drive.securegsb.cfd Open in urlscan Pro
172.67.216.145 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Effective URL:
https://drive.securegsb.cfd/shared/purchase_order.xlsb
Submission: On April 12 via manual (April 12th 2024, 12:41:02 am UTC) from AU — Scanned from AU

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 8 HTTP transactions. The main IP is 172.67.216.145, located in United States and belongs to CLOUDFLARENET, US. The main domain is drive.securegsb.cfd.
TLS certificate: Issued by GTS CA 1P5 on April 8th 2024. Valid for: 3 months.

This is the only time drive.securegsb.cfd was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	34.49.238.24 34.49.238.24	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	13.227.74.4 13.227.74.4	16509 (AMAZON-02) (AMAZON-02)
2	172.67.216.145 172.67.216.145	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	43.154.240.111 43.154.240.111	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
2	211.152.154.242 211.152.154.242	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
1	108.181.3.133 108.181.3.133	40676 (AS40676) (AS40676)
8	5

2 34.49.238.24 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 24.238.49.34.bc.googleusercontent.com

bytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.74.4 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-227-74-4.sfo20.r.cloudfront.net

docsend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.216.145 (United States)

ASN13335 (CLOUDFLARENET, US)

drive.securegsb.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.154.240.111 (Hong Kong, Hong Kong)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

ca.turing.captcha.qcloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 211.152.154.242 (Melbourne, Australia)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

global.turing.captcha.gtimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.181.3.133 (Los Angeles, United States)

ASN40676 (AS40676, US)
PTR: unassigned.psychz.net

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gtimg.com global.turing.captcha.gtimg.com — Cisco Umbrella Rank: 878905	65 KB
2	securegsb.cfd drive.securegsb.cfd	3 KB
2	bytes.com bytes.com — Cisco Umbrella Rank: 908876	7 KB
1	postimg.cc i.postimg.cc — Cisco Umbrella Rank: 19308	386 KB
1	qcloud.com ca.turing.captcha.qcloud.com — Cisco Umbrella Rank: 853909	33 KB
1	docsend.com 1 redirects docsend.com — Cisco Umbrella Rank: 91148	6 KB
8	6

	Domain	Requested by
2	global.turing.captcha.gtimg.com	ca.turing.captcha.qcloud.com global.turing.captcha.gtimg.com
2	drive.securegsb.cfd
2	bytes.com
1	i.postimg.cc	drive.securegsb.cfd
1	ca.turing.captcha.qcloud.com	drive.securegsb.cfd
1	docsend.com	1 redirects
8	6

This site contains no links.

Subject Issuer	Validity	Valid
bytes.com GTS CA 1D4	`2024-03-30` - `2024-06-28`	3 months	crt.sh
securegsb.cfd GTS CA 1P5	`2024-04-08` - `2024-07-07`	3 months	crt.sh
*.turing.captcha.qcloud.com DigiCert Secure Site CN CA G3	`2024-03-27` - `2025-04-27`	a year	crt.sh
*.turing.captcha.gtimg.com DigiCert Secure Site CN CA G3	`2024-02-20` - `2025-03-22`	a year	crt.sh
postimg.cc R3	`2024-02-21` - `2024-05-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Frame ID: 92CD26D9429D04C737769A5189EDB305
Requests: 7 HTTP requests in this frame

Frame: https://global.turing.captcha.gtimg.com/template/drag_ele_global.html
Frame ID: EB279771E44C7FC8F37698B5D0139FB8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Purchase_order.xlsb

Page URL History Show full URLs

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6 Page URL
https://docsend.com/view/p487hxrdc5ukrrd6 HTTP 302
https://drive.securegsb.cfd/shared/purchase_order.xlsb Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

494 kB
Transfer

704 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6 Page URL
https://docsend.com/view/p487hxrdc5ukrrd6 HTTP 302
https://drive.securegsb.cfd/shared/purchase_order.xlsb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
bytes.com/redirect-to/ 124 B
347 B 229ms
208ms Document
text/html 34.49.238.24
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.238.24 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

24.238.49.34.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

2e70eb585fef3a7bf8f2888e752d8a1ed2337015554109ae03731c65b0c9a7aa

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 106
content-type: text/html; charset=ISO-8859-1
date: Fri, 12 Apr 2024 00:40:49 GMT
etag: "9899356-1712882449;br"
server: LiteSpeed
vary: Accept-Encoding
via: 1.1 google
x-litespeed-cache: miss
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block

GET
H3

200

Primary Request purchase_order.xlsb Show response
drive.securegsb.cfd/shared/
Redirect Chain

https://docsend.com/view/p487hxrdc5ukrrd6
https://drive.securegsb.cfd/shared/purchase_order.xlsb

5 KB
2 KB

1005ms
976ms

Document
text/html

172.67.216.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.216.145 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ebf75c91dfe84c5b73f345bff21f8e433d2f5f2770ad8410e62f21735ddd17ff

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 872f2ad67dcb5c09-SYD
content-encoding: br
content-type: text/html
date: Fri, 12 Apr 2024 00:40:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qKj7gmqrM8f5hEUw3YgnZ2mznWYVwYoCuG3OAY9EcsSWg0eKwb6Jj0AawhCvzzCLhGB1vw%2FycA4jhx7MHlugIGFc%2F%2BVJYWW8zaCLerW3honpTU3EGmbPhyO%2FF98T7i2pwyKuf9XV"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: connect-src 'self' blob: https://assets.docsend.com https://d2qvtfnm75xrxf.cloudfront.net https://*.previews.dropboxusercontent.com/*/p.m3u8 https://*.dropboxusercontent.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://browser-intake-datadoghq.com https://browser-intake-us3-datadoghq.com https://browser-intake-us5-datadoghq.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://events.statsigapi.net/v1/rgstr https://statsigapi.net/v1/sdk_exception https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.dropbox.com https://*.dropboxapi.com https://*.dropboxstatic.com https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://forms.hubspot.com https://*.pubnub.com https://docsend-prod.s3.amazonaws.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://assets.docsend.com https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com https://js-na1.hs-scripts.com https://js.hscollectedforms.net https://js.hsleadflows.net https://js.stripe.com https://checkout.stripe.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://maps.googleapis.com https://static.filestackapi.com https://zapier.com https://d2wy8f7a9ursnm.cloudfront.net https://polyfill.io/v3/polyfill.min.js 'nonce-g67aI6u2BSxX0vByJUiquA=='; report-uri https://www.dropbox.com/csp_log?policy_name=docsend; default-src 'self'; base-uri 'self'; child-src 'self' blob:; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://assets.docsend.com https://*.previews.dropboxusercontent.com/ https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://www.dropbox.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' blob: data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com https://*.dropboxusercontent.com; object-src 'none'; style-src 'self' 'unsafe-inline' https://assets.docsend.com https://fonts.googleapis.com https://tagmanager.google.com https://static.filestackapi.com https://use.fontawesome.com https://vjs.zencdn.net; worker-src 'self' blob:
Content-Type: text/html; charset=utf-8
Date: Fri, 12 Apr 2024 00:40:49 GMT
Location: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1712882450&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=vyByqiQZLBer9EyxMMTCdMQB0A9c9%2BrZjOxstal6CxY%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1712882450&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=vyByqiQZLBer9EyxMMTCdMQB0A9c9%2BrZjOxstal6CxY%3D
Server: Cowboy
Strict-Transport-Security: max-age=31556952; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: Accept-Encoding, Origin
Via: 1.1 vegur, 1.1 d643c18c094f3cd17f1bf4efe422c294.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Q2PItT-25LhzKjKnjBsRcOQ-hirkltZ8T67B6nwASUywURzk8RIcdg==
X-Amz-Cf-Pop: SFO20-C1
X-Cache: Miss from cloudfront
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Request-Id: 4e076fc4-cf95-4294-bcc4-04ea8d216088
X-Runtime: 0.266510

GET
H2 200 favicon.ico
bytes.com/ 6 KB
7 KB 6ms
5ms Other
image/x-icon 34.49.238.24
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://bytes.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.49.238.24 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 24.238.49.34.bc.googleusercontent.com
Software: LiteSpeed /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 00:35:58 GMT
via: 1.1 google
last-modified: Wed, 24 Feb 2021 13:19:37 GMT
server: LiteSpeed
age: 292
etag: "1976-60365269-11ccbf0551a89e1b;;;"
content-type: image/x-icon
cache-control: public,max-age=3600
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6518

GET
H/1.1 200
OK TCaptcha-global.js Show response
ca.turing.captcha.qcloud.com/ 106 KB
33 KB 1752ms
430ms Script
text/javascript 43.154.240.111
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ca.turing.captcha.qcloud.com/TCaptcha-global.js
Requested by: Host: drive.securegsb.cfd
URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.154.240.111 Hong Kong, Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software: Trpc httpd, tencent http server /
Resource Hash: d719f73463e9691d74e651e532ea55c49699e0718e9c70a1a16227afaa09f08a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 12 Apr 2024 00:40:53 GMT
Content-Encoding: gzip
Server: Trpc httpd, tencent http server
Transfer-Encoding: chunked
P3P: CP=CAO PSA OUR
Content-Type: text/javascript
Cache-Control: max-age=600
Connection: keep-alive

GET
H/1.1 200
OK tcaptcha-frame.a3b4aa9f.js Show response
global.turing.captcha.gtimg.com/ 202 KB
65 KB 909ms
14ms Script
application/javascript 211.152.154.242
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to

Full URL: https://global.turing.captcha.gtimg.com/tcaptcha-frame.a3b4aa9f.js
Requested by: Host: ca.turing.captcha.qcloud.com
URL: https://ca.turing.captcha.qcloud.com/TCaptcha-global.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 211.152.154.242 Melbourne, Australia, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software: tencent-cos /
Resource Hash: d543b0cdc38d744ab2b5aa7e394c8005e8ba65baf7bf23a93374656e41259518

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 12 Mar 2024 09:26:24 GMT
Content-Encoding: gzip
x-cos-hash-crc64ecma: 4322838236147498450
Last-Modified: Thu, 07 Mar 2024 02:49:09 GMT
Server: tencent-cos
X-Cache-Lookup: Cache Hit
Etag: "903167abcdfda3f6ed3fd4acd60425c9"
Content-Type: application/javascript
x-cos-request-id: NjVmMDFmYzBfMzg1MTA2MDlfNGQ1MV8xY2Y0YzFj
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
X-NWS-LOG-UUID: 6696301221531535451
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 66348

GET
H2 200 Untitled-design-5.png
i.postimg.cc/DzpHM6v4/ 386 KB
386 KB 864ms
302ms Image
image/png 108.181.3.133
AS40676

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/DzpHM6v4/Untitled-design-5.png
Requested by: Host: drive.securegsb.cfd
URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.181.3.133 Los Angeles, United States, ASN40676 (AS40676, US),
Reverse DNS: unassigned.psychz.net
Software: openresty /
Resource Hash: fd683568ee95faadf8a13408b809e11ebd79b48a2a35341eed6ad6b505cf5719

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 00:40:54 GMT
last-modified: Mon, 25 Mar 2024 22:38:31 GMT
server: openresty
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 394831
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK drag_ele_global.html
global.turing.captcha.gtimg.com/template/ Frame EB27 0
0 39ms
14ms Document
text/html 211.152.154.242
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to

Full URL: https://global.turing.captcha.gtimg.com/template/drag_ele_global.html
Requested by: Host: global.turing.captcha.gtimg.com
URL: https://global.turing.captcha.gtimg.com/tcaptcha-frame.a3b4aa9f.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 211.152.154.242 Melbourne, Australia, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software: Trpc httpd tencent http server /
Resource Hash

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://drive.securegsb.cfd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 34054
Content-Type: text/html
Date: Tue, 12 Mar 2024 10:48:33 GMT
P3P: CP=CAO PSA OUR
Pragma: No-cache
Server: Trpc httpd tencent http server
X-Cache-Lookup: Cache Hit
X-NWS-LOG-UUID: 7417203020298022994

GET
H3 404 favicon.ico
drive.securegsb.cfd/ 0
417 B 634ms
634ms Other
text/html 172.67.216.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://drive.securegsb.cfd/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.216.145 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 00:40:57 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2rRbqM5NqfHBfsvq4lpXZMh5qYqVI93LaTMaBVrwJEFlqw0IBm0t7XCy4EeVomzBdAKhiAFOHYkqO6RCu0A8g%2FplWb5PbkxDY1urxs%2FtsfAFG90LZBH271wLmjVt1dZujTTvIMJN"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 872f2afc1d105c09-SYD
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.docsend.com/	1970-01-21 04:33:38	Name: _v_ Value: A2N7Skf0bYQJijq71LpVFEKVMXTTChTO67iwnLxvt4gOFmwS428YhvfbnkIcBjUQhzkG7TVqSrCGcVJ9x24j0RRqHLPjpf8qqXp25xSFb2GOGz3Nkg%3D%3D--hc6yd1K5V61z8OPp--fj3STyCGGP9891aQXXmEWg%3D%3D
.docsend.com/	1970-01-21 05:24:02	Name: _us_ Value: eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJZzkyYVdWM1pXUWdaRzlqQmpvR1JWUT0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5fdXNfIn19--0a19c6dc51d459746e8b01d901655a78795a6225
.docsend.com/	1969-12-31 23:59:59	Name: _dss_ Value: e1a881bb486052c361e8d9b71641d83d
.securegsb.cfd/	1970-01-20 19:48:06	Name: FMWV Value: 9fd1dbb3b004e5e1ab98cd1e7ae6e0d64bd9a05c50663a5cbe8840c70a37cdcd

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://drive.securegsb.cfd/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bytes.com
ca.turing.captcha.qcloud.com
docsend.com
drive.securegsb.cfd
global.turing.captcha.gtimg.com
i.postimg.cc
108.181.3.133
13.227.74.4
172.67.216.145
211.152.154.242
34.49.238.24
43.154.240.111
2e70eb585fef3a7bf8f2888e752d8a1ed2337015554109ae03731c65b0c9a7aa
d543b0cdc38d744ab2b5aa7e394c8005e8ba65baf7bf23a93374656e41259518
d719f73463e9691d74e651e532ea55c49699e0718e9c70a1a16227afaa09f08a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebf75c91dfe84c5b73f345bff21f8e433d2f5f2770ad8410e62f21735ddd17ff
fd683568ee95faadf8a13408b809e11ebd79b48a2a35341eed6ad6b505cf5719

drive.securegsb.cfd Open in urlscan Pro 172.67.216.145 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

5 IPs

3 Countries

494 kBTransfer

704 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

4 Cookies

1 Console Messages

Security Headers

Indicators

drive.securegsb.cfd Open in urlscan Pro
172.67.216.145 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

494 kB
Transfer

704 kB
Size

4
Cookies

8 HTTP transactions
0 data transactions