aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2c6b  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://1944c992bfee4151402cb9d28.pages.dev/ Page URL
2. https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?z9tl1c=c06b48fe9e9e70b81dceaee5e962b9f&n2xye=mif8z3l&fbtqrjd=ab19d5262c6f7bfa4df19c782a04&4uv02g3zl=e99bb85f049a52cffe058&vdwtmr=z4n1&t2fba=84dd0c838dc77156c2b10e45588d6682be1e1e7d Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response 1944c992bfee4151402cb9d28.pages.dev/	21 KB 15 KB	406ms 196ms	Document text/html	2606:4700:310c::ac42:2f88 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2f88 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13e04ca239b4a41d5e79837e7e431ff85a25e7634a7214ee9356ab4cf926495d Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 84f6fb58a930099a-MIA content-encoding br content-type text/html; charset=utf-8 date Sat, 03 Feb 2024 01:43:14 GMT etag W/"888bb8e168f4b0ec97b5884c938f0549" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1COJogMArlxSLJG3RMRC8tkrHTH3rXoPmajOU3ekv1diZNfGmT3vjcDU5YbY2TTxRf4WxMSRydwoiKVOPUCiTueNGNlx1VjAabCPfzfp8v%2BQzxjJ3wSjDSsLRDFIExAT3IXbHDi0Da7usio2kh4YajdAtMSUs2idkhN7zalBsJHOLQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.4/	88 KB 31 KB	208ms 65ms	Script text/javascript	2607:f8b0:4006:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://1944c992bfee4151402cb9d28.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Thu, 01 Feb 2024 09:11:51 GMT content-encoding gzip x-content-type-options nosniff age 145883 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31154 x-xss-protection 0 last-modified Tue, 04 Apr 2023 03:27:01 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 31 Jan 2025 09:11:51 GMT
GET DATA	200 OK	truncated /	13 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ff1197d661ec23e0e8ae066305396bc0d8fb478d2ded1e994249974f7fa6cb1f Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/png
POST H2	200	get.php fetchlnk.truesharingzone.site/	257 B 354 B	936ms 641ms	XHR text/html	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://fetchlnk.truesharingzone.site/get.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept text/html, */*; q=0.01 Referer https://1944c992bfee4151402cb9d28.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Sat, 03 Feb 2024 01:43:15 GMT content-encoding br server LiteSpeed x-powered-by PHP/8.0.30 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * x-turbo-charged-by LiteSpeed content-length 182
GET H2	200	Primary Request / Show response aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/	4 KB 2 KB	181ms 75ms	Document text/html	2606:4700:310c::ac42:2c6b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?z9tl1c=c06b48fe9e9e70b81dceaee5e962b9f&n2xye=mif8z3l&fbtqrjd=ab19d5262c6f7bfa4df19c782a04&4uv02g3zl=e99bb85f049a52cffe058&vdwtmr=z4n1&t2fba=84dd0c838dc77156c2b10e45588d6682be1e1e7d Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:310c::ac42:2c6b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 086c52c9aa45fc98ed32f1e513aa82109b424752874ffa985e3ab0e1536baea9 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://1944c992bfee4151402cb9d28.pages.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 84f6fb6279bb743d-MIA content-encoding br content-type text/html; charset=utf-8 date Sat, 03 Feb 2024 01:43:15 GMT etag W/"05ba45d52901c683c4065de6f6fd5111" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p7sdZcOmvor7OrV1oNnODI1ly5XQ7%2BCJ78a%2F3LgPuoEHLOFm0uXkIpnBIPEQL2YAxiEXM6PQehhugMTytkBXbR6QDM9sd%2B5MDsnQAiHHrB8zdlBWpei%2FWC0kBVvKL7hhZVRPTSfN%2BRpuf1rlD3X2VtJ%2F1xeeDP6CbSAIMMG%2FXuEgehnd9sVmZVaT3puxnTbyEDg%2FoQNstfYwOWNnbih%2FzEiGGQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.4/	88 KB 31 KB	71ms 70ms	Script text/javascript	2607:f8b0:4006:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Requested by Host: aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev URL: https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?z9tl1c=c06b48fe9e9e70b81dceaee5e962b9f&n2xye=mif8z3l&fbtqrjd=ab19d5262c6f7bfa4df19c782a04&4uv02g3zl=e99bb85f049a52cffe058&vdwtmr=z4n1&t2fba=84dd0c838dc77156c2b10e45588d6682be1e1e7d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Thu, 01 Feb 2024 09:11:51 GMT content-encoding gzip x-content-type-options nosniff age 145884 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31154 x-xss-protection 0 last-modified Tue, 04 Apr 2023 03:27:01 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 31 Jan 2025 09:11:51 GMT
POST H2	200	ready-page.php Show response fetchlnk.truesharingzone.site/	313 KB 106 KB	198ms 197ms	XHR text/html	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://fetchlnk.truesharingzone.site/ready-page.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash 3cd5cf8e36aa778d0711f3b21ecb22e500df86b530cf27010881fadf785bcac5 Request headers Accept text/html, */*; q=0.01 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Sat, 03 Feb 2024 01:43:15 GMT content-encoding br server LiteSpeed x-powered-by PHP/8.0.30 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * x-turbo-charged-by LiteSpeed
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 22 KB	139ms 53ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ Origin https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 878 cdn-cachedat 09/04/2022 07:20:45 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"450fc463b8b1a349df717056fbb3e078" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 9ff182e474ab8cc6d8e42dea2655c7a9 timing-allow-origin * cdn-requestcountrycode US cdn-status 200 cf-ray 84f6fb66daea5c81-MIA cdn-requestpullsuccess True
GET H2	400	css fonts.googleapis.com/	0 0	226ms 78ms	Stylesheet text/html	2607:f8b0:4006:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=SegeoUI&display=swap Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers
GET H2	200	one-drive-icon-28.png myexternalfls.realityresultsposter.store/oned2023/	14 KB 15 KB	760ms 473ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/one-drive-icon-28.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 047cd04c0bf47796870a485d672f90f6b4ec54203957cd520022b46130102a46 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:44 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 14777 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H2	200	out.png myexternalfls.realityresultsposter.store/oned2023/	771 B 971 B	755ms 468ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/out.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:45 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 771 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H2	200	of.png myexternalfls.realityresultsposter.store/oned2023/	18 KB 18 KB	473ms 187ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/of.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:43 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 18147 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H2	200	aol.png myexternalfls.realityresultsposter.store/oned2023/	26 KB 26 KB	566ms 280ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/aol.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash f8a8cf4f1928938c796e2f35f8c21b0d510d4e3f16e016ee83d1f206f8ebde14 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:43 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 26456 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H2	200	yahoo.png myexternalfls.realityresultsposter.store/oned2023/	18 KB 18 KB	755ms 469ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/yahoo.png Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash aad24ed5f36320964c515b9889cb2943bbf830b40703999ad3976fce8176e554 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:46 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 17931 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H2	200	other.ico myexternalfls.realityresultsposter.store/oned2023/	195 KB 195 KB	569ms 284ms	Image image/x-icon	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/other.ico Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 2ef05cf5ee8f394a6399077d91e12ae3ed7f7232336308bcc051feca72d2d7b8 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Thu, 12 Oct 2023 20:06:46 GMT server LiteSpeed content-type image/x-icon cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 199448 expires Sat, 10 Feb 2024 01:43:16 GMT
GET H3	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	65ms 64ms	Script text/javascript	2607:f8b0:4006:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: 1944c992bfee4151402cb9d28.pages.dev URL: https://1944c992bfee4151402cb9d28.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 01 Feb 2024 05:29:23 GMT content-encoding gzip x-content-type-options nosniff age 159233 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 31 Jan 2025 05:29:23 GMT
GET H2	200	bg.png myexternalfls.realityresultsposter.store/oned2023/	184 KB 184 KB	497ms 472ms	Image image/png	162.254.39.141 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://myexternalfls.realityresultsposter.store/oned2023/bg.png Requested by Host: aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev URL: https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/?z9tl1c=c06b48fe9e9e70b81dceaee5e962b9f&n2xye=mif8z3l&fbtqrjd=ab19d5262c6f7bfa4df19c782a04&4uv02g3zl=e99bb85f049a52cffe058&vdwtmr=z4n1&t2fba=84dd0c838dc77156c2b10e45588d6682be1e1e7d Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.254.39.141 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium288-5.web-hosting.com Software LiteSpeed / Resource Hash 2e20f3c43b72e5bdb626d5ad5e035ae0b3beacba19eae10c52ed35216885e203 Request headers accept-language en-US,en;q=0.9 Referer https://aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers date Sat, 03 Feb 2024 01:43:16 GMT last-modified Wed, 18 Oct 2023 20:30:33 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 188287 expires Sat, 10 Feb 2024 01:43:16 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getAllUrlParams function| testJSON function| geturlparameter function| saveFile function| getHashOrUrlParVal object| os object| n string| rdrt number| rc string| f

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://fonts.googleapis.com/css?family=SegeoUI&display=swap Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1944c992bfee4151402cb9d28.pages.dev
aded674be2a25fe5ad33fff271deb368292704f23ca879936d6e368a4f.pages.dev
ajax.googleapis.com
fetchlnk.truesharingzone.site
fonts.googleapis.com
maxcdn.bootstrapcdn.com
myexternalfls.realityresultsposter.store
162.254.39.141
2606:4700:310c::ac42:2c6b
2606:4700:310c::ac42:2f88
2606:4700::6812:acf
2607:f8b0:4006:809::200a
2607:f8b0:4006:81c::200a
047cd04c0bf47796870a485d672f90f6b4ec54203957cd520022b46130102a46
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
086c52c9aa45fc98ed32f1e513aa82109b424752874ffa985e3ab0e1536baea9
13e04ca239b4a41d5e79837e7e431ff85a25e7634a7214ee9356ab4cf926495d
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2e20f3c43b72e5bdb626d5ad5e035ae0b3beacba19eae10c52ed35216885e203
2ef05cf5ee8f394a6399077d91e12ae3ed7f7232336308bcc051feca72d2d7b8
3cd5cf8e36aa778d0711f3b21ecb22e500df86b530cf27010881fadf785bcac5
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
aad24ed5f36320964c515b9889cb2943bbf830b40703999ad3976fce8176e554
f8a8cf4f1928938c796e2f35f8c21b0d510d4e3f16e016ee83d1f206f8ebde14
ff1197d661ec23e0e8ae066305396bc0d8fb478d2ded1e994249974f7fa6cb1f