safeplace.loisevans.org Open in urlscan Pro
72.10.54.224 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://safeplace.loisevans.org/
Submission: On August 21 via automatic, source certstream-suspicious (August 21st 2021, 11:42:10 am UTC)

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 72.10.54.224, located in Ashburn, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is safeplace.loisevans.org.
TLS certificate: Issued by R3 on August 21st 2021. Valid for: 3 months.

This is the only time safeplace.loisevans.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3	72.10.54.224 72.10.54.224		398110 (GO-DADDY-...) (GO-DADDY-COM-LLC)
1	2a00:1450:400... 2a00:1450:4001:80e::200a		15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:acf		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:809::2003		15169 (GOOGLE) (GOOGLE)
7	4

3 72.10.54.224 (Ashburn, United States)

ASN398110 (GO-DADDY-COM-LLC, US)
PTR: tonyevans.org

safeplace.loisevans.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	loisevans.org safeplace.loisevans.org	255 KB
2	gstatic.com fonts.gstatic.com	39 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	googleapis.com fonts.googleapis.com	670 B
7	4

	Domain	Requested by
3	safeplace.loisevans.org	safeplace.loisevans.org
2	fonts.gstatic.com	fonts.googleapis.com
1	maxcdn.bootstrapcdn.com	safeplace.loisevans.org
1	fonts.googleapis.com	safeplace.loisevans.org
7	4

This site contains links to these domains. Also see Links.

Domain
loisevans.org

Subject Issuer	Validity	Valid
safeplace.loisevans.org R3	`2021-08-21` - `2021-11-19`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://safeplace.loisevans.org/
Frame ID: CB8BA3A6E7F469B42AEE63AF37784770
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

A Safe Place

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

7
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

302 kB
Transfer

333 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://loisevans.org/
Title: LoisEvans.org

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
safeplace.loisevans.org/ 4 KB
1 KB 721ms
380ms Document
text/html 72.10.54.224
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://safeplace.loisevans.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.10.54.224 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS: tonyevans.org
Software: nginx / PHP/7.3.29 PleskLin
Resource Hash: 409c20fbe31f20c30a088dc761a2dbb46017dd9a0b6f8105ce62442369978533

Request headers

:method: GET
:authority: safeplace.loisevans.org
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Sat, 21 Aug 2021 11:41:51 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/7.3.29 PleskLin
content-encoding: br

GET
H2 200 css
fonts.googleapis.com/ 3 KB
670 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:700%7CMontserrat:400,700,400&subset=cyrillic-ext,latin-ext,cyrillic,latin,vietnamese

Requested by

Host: safeplace.loisevans.org
URL: https://safeplace.loisevans.org/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://safeplace.loisevans.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 21 Aug 2021 11:41:51 GMT
server: ESF
date: Sat, 21 Aug 2021 11:41:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 21 Aug 2021 11:41:51 GMT

GET
H2 200 style.css
safeplace.loisevans.org/wp-content/plugins/cmp-coming-soon-maintenance/themes/hardwork/ 4 KB
1 KB 555ms
554ms Stylesheet
text/css 72.10.54.224
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://safeplace.loisevans.org/wp-content/plugins/cmp-coming-soon-maintenance/themes/hardwork/style.css?ver=3.6.14
Requested by: Host: safeplace.loisevans.org
URL: https://safeplace.loisevans.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.10.54.224 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS: tonyevans.org
Software: nginx / PleskLin
Resource Hash: fba3f77dc44a177fbf9d530777aced9607ef17d876906217df67e5f4d13bbb29

Request headers

:path: /wp-content/plugins/cmp-coming-soon-maintenance/themes/hardwork/style.css?ver=3.6.14
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: safeplace.loisevans.org
referer: https://safeplace.loisevans.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://safeplace.loisevans.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:41:51 GMT
content-encoding: br
etag: W/"5e42ff91-fd4"
last-modified: Tue, 11 Feb 2020 19:25:05 GMT
server: nginx
x-powered-by: PleskLin
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
expires: Mon, 20 Sep 2021 11:41:51 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 16ms
15ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: safeplace.loisevans.org
URL: https://safeplace.loisevans.org/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://safeplace.loisevans.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:41:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723, 617
age: 1438745
cdn-cachedat: 2021-07-24 08:09:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 40b2c5e257c44c41b18e54bb6d5c182e
cf-ray: 6823983bebbfc2a4-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 New-Header-banner-2.png
safeplace.loisevans.org/wp-content/uploads/2018/08/ 252 KB
253 KB 231ms
230ms Image
image/png 72.10.54.224
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://safeplace.loisevans.org/wp-content/uploads/2018/08/New-Header-banner-2.png
Requested by: Host: safeplace.loisevans.org
URL: https://safeplace.loisevans.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.10.54.224 Ashburn, United States, ASN398110 (GO-DADDY-COM-LLC, US),
Reverse DNS: tonyevans.org
Software: nginx / PleskLin
Resource Hash: 5d30a43d0fd9f96e63d4b90b7dab8f0a153d897b59e5b9be180ea586c2244a35

Request headers

:path: /wp-content/uploads/2018/08/New-Header-banner-2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: safeplace.loisevans.org
referer: https://safeplace.loisevans.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://safeplace.loisevans.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 21 Aug 2021 11:41:51 GMT
etag: "5b68a44b-3f166"
last-modified: Mon, 06 Aug 2018 19:40:59 GMT
server: nginx
x-powered-by: PleskLin
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 258406
expires: Mon, 20 Sep 2021 11:41:51 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ 20 KB
20 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:700%7CMontserrat:400,700,400&subset=cyrillic-ext,latin-ext,cyrillic,latin,vietnamese

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://safeplace.loisevans.org
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:31:26 GMT
x-content-type-options: nosniff
age: 385825
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 00:31:26 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ 19 KB
20 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:700%7CMontserrat:400,700,400&subset=cyrillic-ext,latin-ext,cyrillic,latin,vietnamese

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://safeplace.loisevans.org
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:32:15 GMT
x-content-type-options: nosniff
age: 385776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Aug 2022 00:32:15 GMT

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| init

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
safeplace.loisevans.org
2606:4700::6812:acf
2a00:1450:4001:809::2003
2a00:1450:4001:80e::200a
72.10.54.224
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
409c20fbe31f20c30a088dc761a2dbb46017dd9a0b6f8105ce62442369978533
5d30a43d0fd9f96e63d4b90b7dab8f0a153d897b59e5b9be180ea586c2244a35
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
fba3f77dc44a177fbf9d530777aced9607ef17d876906217df67e5f4d13bbb29