e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2ef5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c
Effective URL:
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff...
Submission Tags: phishing
Submission: On October 29 via api (October 29th 2024, 11:20:57 am UTC) from US — Scanned from GB

Summary HTTP 13 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2606:4700:310c::ac42:2ef5, located in United States and belongs to CLOUDFLARENET, US. The main domain is e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev.
TLS certificate: Issued by WE1 on October 7th 2024. Valid for: 3 months.

This is the only time e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:310... 2606:4700:310c::ac42:2f31	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
4	192.64.118.50 192.64.118.50	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 3	2606:4700:310... 2606:4700:310c::ac42:2ef5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1		() ()
13	6

3 2606:4700:310c::ac42:2f31 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.64.118.50 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server315-5.web-hosting.com

external-files.minimalactionshandler.store	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
getor.roundupactions.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:310c::ac42:2ef5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pages.dev 2 redirects 1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	18 KB
3	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412 firebasestorage.googleapis.com Failed	92 KB
2	roundupactions.shop getor.roundupactions.shop	16 KB
2	minimalactionshandler.store external-files.minimalactionshandler.store	72 KB
13	4

	Domain	Requested by
4	e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	1 redirects 1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
3	ajax.googleapis.com	1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
3	1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev	1 redirects
2	getor.roundupactions.shop	ajax.googleapis.com
2	external-files.minimalactionshandler.store	1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev
0	firebasestorage.googleapis.com Failed	e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
13	6

This site contains links to these domains. Also see Links.

Domain
www.att.com
attreg.att.net
about.att.com

Subject Issuer	Validity	Valid
a5f79651.sni.cloudflaressl.com WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
external-files.minimalactionshandler.store Sectigo RSA Domain Validation Secure Server CA	`2024-09-30` - `2025-09-30`	a year	crt.sh
getor.roundupactions.shop Sectigo RSA Domain Validation Secure Server CA	`2024-09-30` - `2025-09-30`	a year	crt.sh
bc08b04c.sni.cloudflaressl.com WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml
Frame ID: AE62AB94F57593810D5B777D4C84DF2D
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Screen

Page URL History Show full URLs

https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c HTTP 308
https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/ Page URL
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6?aq0ew16io=024a74dd52dc6d8588... HTTP 308
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d858... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

92 %
HTTPS

60 %
IPv6

4
Domains

6
Subdomains

6
IPs

2
Countries

197 kB
Transfer

425 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://attreg.att.net/PortalRegWeb/PortalRegController?callingAppId=OP
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/support/article/wireless/KM1375558/
Title: Learn about ZenKey

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal info

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c HTTP 308
https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/ Page URL
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml HTTP 308
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c HTTP 308
https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

/ Show response
1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/
Redirect Chain

https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c
https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/

12 KB
8 KB

77ms
77ms

Document
text/html

2606:4700:310c::ac42:2f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34d0f9511e30d330d3e68eafdc065108b184ef2b9c09edfe2e252e9a01cba77a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8da2c75fa99e958a-LHR
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 29 Oct 2024 11:20:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Xu8rwFGsmfGQx3PXW2VjH0rN%2FF3CqQFMdPmDl2G59qADBbJl%2FatGoApuEiEE3mgT3qkWhUv6BRw03JeDuw7v%2FCF2Wu4K0hDSSVqF8D3uXJ1ZaY02paMQvlj%2FVCc2GZ0TkaVrgblRCc0AbpRzHO7ntnPqzpKGIj%2Bgr9JPIqalZwF0vWCT6VOUBZOTY%2Fcz6485U%2FnLEMQVct%2FX6mfVufnEiOoyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=28889&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4999&recv_bytes=4892&delivery_rate=28211&cwnd=12000&unsent_bytes=0&cid=2ac9547f51932e60&ts=154&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-ray: 8da2c75f493b958a-LHR
content-length: 0
date: Tue, 29 Oct 2024 11:20:52 GMT
location: /e8a4ab018d5d7ffe941a83d81/b021515e6c/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LwwlnVtMYBNJfmA4LmkXVX4NpzbaG0JnTJ1Lur5K%2FywwNdI3xlZa9AiYdk0P6p1UtPLCZ%2FSIoTftkbeCJQBxrLvAAQSpdhixcuwYxeRl6Fg6Yqfe9%2F3rz8P1vl2aUIXYBV6kol8vUWzc8GzMLP8RIVkSubHO%2FjS%2FAswYnibrZOXq7LX4f7DeHUPUBl3NYJFfTxQXQCy%2Fn5UGpakc9kZR5v5%2FLg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=25847&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4198&recv_bytes=4333&delivery_rate=99765&cwnd=12000&unsent_bytes=0&cid=2ac9547f51932e60&ts=71&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ 88 KB
31 KB 270ms
40ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js

Requested by

Host: 1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev
URL: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/

Response headers

content-encoding: gzip
age: 586284
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:29:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:29:29 GMT
last-modified: Tue, 04 Apr 2023 03:27:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31154
x-xss-protection: 0
server: sffe

GET
H2 200 att-logo.png
external-files.minimalactionshandler.store/thegifloader/ 5 KB
5 KB 1093ms
581ms Image
image/png 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external-files.minimalactionshandler.store/thegifloader/att-logo.png
Requested by: Host: 1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev
URL: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: b9d335ef26ff5819ae1a07f6a1185cbd9df6bc3383b4c934fe6a2ef02693f71c

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/

Response headers

cache-control: public, max-age=604800
expires: Tue, 05 Nov 2024 11:20:53 GMT
accept-ranges: bytes
content-length: 4760
date: Tue, 29 Oct 2024 11:20:53 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/png
last-modified: Mon, 30 Sep 2024 06:48:14 GMT
server: LiteSpeed

POST
H2 200 get.php
getor.roundupactions.shop/ 217 B
331 B 934ms
340ms XHR
text/html 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://getor.roundupactions.shop/get.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed / PHP/8.1.30
Resource Hash

Request headers

Referer: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Accept: text/html, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
access-control-allow-origin: *
content-length: 159
date: Tue, 29 Oct 2024 11:20:54 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.30
vary: Accept-Encoding
server: LiteSpeed

GET
H3 404 favicon.ico
1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/ 0
655 B 57ms
56ms Other
text/plain 2606:4700:310c::ac42:2f31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2f31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/

Response headers

cache-control: no-store
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h8u5M0qrjmoyilxHE8bsLlomqtWwX0ywbBOHl8pzi0%2FMmKKjvROlumDzbfn%2FoIexdKbNqB0U22Ye3OeX2wrA5XCJPN2fYkGpl0B8Sr93eLugEtFxDQpXLOzA%2Bk0TZR21qbHqZByHXzbAAqC%2BF9Mt5scmItSAG8lv7XQS%2Fe2urmAK1an5H1oUiUc6mopDboiO8%2BKV6FCx8Ks%2FgyOKm8u5loc0xg%3D%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8da2c769482c958a-LHR
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfL4;desc="?proto=QUIC&rtt=28243&sent=21&recv=16&lost=0&retrans=0&sent_bytes=13040&recv_bytes=5490&delivery_rate=108494&cwnd=12000&unsent_bytes=0&cid=2ac9547f51932e60&ts=1681&x=1", cfHdrFlush;dur=0
date: Tue, 29 Oct 2024 11:20:53 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

Primary Request / Show response
e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/
Redirect Chain

https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t...
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9...

12 KB
8 KB

115ms
115ms

Document
text/html

2606:4700:310c::ac42:2ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ef5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4cb5be9bb0695ace84e777cff8bc7807126a8a6df01628677f6a4a540cda708a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/
Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8da2c7707ecd6365-LHR
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 29 Oct 2024 11:20:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J5NZ8WS08fwLOiuTuxXli12mFkdEXZkV%2BONu%2Fhy2femk7q7JMvzikh3okzT%2FtJMDh7nXYtAAMXAAqmFH4CvrYcM6gAc%2BXgNVYiqLMqCZdSeLMVEi0pCvIFx9Ib0xtvpyu32H55KqC07%2FBn4A%2FAkOeREcHG1TXj9lMHb2x1epWEp8y6f%2B4gzKrx3NVpBUvh9PRgoxxIz9NFBgp9HaJWX9XQLRWw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=27661&sent=15&recv=11&lost=0&retrans=0&sent_bytes=5096&recv_bytes=5143&delivery_rate=20710&cwnd=12000&unsent_bytes=0&cid=b460653d6380746e&ts=196&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-ray: 8da2c7700e196365-LHR
content-length: 0
date: Tue, 29 Oct 2024 11:20:55 GMT
location: /7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wtho0KVnVVq8ZY1BqdoLKeUE2Gn7tcaLGzEOxQMdA24mipB7B7Ajbwo4tsQEslfYgbXdsOzI3la%2BoJQpvqb5WlkEpMUir%2Bny5f4IrUlzb0Eq%2FStqYSIRTJIN3jKirYVmUFcNXzNsYQgjkiilzCD8kqeGV6ZcSxnmuY0QKDFuu38FlcXh%2BN1Vwp3tQY9DAx9EwpqSBryWSGagTTz32hCJKXCniA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=25788&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4253&recv_bytes=4551&delivery_rate=22931&cwnd=12000&unsent_bytes=0&cid=b460653d6380746e&ts=78&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ 88 KB
31 KB 194ms
52ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/

Response headers

content-encoding: gzip
age: 586286
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:29:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:29:29 GMT
last-modified: Tue, 04 Apr 2023 03:27:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31154
x-xss-protection: 0
server: sffe

GET
H2 200 loading.gif
external-files.minimalactionshandler.store/thegifloader/ 67 KB
67 KB 739ms
166ms Image
image/gif 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external-files.minimalactionshandler.store/thegifloader/loading.gif
Requested by: Host: 1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev
URL: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/e8a4ab018d5d7ffe941a83d81/b021515e6c/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: 3c21e22b282a0a65b6b07871d20856fb062da3b5e1d481564379249bc2071235

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/

Response headers

cache-control: public, max-age=604800
expires: Tue, 05 Nov 2024 11:20:55 GMT
accept-ranges: bytes
content-length: 68682
date: Tue, 29 Oct 2024 11:20:55 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/gif
last-modified: Mon, 30 Sep 2024 06:48:16 GMT
server: LiteSpeed

POST
H2 200 ready-page.php
getor.roundupactions.shop/ 35 KB
16 KB 895ms
483ms XHR
text/html 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://getor.roundupactions.shop/ready-page.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed / PHP/8.1.30
Resource Hash

Request headers

Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Accept: text/html, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
access-control-allow-origin: *
content-length: 15936
date: Tue, 29 Oct 2024 11:20:56 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.30
vary: Accept-Encoding
server: LiteSpeed

GET
H3 404 favicon.ico
e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/ 0
655 B 54ms
53ms Other
text/plain 2606:4700:310c::ac42:2ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml

Response headers

cache-control: no-store
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LiUccZ4axpgLOMReKauouqMvlb12VGLbOUMgt3qLESsGfxraH9sJSpeqJTocverbkLAevWFOOVUOWyFJChlXSFio1W%2Fy%2FLyFutPDAnduBXfWkdsQAODwkVQHoeml%2BfoPVjblhlD5XLRZ361W51erPAspxx%2B79hc3WRdWl8%2BiI7fL0rb9KvHWZQi0opQsR%2BFl9nt0kZIAY7pyBtWJVwZ6unKpAw%3D%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8da2c777e88e6365-LHR
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfL4;desc="?proto=QUIC&rtt=27141&sent=24&recv=16&lost=0&retrans=0&sent_bytes=13336&recv_bytes=5818&delivery_rate=72438&cwnd=12000&unsent_bytes=0&cid=b460653d6380746e&ts=1321&x=1", cfHdrFlush;dur=0
date: Tue, 29 Oct 2024 11:20:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
BLOB 200
OK cc94aa85-f976-453f-80e5-09d5f24af033 Show response
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/ 26 KB
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/cc94aa85-f976-453f-80e5-09d5f24af033
Requested by: Host: e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
URL: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/7d24e277f71c4799d58c374e8/d0ac7b32e4a99486244f6/?aq0ew16io=024a74dd52dc6d8588da17f30e9fc6f9cc3ff&lmdnsev=j86xl-ws-0lebm9t-eorprh&ur4qy=e6vxml
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a2d9af3cc03f6cf4556f7edcda0438ca3b9b9e7c20f0061a0f0b55cb2ca3973

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Content-Length: 26524
Content-Type: text/html

GET styles.css
firebasestorage.googleapis.com/v0/b/external-files-f9026.appspot.com/o/ 0
0

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
URL: blob:https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/cc94aa85-f976-453f-80e5-09d5f24af033

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

content-encoding: gzip
age: 529111
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 08:22:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 08:22:25 GMT
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30462
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

Content-Type: image/svg+xml

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: firebasestorage.googleapis.com
URL: https://firebasestorage.googleapis.com/v0/b/external-files-f9026.appspot.com/o/styles.css?alt=media&token=10f29176-5bcb-4f25-9313-662dbee1d1c7

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1ec90fdd33b86948377f9313acc42dda03035686905da28262af83fc2f.pages.dev
ajax.googleapis.com
e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
external-files.minimalactionshandler.store
firebasestorage.googleapis.com
getor.roundupactions.shop
firebasestorage.googleapis.com

192.64.118.50
2606:4700:310c::ac42:2ef5
2606:4700:310c::ac42:2f31
2a00:1450:4001:806::200a
34d0f9511e30d330d3e68eafdc065108b184ef2b9c09edfe2e252e9a01cba77a
3c21e22b282a0a65b6b07871d20856fb062da3b5e1d481564379249bc2071235
4cb5be9bb0695ace84e777cff8bc7807126a8a6df01628677f6a4a540cda708a
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
9a2d9af3cc03f6cf4556f7edcda0438ca3b9b9e7c20f0061a0f0b55cb2ca3973
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b9d335ef26ff5819ae1a07f6a1185cbd9df6bc3383b4c934fe6a2ef02693f71c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2ef5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

92 %HTTPS

60 %IPv6

4 Domains

6 Subdomains

6 IPs

2 Countries

197 kBTransfer

425 kBSize

0 Cookies

9 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

6 Console Messages

Security Headers

Indicators

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2ef5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

92 %
HTTPS

60 %
IPv6

4
Domains

6
Subdomains

6
IPs

2
Countries

197 kB
Transfer

425 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!