www.cedifarma.com Open in urlscan Pro
192.185.131.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Effective URL:
https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Submission: On June 17 via automatic, source openphish (June 17th 2024, 1:20:11 am UTC) — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 5 countries across 9 domains to perform 15 HTTP transactions. The main IP is 192.185.131.134, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is www.cedifarma.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 20th 2024. Valid for: 3 months.

This is the only time www.cedifarma.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 3	192.185.131.134 192.185.131.134	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
2	104.18.10.207 104.18.10.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
3	2620:1ec:bdf::45 2620:1ec:bdf::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	144.76.109.178 144.76.109.178	24940 (HETZNER-AS) (HETZNER-AS)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
1	2603:1026:300... 2603:1026:3000:c8::6	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	102.132.97.27 102.132.97.27	32934 (FACEBOOK) (FACEBOOK)
15	10

3 192.185.131.134 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: mx50.hostgator.mx

www.cedifarma.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cedifarma.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.76.109.178 (Hamm, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.178.109.76.144.clients.your-server.de

www.freeiconspng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2603:1026:3000:c8::6 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 102.132.97.27 (Alexandria, Egypt)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-hbe1.fbcdn.net

scontent-hbe1-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 16778	3 KB
3	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1267 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3345	41 KB
3	cedifarma.com 1 redirects www.cedifarma.com cedifarma.com	6 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 265	13 KB
1	fbcdn.net scontent-hbe1-1.xx.fbcdn.net — Cisco Umbrella Rank: 254377	21 B
1	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 11
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 814	24 KB
1	freeiconspng.com www.freeiconspng.com — Cisco Umbrella Rank: 140789	9 KB
1	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 1105	2 KB
15	9

	Domain	Requested by
3	secure.aadcdn.microsoftonline-p.com	www.cedifarma.com
2	cdnjs.cloudflare.com	www.cedifarma.com
2	maxcdn.bootstrapcdn.com	www.cedifarma.com
2	www.cedifarma.com	1 redirects
1	cedifarma.com
1	scontent-hbe1-1.xx.fbcdn.net	www.cedifarma.com
1	login.microsoftonline.com	www.cedifarma.com
1	code.jquery.com	www.cedifarma.com
1	www.freeiconspng.com	www.cedifarma.com
1	aadcdn.msftauth.net	www.cedifarma.com
1	stackpath.bootstrapcdn.com	www.cedifarma.com
15	11

This site contains no links.

Subject Issuer	Validity	Valid
cedifarma.com Sectigo RSA Domain Validation Secure Server CA	`2024-05-20` - `2024-08-18`	3 months	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-05-25` - `2024-08-23`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft Azure RSA TLS Issuing CA 04	`2024-05-22` - `2025-05-17`	a year	crt.sh
freeiconspng.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-12` - `2025-03-13`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-05-27` - `2025-05-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-03-26` - `2024-06-24`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Frame ID: 08E262F3C9CE215674B2C857DF20A519
Requests: 14 HTTP requests in this frame

Frame: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Frame ID: 25A47FE1A19CE8ADD88D173FEEC93EBE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html HTTP 307
https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<script [^>]*src="[^"]*/popper\.js/([0-9.]+)
/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

40 %
IPv6

9
Domains

11
Subdomains

10
IPs

5
Countries

98 kB
Transfer

337 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html HTTP 307
https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://www.cedifarma.com/favicon.ico HTTP 302
https://cedifarma.com/wp-content/uploads/2020/05/cropped-Imagen6-32x32.png

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request recover.html Show response
www.cedifarma.com/inboxaudio/azure2019/realm/
Redirect Chain

http://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

12 KB
4 KB

694ms
183ms

Document
text/html

192.185.131.134
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.131.134 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: mx50.hostgator.mx
Software: nginx/1.23.4 /
Resource Hash: e57502f7f4426096a81be3ccdc435b0497cc8952217bfebbbf03cec72a94942b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 4352
content-type: text/html
date: Mon, 17 Jun 2024 01:20:07 GMT
last-modified: Wed, 17 Jul 2019 03:08:46 GMT
server: nginx/1.23.4
vary: Accept-Encoding
x-proxy-cache: HIT
x-server-cache: true

Redirect headers

Location: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
22 KB 116ms
65ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1077
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-cachedat: 06/09/2024 14:16:24
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"ec3bb52a00e176a7181d454dffaea219"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: a56d5d837f2444c16a18894c007ade78
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 894f371f5a2a58ea-TXL
cdn-requestpullsuccess: True

GET
H3 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
6 KB 105ms
50ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 288191
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5884
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-9226"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PEgkp7Vz2dC%2BkVGG1Fq6OSCDRHDtm1OdEnWCifWD1KKBj4PKw2tBOEJGy18DFS2jLXxaB4AnepKvsvQlt5SslLufzWyVSIblnsmaW%2BAE%2Fl3G0aFVCylKb7sExuRbo7s7Im50kmzw"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 894f371f6b289b7d-FRA
expires: Sat, 07 Jun 2025 01:20:07 GMT

GET
H3 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
8 KB 116ms
64ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1078
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-cachedat: 03/18/2024 12:28:12
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"269550530cc127b6aa5a35925a7de6ce"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 4bbfffdaac4d77e154a8235627d0901c
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 894f371f6af2aca9-TXL
cdn-requestpullsuccess: True

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ 4 KB
2 KB 171ms
42ms Image
image/svg+xml 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD5) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 76977
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:22 GMT
server: ECAcc (frc/4CD5)
etag: 0x8D64101507E84BD
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 861906cd-201e-00b5-5ea1-bfab68000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker_account_aad.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/ 1 KB
1 KB 228ms
45ms Image
image/png 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_account_aad.png
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 17 Jun 2024 01:20:07 GMT
last-modified: Sat, 18 May 2019 14:25:33 GMT
etag: 0x8D6DB9CB015AF6E
x-azure-ref: 20240617T012007Z-r1695cb7469ptb7p0ypq57ay3n00000000kg00000000wnhg
x-cache: TCP_HIT
content-type: image/png
x-ms-request-id: d3a1d805-501e-00f1-664c-c08896000000
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
x-fd-int-roxy-purgeid: 50755578
x-cache-info: L1_T2
accept-ranges: bytes
content-length: 1082

GET
H2 200 picker_more.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/ 192 B
561 B 206ms
44ms Image
image/png 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_more.png
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 1b8e9869c33c1086478e807f8537b155c84660c631c830d6a83d83accfd1ed18

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Mon, 17 Jun 2024 01:20:07 GMT
last-modified: Sat, 18 May 2019 14:25:45 GMT
etag: 0x8D6DB9CB71AE498
x-azure-ref: 20240617T012007Z-r1695cb7469ptb7p0ypq57ay3n00000000kg00000000wnhf
x-cache: TCP_HIT
content-type: image/png
x-ms-request-id: 30e8e7d8-701e-0070-454c-c0284c000000
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
x-fd-int-roxy-purgeid: 50755578
x-cache-info: L1_T2
accept-ranges: bytes
content-length: 192

GET
H2 200 picker_account_add.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/ 222 B
572 B 207ms
45ms Image
image/svg+xml 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_account_add.svg
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 50755578
content-length: 184
x-ms-lease-status: unlocked
last-modified: Sat, 18 May 2019 14:25:49 GMT
etag: 0x8D6DB9CB965E890
x-azure-ref: 20240617T012007Z-r1695cb7469ptb7p0ypq57ay3n00000000kg00000000wnhh
content-type: image/svg+xml
x-ms-request-id: 0aeabe78-101e-00f0-2e2c-c0d74a000000
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 success-icon-10.png
www.freeiconspng.com/uploads/ 9 KB
9 KB 207ms
91ms Image
image/png 144.76.109.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.freeiconspng.com/uploads/success-icon-10.png
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.109.178 Hamm, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.109.76.144.clients.your-server.de
Software: nginx /
Resource Hash: 43d7977e40842a30573239834df28dcd59fd7f8f95ab44a48e9fd5d008e99f54

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
last-modified: Tue, 14 Mar 2017 23:16:07 GMT
server: nginx
etag: "2488-54ab903389bc0"
content-type: image/png
cache-control: max-age=3600, no-cache, must-revalidate
accept-ranges: bytes
content-length: 9352
expires: Mon, 17 Jun 2024 02:20:07 GMT

GET
H2 200 jquery-3.3.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 133ms
40ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 23786607
x-cache: HIT, HIT
content-length: 24038
x-served-by: cache-lga21982-LGA, cache-cph2320037-CPH
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1718587208.646628,VS0,VE0
etag: W/"28feccc0-1111d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 73, 59534

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 20 KB
7 KB 81ms
51ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4487287
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6458
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-500f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UK56w%2FPGuZSoOH5nsXBfk3i9BU97OuPW77pP64e%2FDv7mvcU0nMRmsuDuSMqBPHDLPbr3QrjZ6qf3r%2B2LBk6%2BmElHiIcFG6OGimXmJllvV8h6B5SpkQFlTuMFORCnYiIcIN%2BzckbM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 894f371f6b299b7d-FRA
expires: Sat, 07 Jun 2025 01:20:07 GMT

GET
H3 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
11 KB 128ms
101ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Origin: https://www.cedifarma.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 17 Jun 2024 01:20:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1047
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-cachedat: 03/18/2024 12:13:26
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"5869c96cc8f19086aee625d670d741f9"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 0781c55945cbe570a9b62d972935291b
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 894f371f5a3058ea-TXL
cdn-requestpullsuccess: True

GET
H/1.1 200
OK logout.srf
login.microsoftonline.com/ Frame 25A4 0
0 248ms
66ms Document
text/html 2603:1026:3000:c8::6
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392

Requested by

Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:c8::6 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.cedifarma.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 11173
Content-Type: text/html; charset=utf-8
Date: Mon, 17 Jun 2024 01:20:07 GMT
Expires: -1
Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: on
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
x-ms-ests-server: 2.1.18298.5 - NEULR1 ProdSlices
x-ms-request-id: 3c8312f8-059d-4a49-9aaf-5a4b862a9000
x-ms-srs: 1.P

GET
H3 403 48422006_339286713574611_2218872287996674048_n.jpg
scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/ 21 B
21 B 220ms
93ms Image
text/plain 102.132.97.27
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/48422006_339286713574611_2218872287996674048_n.jpg?_nc_cat=102&_nc_oc=AQmZE8Zxmxd2NJBgLImX_xETnYBUFjdh60pbEnh44rUa193MJyF3JSvETRaG658BAxo&_nc_ht=scontent-hbe1-1.xx&oh=d54ff74920f15ad1f907020a1659dc1d&oe=5D34E1DC
Requested by: Host: www.cedifarma.com
URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 102.132.97.27 Alexandria, Egypt, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-hbe1.fbcdn.net
Software: proxygen-bolt /
Resource Hash: 16366d2552aa8349747c1168a3ef03665652b08d80385b6664c4cbf6a5b2f932

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.cedifarma.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=90, rtx=0, c=23, mss=1232, tbw=4065, tp=8, tpl=0, uplat=0, ullat=-1
date: Mon, 17 Jun 2024 01:20:07 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 21
priority: u=1,i
proxy-status: http_request_error; e_fb_configversion="AcI7gSkFZ9LTg5c_h4uBu1n5xPfngFqjPG5vEP8ztWiDguUMJDk8C3p5HBsW_w"; e_fb_vipport="AcJ-_UnGgnRzfeHmfP7_fK4D-McTfSm4BtfzyrfLJAul7UJU-5thzoNpB7cy"; e_fb_requestsequencenumber="AcKPV1m5_TbgAvNEAAFs_mqUd32moheSg3dP97tjOzfsee2fS7Eat1HurA"; e_fb_hostheader="AcJoxNbKQIgqg8y_Veg-qXPd0rAxRBoaLxf57om1fa9i8y3uk203294wsQU5OCJxBufSkAQN75wiHpJoK_3Et6matWkCBQ"; e_fb_vipaddr="AcKjGuzS-mgLKecaippFmLT3Y_qrOhzR2OKd-UyjAqaqPbneffgRqCjKQPwuI3VW-7tYJBdzeg"; e_fb_requesthandler="AcL4ZmxS9gD3qo8Q8fk1uIOinTwwpWUcLi6RgSXNLvUkoyOAr39CtJPtYouUcsy7ipZMFK3CMrqBBGbw"; e_fb_requesttime="AcIQqdj5myGdXhrv6DqrGGrcXFL41R1IIN8negBUozY6sQl9EOF4lxkrrYnnY7bwhqtxGxHExw"; e_fb_builduser="AcIAOswK5qaMd-Tc2xUx1bATX-s7S51IVOhnL-TXCEX4HYcUhe6ZyUzysJTxRttCeG4"; e_fb_httpversion="AcJKPRU5J8BUMnbf7MFiLzQKninbjbtlLO7XNfbhGYo2HcUUeDk3FebrGA3A"; e_fb_binaryversion="AcJ8RvPZsk4gJ04_lZUOry-eS7SEz3uvySejSlVNb3CQfcM-IdDLC6cgrC-mUaxW3XaLLsXLlQXfPhKAMTbjJPuscXAl22Y2t4g"; e_proxy="AcKqZ3RFjFBcBcnIqI94VafdgkMe1pJQXl8XFOIiC7MbihubUmTr3u9Al95rgkvXXFaDzFRgfNYDnSE", http_request_error; e_fb_configversion="AcJZjIKVBEHR6fELj3xqTWI9rRD6I8WabI4vdwkIUNuK0gcZ6Oan9XzDInrzdg"; e_fb_vipport="AcK29LpY4T_Ad7XSzkArxyVmZ3n58NiRh_wmEXRkNMzGOuc1WH0BLe99_IYt"; e_fb_requestsequencenumber="AcLx-G4_3GZxE-74b-a3Q08ES0lN0JFGAZgwNGDNY_lENgdClxjy6KVQeQ"; e_fb_responsebytes="AcKm894T78heuAFjR9NTSbvDd4-lLzab2kr_LS2QUrVV06zhDKaBM2JhYgI"; e_fb_hostheader="AcJKQYJJyZraehdIA5VfB4_cK7Nprg944OZol3XCCLHAgEiZgIRcud2JzY5UBxoNKiLRVsmX-cys20vA8S5Kn8QMhBcRdg"; e_fb_vipaddr="AcK50MgqG9dhePenRm3krml8Fi9AHYMofvGju4IN5s8fbSddJwAD_E2m1vccpPg_6r_QkeyTpQ"; e_fb_requesthandler="AcIDRNMj_073pM4WBry9CI_Va4Ih2hx2Ba_EZX70op929SPZnnleyGiPYnz5CYJ3R3goXuTr39Rf9myU"; e_fb_requesttime="AcICIy3trrefyjQURDxPG7Tw3FI9xXbpWF2nY1fyPLqlcgs2gigCLey76NED-JTNS3jrEsWWwg"; e_fb_builduser="AcKAeIfKrrr9OYBhEm8raxyz8hs9cXtaMWxJfCtUjQadKTqyeexCJmiEWAOU9PxXU7E"; e_fb_httpversion="AcIfE5YExdUH5q3ZoQQTiODyoLq6MfKlXsZXLVcOdweZ8AYE8IJNlZ4wNnj6"; e_fb_binaryversion="AcJluqAIBBRnFLWCEMdP7r31nkh0ayxGaCsDUDxgIyI6uWxC4jGXPiHib8D-SoiIK_89fMYCf-URE4FVyezHWirtL8QxIC2v6nE"; e_proxy="AcKijAJvWczr4_7FMt2aaNaU_yd5gsjMDLNcjdrLgDNcPgJfNkzfxLRabcfNunNgS6ltC5Lf3bpIic4"

GET
H2

200

cropped-Imagen6-32x32.png
cedifarma.com/wp-content/uploads/2020/05/
Redirect Chain

https://www.cedifarma.com/favicon.ico
https://cedifarma.com/wp-content/uploads/2020/05/cropped-Imagen6-32x32.png

1 KB
1 KB

147ms
146ms

Other
image/png

192.185.131.134
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cedifarma.com/wp-content/uploads/2020/05/cropped-Imagen6-32x32.png
Protocol: H2
Server: 192.185.131.134 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: mx50.hostgator.mx
Software: Apache /
Resource Hash: 72eb8417ad5bcf7cc78783d1e737e4bf0a80b7e070dcc3ccd1cc7cec73ec467e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.cedifarma.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 17 Jun 2024 01:20:09 GMT
last-modified: Mon, 04 May 2020 18:46:41 GMT
server: Apache
accept-ranges: bytes
content-length: 1421
content-type: image/png

Redirect headers

date: Mon, 17 Jun 2024 01:20:09 GMT
server: nginx/1.23.4
x-redirect-by: WordPress
x-server-cache: true
content-type: text/html; charset=UTF-8
location: https://cedifarma.com/wp-content/uploads/2020/05/cropped-Imagen6-32x32.png
link: <https://cedifarma.com/wp-json/>; rel="https://api.w.org/"
content-length: 0
x-proxy-cache: EXPIRED

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: SignInStateCookie Value: CAgABFgIAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P9q6PSKlB2XuIl_9K4nr1fm5BoGRYNLITBASNsuXgDLRjXMpu_rTMYJLEj6r8P7nXrU1A-sFbne_Q
login.microsoftonline.com/	1970-01-21 06:59:07	Name: ESTSSSOTILES Value: 1
login.microsoftonline.com/	1970-01-21 06:59:07	Name: AADSSOTILES Value: 1
.login.microsoftonline.com/	1970-01-20 23:32:43	Name: ESTSAUTHPERSISTENT Value: AgABFwQAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P-UlRTWmMQ0gE0VGJ4dwRQKE5yj2xYs2Tk5eWhBeOcM09xff8EvpEqW7VTAlxUJPSoDho6YXtROwQ
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTH Value: AgABFwQAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P-QTQ87m_bEz9bfd9syGnuDQvwt_RqlspaPCaMN7U7Xb0LD8o0OhthzavYxvk5OzQ3MYtK2dfeN0w
login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTHLIGHT Value: +
login.microsoftonline.com/	1970-01-20 22:06:19	Name: buid Value: AQABGgEAAAApTwJmzXqdR4BN2miheQMY0tGF2hbzuJvtlC4pHraOM6G8JM84CjjMAcyCZ9gkBozmzclouYgqIYzQLGzT1bKAiGEh-1t_c0iOk3s3Z2_VaxzXG4nzobk5mN3BLsB6_xggAA
login.microsoftonline.com/	1970-01-20 22:06:19	Name: fpc Value: AoHTMon6keJPuEfebugdLX4
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMYz1uCL-xEcyhttx1ZqZQI5oi2aySottvBKWkMko8yjl7lDdIY4CjizhWeNqNJQbzXv9KjDK8MM3fZDIgUR3f442Q5lyKXnMdxmgS5W6A1NynWHyYivD_7EtYT5qGEGgTA7JEorkexfBndwnUOQnIY6jgKiOuxHpmu2mu8yrvho1ggAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://www.cedifarma.com/inboxaudio/azure2019/realm/recover.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/48422006_339286713574611_2218872287996674048_n.jpg?_nc_cat=102&_nc_oc=AQmZE8Zxmxd2NJBgLImX_xETnYBUFjdh60pbEnh44rUa193MJyF3JSvETRaG658BAxo&_nc_ht=scontent-hbe1-1.xx&oh=d54ff74920f15ad1f907020a1659dc1d&oe=5D34E1DC Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
cdnjs.cloudflare.com
cedifarma.com
code.jquery.com
login.microsoftonline.com
maxcdn.bootstrapcdn.com
scontent-hbe1-1.xx.fbcdn.net
secure.aadcdn.microsoftonline-p.com
stackpath.bootstrapcdn.com
www.cedifarma.com
www.freeiconspng.com
102.132.97.27
104.17.24.14
104.18.10.207
104.18.11.207
144.76.109.178
192.185.131.134
2603:1026:3000:c8::6
2606:2800:233:1cb7:261b:1f9c:2074:3c
2620:1ec:bdf::45
2a04:4e42:600::649
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16366d2552aa8349747c1168a3ef03665652b08d80385b6664c4cbf6a5b2f932
1b8e9869c33c1086478e807f8537b155c84660c631c830d6a83d83accfd1ed18
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
43d7977e40842a30573239834df28dcd59fd7f8f95ab44a48e9fd5d008e99f54
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
72eb8417ad5bcf7cc78783d1e737e4bf0a80b7e070dcc3ccd1cc7cec73ec467e
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e57502f7f4426096a81be3ccdc435b0497cc8952217bfebbbf03cec72a94942b
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

www.cedifarma.com Open in urlscan Pro 192.185.131.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

40 %IPv6

9 Domains

11 Subdomains

10 IPs

5 Countries

98 kBTransfer

337 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

11 Cookies

2 Console Messages

Indicators

www.cedifarma.com Open in urlscan Pro
192.185.131.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

40 %
IPv6

9
Domains

11
Subdomains

10
IPs

5
Countries

98 kB
Transfer

337 kB
Size

11
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!