46 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:44 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 14777 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H2	200	out.png myexternalfls.realityresultsposter.store/oned2023/	771 B 971 B	1029ms 609ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/out.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:45 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 771 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H2	200	of.png myexternalfls.realityresultsposter.store/oned2023/	18 KB 18 KB	1029ms 611ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/of.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:43 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 18147 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H2	200	aol.png myexternalfls.realityresultsposter.store/oned2023/	26 KB 26 KB	1432ms 1014ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/aol.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash f8a8cf4f1928938c796e2f35f8c21b0d510d4e3f16e016ee83d1f206f8ebde14 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:43 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 26456 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H2	200	yahoo.png myexternalfls.realityresultsposter.store/oned2023/	18 KB 18 KB	1431ms 1013ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/yahoo.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash aad24ed5f36320964c515b9889cb2943bbf830b40703999ad3976fce8176e554 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:46 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 17931 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H2	200	other.ico myexternalfls.realityresultsposter.store/oned2023/	64 KB 0	1029ms 611ms	Image image/x-icon	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/other.ico Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Thu, 12 Oct 2023 20:06:46 GMT server LiteSpeed content-type image/x-icon cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 199448 expires Sun, 11 Feb 2024 00:47:35 GMT
GET H3	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	68ms 67ms	Script text/javascript	2607:f8b0:4006:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Sat, 03 Feb 2024 20:18:11 GMT content-encoding gzip x-content-type-options nosniff age 16163 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 02 Feb 2025 20:18:11 GMT
GET H2	200	bg.png myexternalfls.realityresultsposter.store/oned2023/	80 KB 0	374ms 205ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/bg.png Requested by Host: aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev URL: https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?fkenow=276b432d489cb3b249782b9ed63&c8swq=t3hfluz&a45rg=60160826bd84dca24f4779b4c&e2d784=0tpvmj6kw&3nmjb2=2kayfp&8o4dic6a3=032d0a1765345cc79cf3df9bb4f50358 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sun, 04 Feb 2024 00:47:35 GMT last-modified Wed, 18 Oct 2023 20:30:33 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 188287 expires Sun, 11 Feb 2024 00:47:35 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getAllUrlParams function| testJSON function| geturlparameter function| saveFile function| getHashOrUrlParVal object| xj object| o string| rdrt number| rc string| f

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://fonts.googleapis.com/css?family=SegeoUI&display=swap Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1944c992bfee4151402cb9d28.pages.dev
aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev
ajax.googleapis.com
fetchlnk.truesharingzone.site
fonts.googleapis.com
maxcdn.bootstrapcdn.com
myexternalfls.realityresultsposter.store
162.254.39.141
2606:4700:310c::ac42:2f88
2606:4700:310c::ac42:2f95
2606:4700::6812:bcf
2607:f8b0:4006:81d::200a
047cd04c0bf47796870a485d672f90f6b4ec54203957cd520022b46130102a46
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
086c52c9aa45fc98ed32f1e513aa82109b424752874ffa985e3ab0e1536baea9
13e04ca239b4a41d5e79837e7e431ff85a25e7634a7214ee9356ab4cf926495d
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1
8fdbce3751aaae27b79d6ff129fb48a1dfe66393599d981cf1931b20c79eb480
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
aad24ed5f36320964c515b9889cb2943bbf830b40703999ad3976fce8176e554
f8a8cf4f1928938c796e2f35f8c21b0d510d4e3f16e016ee83d1f206f8ebde14
ff1197d661ec23e0e8ae066305396bc0d8fb478d2ded1e994249974f7fa6cb1f