pub-46d5657c20aa44028defdbcf65c12db8.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.diom.hu/boots-52596.html
Effective URL:
https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Submission: On May 15 via api (May 15th 2024, 9:24:57 pm UTC) from US — Scanned from DE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 5 countries across 10 domains to perform 22 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-46d5657c20aa44028defdbcf65c12db8.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-46d5657c20aa44028defdbcf65c12db8.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online) Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	217.79.142.5 217.79.142.5	8448 (CETIN-HU ...) (CETIN-HU Torokbalint)
5	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2606:4700::68... 2606:4700::6812:18a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:ec80:300... 2a02:ec80:300:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
22	8

1 217.79.142.5 (Budapest, Hungary) 1 redirects

ASN8448 (CETIN-HU Torokbalint, Hungary, HU)

www.diom.hu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-46d5657c20aa44028defdbcf65c12db8.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:18a3 (United States)

ASN13335 (CLOUDFLARENET, US)

i.gyazo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:ec80:300:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	gyazo.com i.gyazo.com — Cisco Umbrella Rank: 105614	307 KB
5	r2.dev pub-46d5657c20aa44028defdbcf65c12db8.r2.dev	30 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1103 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3044	29 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	30 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 237	7 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	24 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 3017	11 KB
1	diom.hu 1 redirects www.diom.hu	243 B
0	microsoft.com Failed learn.microsoft.com — Cisco Umbrella Rank: 11344 Failed
0	keycdn.com Failed opensource.keycdn.com Failed
22	10

	Domain	Requested by
8	i.gyazo.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
5	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	stackpath.bootstrapcdn.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	ajax.googleapis.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	maxcdn.bootstrapcdn.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	cdnjs.cloudflare.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	code.jquery.com	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	upload.wikimedia.org	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
1	www.diom.hu	1 redirects
0	learn.microsoft.com Failed
0	opensource.keycdn.com Failed	pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
22	11

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
gyazo.com E1	`2024-04-03` - `2024-07-02`	3 months	crt.sh
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-18` - `2024-10-16`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
bootstrapcdn.com GTS CA 1P5	`2024-03-27` - `2024-06-25`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Frame ID: 26B88E30385C22935EE95EB4B9293587
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Adobe

Page URL History Show full URLs

https://www.diom.hu/boots-52596.html HTTP 301
https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

22
Requests

86 %
HTTPS

63 %
IPv6

10
Domains

11
Subdomains

8
IPs

5
Countries

437 kB
Transfer

613 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.diom.hu/boots-52596.html HTTP 301
https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

https://docs.com/1673155405_Images/favicon.ico HTTP 301
https://www.docs.com/1673155405_Images/favicon.ico HTTP 301
https://learn.microsoft.com/ HTTP 301
https://learn.microsoft.com/de-de/

Request Chain 20

https://docs.com/1673155405_Images/favicon.ico HTTP 301
https://www.docs.com/1673155405_Images/favicon.ico HTTP 301
https://learn.microsoft.com/ HTTP 301
https://learn.microsoft.com/de-de/

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request Paidinvoices.html Show response
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Redirect Chain

https://www.diom.hu/boots-52596.html
https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

27 KB
28 KB

630ms
518ms

Document
text/html

2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de13f6b671cf8b975a2940b06f633567f1bffe2fb2d25a8f4e004713e07ab808

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 884632837ba19972-FRA
Connection: keep-alive
Content-Length: 28148
Content-Type: text/html
Date: Wed, 15 May 2024 21:24:52 GMT
ETag: "19edc9522b9053efee63651a00a3d241"
Last-Modified: Wed, 15 May 2024 18:15:14 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 707
content-type: text/html
date: Wed, 15 May 2024 21:24:52 GMT
location: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

GET font-awesome.min.css
opensource.keycdn.com/fontawesome/4.6.3/ 0
0

GET
H/1.1 404
Not Found smallpdf.png
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/ 1 KB
1 KB 159ms
159ms Image
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/smallpdf.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 288866a28377f1d451df8e97fec63d3281db96753233211912377d75086b82c3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 15 May 2024 21:24:53 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 88463286bea19972-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H2 200 2c9a9eb978ff3a4a4f208b2c45739fd3.png
i.gyazo.com/ 31 KB
31 KB 275ms
107ms Image
image/png 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/2c9a9eb978ff3a4a4f208b2c45739fd3.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5a135bd47b11881dc1a223ea1ea946e6ca5e7cb3b1af58eef8629ea017dbd4e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 872847
content-length: 31580
server: cloudflare
etag: "2c9a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc739207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 2e6a7c17a90b17b5ff2019543193b4e9.jpg
i.gyazo.com/ 5 KB
5 KB 275ms
107ms Image
image/jpeg 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/2e6a7c17a90b17b5ff2019543193b4e9.jpg
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 505469
content-length: 4687
cf-bgj: h2pri
server: cloudflare
etag: "2e6a"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc769207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 200px-AOL_Eraser.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/a/a2/AOL_Eraser.svg/ 10 KB
11 KB 245ms
71ms Image
image/png 2a02:ec80:300:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/a/a2/AOL_Eraser.svg/200px-AOL_Eraser.svg.png

Requested by

Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:ec80:300:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

envoy /

Resource Hash

8e982c922dc592371d022343be26330264a811cbf26885f5c89839e711914a1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 23:55:36 GMT
strict-transport-security: max-age=106384710; includeSubDomains; preload
x-content-type-options: nosniff
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 77356
x-cache-status: hit-front
x-cache: cp3075 hit, cp3075 hit/1
content-disposition: inline;filename*=UTF-8''AOL_Eraser.svg.png
server-timing: cache;desc="hit-front", host;desc="cp3075"
content-length: 9929
x-client-ip: 2a01:4a0:1338:93::9
x-object-meta-sha1base36: 1e173krnq4omrwr237t82q9ornr6tpi
last-modified: Wed, 25 May 2016 02:56:27 GMT
server: envoy
etag: 5e8a910616b6d430b573d9a9b7f7fb80
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 060e9d726f9bb555eb94f15474b6fd65.png
i.gyazo.com/ 2 KB
2 KB 278ms
110ms Image
image/png 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/060e9d726f9bb555eb94f15474b6fd65.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 150635dc2c0d83b291bca970628370ff2a04c760c3bb7c1ff52aee296b6287d5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 194044
content-length: 2079
server: cloudflare
etag: "060e"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc749207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 8b09deab09d58e1261bbb6cbc5e89559.jpg
i.gyazo.com/ 14 KB
14 KB 265ms
106ms Image
image/jpeg 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/8b09deab09d58e1261bbb6cbc5e89559.jpg
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cf605381ef8acee469f427fb203acf2e5fedf6056208215be170bf7421e3433

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 194044
content-length: 14024
cf-bgj: h2pri
server: cloudflare
etag: "8b09"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc6e9207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 1cd4efa81de96d9776b7cdb887745acf.gif
i.gyazo.com/ 6 KB
6 KB 269ms
110ms Image
image/gif 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/1cd4efa81de96d9776b7cdb887745acf.gif
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7ead6c56b3245b1bc31fff1b4c97e4e0190dae25116d9f04dcaca0ae8b30f4a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
server: cloudflare
age: 194044
etag: "1cd4"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 88463287dc6c9207-FRA
content-length: 6210
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 c2bddd4e69aba81bcf138fa9028df5fb.png
i.gyazo.com/ 12 KB
13 KB 269ms
110ms Image
image/png 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/c2bddd4e69aba81bcf138fa9028df5fb.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91a90597b2e95f89fdcef1fb71c3eef1dd6a9e849ccd4a68dae3a94ceb8a7c8b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 872847
content-length: 12787
server: cloudflare
etag: "c2bd"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc709207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 8922f8c4f3b73b259c84ee57c2dec1ee.png
i.gyazo.com/ 16 KB
16 KB 265ms
106ms Image
image/png 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/8922f8c4f3b73b259c84ee57c2dec1ee.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f028b5949911c652f1ac727f5c2c8e30d7ae79a7de47a6e392a15073fa18f56

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 872847
content-length: 16053
server: cloudflare
etag: "8922"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc6f9207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 200ms
39ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Origin: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1090913
x-cache: HIT, HIT
content-length: 23856
x-served-by: cache-lga21963-LGA, cache-cph2320053-CPH
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1715808293.079177,VS0,VE0
etag: W/"28feccc0-10fdd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 64, 25336

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 174ms
130ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Origin: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 605774
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6157
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UejUYXfoIuc4P5LGOj1z4ROfHKmhFV6I%2FmmqTR0kGQ5pXL%2BbSYUiukLkIu4uCGKI6lsbQ2tgN61iY0zi%2FT5z2bZLS4Piv0ReDL9iey2%2FsKN8LMYtRrOAD92if3uz1RolsPhfSmz%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8846328798c83829-FRA
expires: Mon, 05 May 2025 21:24:53 GMT

GET
H3 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
15 KB 186ms
129ms Script
application/javascript 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Origin: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1048
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 216
cdn-cachedat: 03/18/2024 12:46:36
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 289dea0a8eb3f94d810754fba3fab00a
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 884632879d6bbf47-WAW
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 212ms
39ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 11:27:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 May 2025 11:27:42 GMT

GET
H3 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 216ms
64ms Script
application/javascript 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 723
age: 2684203
cdn-cachedat: 11/15/2021 23:30:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: a35b0179a28ed953258d0fb41376a09c
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 88463287cbf1bf60-WAW
cdn-requestpullsuccess: True

GET
H/1.1 404
Not Found bg.jpg
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/ 1 KB
1 KB 292ms
132ms Image
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/bg.jpg
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 288866a28377f1d451df8e97fec63d3281db96753233211912377d75086b82c3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 15 May 2024 21:24:53 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 88463287dd769c10-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H2 200 d2bd26943cffcb06ab98eabd235b241e.png
i.gyazo.com/ 221 KB
221 KB 227ms
68ms Image
image/png 2606:4700::6812:18a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/d2bd26943cffcb06ab98eabd235b241e.png
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f72377384851c6da4a852bb9f81af00bbd17deed81290023918d73eb8b00042

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 21:24:53 GMT
via: 1.1 google
cf-cache-status: HIT
age: 107182
content-length: 225894
server: cloudflare
etag: "d2bd"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 88463287dc6d9207-FRA
expires: Thu, 15 May 2025 21:24:53 GMT

GET
H/1.1 404
Not Found et-line.woff
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/ 0
0 273ms
132ms Font
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/et-line.woff
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Origin: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 15 May 2024 21:24:53 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 88463287bf929972-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H/1.1 404
Not Found et-line.ttf
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/ 0
0 519ms
519ms Font
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/et-line.ttf
Requested by: Host: pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html
Origin: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 15 May 2024 21:24:53 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 884632889ed44dc5-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET

/
learn.microsoft.com/de-de/
Redirect Chain

https://docs.com/1673155405_Images/favicon.ico
https://www.docs.com/1673155405_Images/favicon.ico
https://learn.microsoft.com/
https://learn.microsoft.com/de-de/

0
0

GET

/
learn.microsoft.com/de-de/
Redirect Chain

https://docs.com/1673155405_Images/favicon.ico
https://www.docs.com/1673155405_Images/favicon.ico
https://learn.microsoft.com/
https://learn.microsoft.com/de-de/

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: opensource.keycdn.com
URL: https://opensource.keycdn.com/fontawesome/4.6.3/font-awesome.min.css

Domain: learn.microsoft.com
URL: https://learn.microsoft.com/de-de/

Domain: learn.microsoft.com
URL: https://learn.microsoft.com/de-de/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Adobe (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			i.gyazo.com/	1970-01-21 06:12:48	Name: Gyazo_cfwoker Value: i

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://opensource.keycdn.com/fontawesome/4.6.3/font-awesome.min.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/smallpdf.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
recommendation	verbose	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/Paidinvoices.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/et-line.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/images/bg.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://pub-46d5657c20aa44028defdbcf65c12db8.r2.dev/fonts/et-line.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
i.gyazo.com
learn.microsoft.com
maxcdn.bootstrapcdn.com
opensource.keycdn.com
pub-46d5657c20aa44028defdbcf65c12db8.r2.dev
stackpath.bootstrapcdn.com
upload.wikimedia.org
www.diom.hu
learn.microsoft.com
opensource.keycdn.com
104.17.24.14
104.18.11.207
217.79.142.5
2606:4700::6812:18a3
2606:4700::6812:223
2a00:1450:4001:806::200a
2a02:ec80:300:ed1a::2:b
2a04:4e42:200::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0cf605381ef8acee469f427fb203acf2e5fedf6056208215be170bf7421e3433
0f72377384851c6da4a852bb9f81af00bbd17deed81290023918d73eb8b00042
150635dc2c0d83b291bca970628370ff2a04c760c3bb7c1ff52aee296b6287d5
288866a28377f1d451df8e97fec63d3281db96753233211912377d75086b82c3
2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5
3f028b5949911c652f1ac727f5c2c8e30d7ae79a7de47a6e392a15073fa18f56
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
8e982c922dc592371d022343be26330264a811cbf26885f5c89839e711914a1a
91a90597b2e95f89fdcef1fb71c3eef1dd6a9e849ccd4a68dae3a94ceb8a7c8b
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b7ead6c56b3245b1bc31fff1b4c97e4e0190dae25116d9f04dcaca0ae8b30f4a
d5a135bd47b11881dc1a223ea1ea946e6ca5e7cb3b1af58eef8629ea017dbd4e
de13f6b671cf8b975a2940b06f633567f1bffe2fb2d25a8f4e004713e07ab808
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

pub-46d5657c20aa44028defdbcf65c12db8.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

86 %HTTPS

63 %IPv6

10 Domains

11 Subdomains

8 IPs

5 Countries

437 kBTransfer

613 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

14 Console Messages

Indicators

pub-46d5657c20aa44028defdbcf65c12db8.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

86 %
HTTPS

63 %
IPv6

10
Domains

11
Subdomains

8
IPs

5
Countries

437 kB
Transfer

613 kB
Size

1
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!