urlscan.io logo urlscan.io
SecurityTrails logo

f-online.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2fbd  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://f-online.pages.dev/at/
Submission: On November 21 via api from LU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main IP is 2606:4700:310c::ac42:2fbd, located in United States and belongs to CLOUDFLARENET, US. The main domain is f-online.pages.dev.
TLS certificate: Issued by WE1 on November 20th 2024. Valid for: 3 months.
This is the only time f-online.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
1 14 2606:4700:310... 13335 (CLOUDFLAR...)
1 144.76.88.114 24940 (HETZNER-A...)
4 34.149.250.58 396982 (GOOGLE-CL...)
18 4
Apex Domain
Subdomains		 Transfer
14 pages.dev
f-online.pages.dev
46 KB
4 sanity.io
cdn.sanity.io — Cisco Umbrella Rank: 11236
40 KB
1 inlupus.at
piwik.inlupus.at
68 KB
18 3
Domain Requested by
14 f-online.pages.dev 1 redirects f-online.pages.dev
4 cdn.sanity.io f-online.pages.dev
1 piwik.inlupus.at f-online.pages.dev
18 3
Subject Issuer Validity Valid
f-online.pages.dev
WE1		 2024-11-20 -
2025-02-18		 3 months crt.sh
piwik.inlupus.at
R10		 2024-11-09 -
2025-02-07		 3 months crt.sh
*.sanity.io
Sectigo RSA Domain Validation Secure Server CA		 2024-09-18 -
2025-09-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://f-online.pages.dev/at/
Frame ID: 516290EBB1207EA6E44EF118F4C9BE01
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Kostenlos für den österr. Führerschein lernen - F-Online

Page URL History Show full URLs

  1. https://f-online.pages.dev/at/ Page URL
  2. https://f-online.pages.dev/cdn-cgi/phish-bypass?atok=UWAVQQ9QJBaFohMU5wSss3MHcw_lpCCDrdUAn5kXuQc-173215... HTTP 301
    https://f-online.pages.dev/at/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Page Statistics

18
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

153 kB
Transfer

281 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://f-online.pages.dev/at/ Page URL
  2. https://f-online.pages.dev/cdn-cgi/phish-bypass?atok=UWAVQQ9QJBaFohMU5wSss3MHcw_lpCCDrdUAn5kXuQc-1732158559-0.0.1.1-%2Fat%2F HTTP 301
    https://f-online.pages.dev/at/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
f-online.pages.dev/at/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cb0580e9262d8cb39d17cd653af55695a3dc1961c79b39b5a22506369171bd1
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36

Response headers

cf-ray
8e5d7af4c8cf3807-FRA
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 21 Nov 2024 03:09:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xmJV%2FZunABMNPhwg0y%2FJ0qzI50XliM7ZOkbMpt2dtpmQjrEvxAEzoDTV62qXJXzAiGWFmzv3mKXGzH0CLMEvs9XMajU8gWofJTzLnPqbIXK0E9MA8MyN%2BfYu4B6pw73swBF4r2LqdeitmEsOQmwz47o%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cf.errors.css
f-online.pages.dev/cdn-cgi/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/cdn-cgi/styles/cf.errors.css
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
content-encoding
gzip
etag
W/"67379e96-5df3"
x-content-type-options
nosniff
cf-ray
8e5d7af4e8d63807-FRA
expires
Thu, 21 Nov 2024 05:09:19 GMT
date
Thu, 21 Nov 2024 03:09:19 GMT
content-type
text/css
last-modified
Fri, 15 Nov 2024 19:18:46 GMT
server
cloudflare
x-frame-options
DENY
icon-exclamation.png
f-online.pages.dev/cdn-cgi/images/ 		452 B
635 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f-online.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/cdn-cgi/styles/cf.errors.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
etag
"67379e96-1c4"
x-content-type-options
nosniff
cf-ray
8e5d7af4f8de3807-FRA
expires
Thu, 21 Nov 2024 05:09:19 GMT
accept-ranges
bytes
content-length
452
date
Thu, 21 Nov 2024 03:09:19 GMT
content-type
image/png
last-modified
Fri, 15 Nov 2024 19:18:46 GMT
server
cloudflare
x-frame-options
DENY
favicon.ico
f-online.pages.dev/ 		4 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc79337d4e0be868add5df6909edd129a41079ed4d4b831492e197842548f3af
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TzPmXw9GxyJyQDK37PVZ2DFxPAGgwOBECo%2FUiwjFbwdwhfltne4eDqvI9sQSoT10xChphog1WZvX0QXwXdVYLtYfkdQUA%2BL7HIyU6Q%2FfpQMuv8QyY7PK3Qmluxj0w1z%2FxTIYjHNZUmsjoCBJXkGYUa0%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7af518ea3807-FRA
date
Thu, 21 Nov 2024 03:09:19 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
Primary Request /
f-online.pages.dev/at/
Redirect Chain
  • https://f-online.pages.dev/cdn-cgi/phish-bypass?atok=UWAVQQ9QJBaFohMU5wSss3MHcw_lpCCDrdUAn5kXuQc-1732158559-0.0.1.1-%2Fat%2F
  • https://f-online.pages.dev/at/
119 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3746a12c5f494f6f93b0d6e311486484e5a59d16a289de084aa3959d400f72c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://f-online.pages.dev/at/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8e5d7b0dec543807-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 21 Nov 2024 03:09:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nY0yQ9co3NnxtBKqqZh4QlUb%2BGSmT7U%2BQcXEjmzp4baAvpON5cbChAao5LGj9YFDINo5b0RMJ6dJ1YzK%2FEKg5vrx%2FuvIDEZiQ9Sgr1tS2lLmHkCESJW2b3DNP%2BSN2hnAVoPVJ2JsMuaIqAPqp0eXtM%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=7399&sent=26&recv=20&lost=0&retrans=0&sent_bytes=14757&recv_bytes=6725&delivery_rate=921&cwnd=12000&unsent_bytes=0&cid=9140db2c29e9292e&ts=4723&x=1" cfHdrFlush;dur=0
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

cache-control
private, no-cache
cf-ray
8e5d7b0ddc513807-FRA
content-length
167
content-type
text/html
date
Thu, 21 Nov 2024 03:09:23 GMT
location
https://f-online.pages.dev/at/
server
cloudflare
x-content-type-options
nosniff
x-frame-options
DENY
logo.svg
f-online.pages.dev/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f-online.pages.dev/logo.svg
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1b163141a3a91d5d90b215179a8d97fcdecf0d576b8e50d3303a99bdb6688871
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7AgHgXy7P2dM3mcUhCmTBZXap7SSa%2FsjetPfovC7pLE7xgggBTrYngn5gezG8UqAYhv52XiwJ1KPkqr%2FXvN7ptcQarQxjagEUVFhPbgmtOykBtBG86Dv54QI%2BX91wBcdNmwGQQ2sJxTpCPRIPJ6EgA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b124e473807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
download-app-store.svg
f-online.pages.dev/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f-online.pages.dev/download-app-store.svg
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0de3cd4b99c0babed63a2118249398747da1f710f65f0fe291cd73626b9d1d5d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ACIhgmUvUUez96trQhhi2l0gdCWHw6h%2FBEXewSKYX8cJhmzpr6gfsDVxrrkYeDkQFB5eej0LtbF85cuZbLlCzKseg4cnog8uicBYbvGs1RQwYyRk6RjVmGZZ2mwfc3EkC7nMgw0jGs1BhgMu0n1jpQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b124e483807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
download-play-store.svg
f-online.pages.dev/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f-online.pages.dev/download-play-store.svg
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
426a797450340fe1aba734e876787a4a1c82c34e76cfe2ad4e729c4c275280ef
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YVVcfa%2B14amqqVFjHMHoT886U%2BafLUA%2BO6f0LMgJX8SG57LpTpTM9VFyzs4yLKrhOy1j7fD8j5hb%2FDqrJDhQIYTKQ%2F%2B7mByo74Y6vqEGILhVoR4G8nQ3kZfteumTkUATFtZ7FsVqMS8uHCy5lD1N0UQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b125e513807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
truncated
/ 		86 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ca2d77832def7453e055e53be8453d221de93c9d4a07906ce7d9f9a0c95258a

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		83 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
752906974fbb6884252ed40a3aee277e58bcd2b8953e51a2c5e6b44887274c74

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		87 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a6ce075a1162d3d6e3d02979c54d0d42e2803bea7f2ec8969948ba37d31c648b

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		87 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
11124d25b00d875cc536a3e2c29fed4de74ffbbf03972e5c1e69c2013823c502

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		85 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
18c5dfedc3dd82f400859be8862f8ad89e71e3089f570b75a7230defb4cd8ff5

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		85 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
37f31cd2ef051cc40ebcc6b59a32fc9d8ff954f565e8ef03b38f026e10875041

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		87 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ba2a0683995a11c3053ce5f535da6470dad84d99f5d4dc49f959f1ac8e4fecb3

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		85 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7f570750f3101995e440b22ba3d826772564517d88ed04fa8c6a103bf7ffa56

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		85 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
055d395c49b237a166586c92974bf879b8b0f006e19a2c51c081658e0210a388

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8
matomo.js
piwik.inlupus.at// 		67 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://piwik.inlupus.at//matomo.js
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
144.76.88.114 Hamm, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS
gustave.inlupus.at
Software
nginx/1.10.2 /
Resource Hash
52ad1049100fdf161c4986288f8168b86618936b1023834f601ca73f7c864ebf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Cache-Control
max-age=3600, public
ETag
"5ea93913-10def"
Pragma
public
Connection
keep-alive
Expires
Thu, 21 Nov 2024 04:09:24 GMT
Accept-Ranges
bytes
Content-Length
69103
Date
Thu, 21 Nov 2024 03:09:24 GMT
Content-Type
application/javascript
Last-Modified
Wed, 29 Apr 2020 08:21:39 GMT
Server
nginx/1.10.2
Vary
Accept-Encoding
webpack-runtime-a48e136479e4140e854f.js
f-online.pages.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/webpack-runtime-a48e136479e4140e854f.js
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U9qryA2pMV%2FmsMcDkyPZ5SHhohxhJTpk%2FYk%2BZR9UcwoNfZsOslmv0%2BafNlFpb7UWZKp7TQgsAbIoLJjaBxhcYArQb6c4ivVfXzwMRf3hz7I8UbAmhMcmZ1%2FAuXh5Yfx6YLgnUCUqlpUHB6sJym0pVRk%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b126e563807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
framework-e58d96144562e1e1a878.js
f-online.pages.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/framework-e58d96144562e1e1a878.js
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5J34%2FKlyzZrxvYjIX9oKc9nCAsilfQ9K%2FUKiwNCsHstK31xDS81jwSXuQb0q%2FIb7DDzn6x80TKmdjO79GTIsec82Bb5fuoSUfmAKRfO41U1BECxA3Jf1Saz5uhJOHJxMEkBB4XdXUdc6TJw%2FMnavljg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b126e573807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
app-e099c061ce6d9e10fb00.js
f-online.pages.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/app-e099c061ce6d9e10fb00.js
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jozNZ8yk2KhYALrTkqAjar625i2TFJJEBbVDZyaeaPE6HzHRC3veVOyd5RBi9aQXJFws8weJA%2BPkqEp0sIBl7dV6KkDwfTloquRGlCBAV7RqhfgMHM6Eaw9Dc5Xz1mdJBaXZN1vau6dol575yAJEvUU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b126e583807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
d05471877383af46800413a265bdd89af9878cfb-1500x974.png
cdn.sanity.io/images/t9maew4z/production/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.sanity.io/images/t9maew4z/production/d05471877383af46800413a265bdd89af9878cfb-1500x974.png?w=1500&h=974&auto=format
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.250.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.250.149.34.bc.googleusercontent.com
Software
/
Resource Hash
a3ea9c00a6bdfc730ccb74f343419a33e68dd4e628b4966b42f38f71b48eeb2f
Security Headers
Name Value
Content-Security-Policy script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/

Response headers

x-b3-spanid
eb1b5959583ae107
x-b3-parentspanid
105f712be1d3cc79
age
124562
x-content-type-options
nosniff
sanity-gateway
k8s-gcp-eu-w1-prod-ing-01
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 16:33:22 GMT
last-modified
Wed, 31 Dec 1969 23:59:59 GMT
content-type
image/avif
vary
origin, accept
x-sanity-asset-storage
gcs-default
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
script-src 'none'
cache-control
public, max-age=31536000, s-maxage=2592000
x-b3-sampled
0
x-varnish-age
0
via
1.1 google
xkey
project-t9maew4z-production
accept-ranges
bytes
x-b3-traceid
a67b62ec6185d61ae0cd8b5c01daa3e3
content-length
38866
dfd6516433c5b11ce487b74222ebe51627054364-24x24.svg
cdn.sanity.io/images/t9maew4z/production/ 		268 B
369 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.sanity.io/images/t9maew4z/production/dfd6516433c5b11ce487b74222ebe51627054364-24x24.svg?w=24&h=24&auto=format
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.250.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.250.149.34.bc.googleusercontent.com
Software
/
Resource Hash
b3e0d4a28c347c8a7a766191a8ba1a76789e122face9663622320d38fdc2bee1
Security Headers
Name Value
Content-Security-Policy script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/

Response headers

x-b3-spanid
73f76eccb77218cc
x-b3-parentspanid
7a42679b482df782
content-encoding
br
age
124384
x-content-type-options
nosniff
sanity-gateway
k8s-gcp-eu-w1-prod-ing-01
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 19 Nov 2024 16:36:20 GMT
last-modified
Wed, 12 Jan 2022 20:53:30 GMT
content-type
image/svg+xml
vary
origin, accept-encoding
x-sanity-asset-storage
gcs-default
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
script-src 'none'
cache-control
public, max-age=31536000, s-maxage=2592000
x-b3-sampled
0
x-varnish-age
0
via
1.1 google
xkey
project-t9maew4z-production
accept-ranges
bytes
x-b3-traceid
e8e5efcfa5231c8ae7b95b04a042a155
content-length
187
be492dd187a4b62bf5c5bbada996255fda125983-24x24.svg
cdn.sanity.io/images/t9maew4z/production/ 		374 B
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.sanity.io/images/t9maew4z/production/be492dd187a4b62bf5c5bbada996255fda125983-24x24.svg?w=24&h=24&auto=format
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.250.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.250.149.34.bc.googleusercontent.com
Software
/
Resource Hash
ba31677e8caa5f281c65e05a7a215186205d7ab63b1cc58182e7fe89413d0000
Security Headers
Name Value
Content-Security-Policy script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/

Response headers

x-b3-spanid
b186b22364f51189
x-b3-parentspanid
62d4a997a1b579dd
content-encoding
br
age
235385
x-content-type-options
nosniff
sanity-gateway
k8s-gcp-eu-w1-prod-ing-01
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 18 Nov 2024 09:46:19 GMT
last-modified
Wed, 12 Jan 2022 21:10:55 GMT
content-type
image/svg+xml
vary
origin, accept-encoding
x-sanity-asset-storage
gcs-default
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
script-src 'none'
cache-control
public, max-age=31536000, s-maxage=2592000
x-b3-sampled
0
x-varnish-age
0
via
1.1 google
xkey
project-t9maew4z-production
accept-ranges
bytes
x-b3-traceid
2b09b6641752288083348a7afb71e508
content-length
253
cdfabbecd60265ae9246478ddf2b91e6b7240c4b-24x24.svg
cdn.sanity.io/images/t9maew4z/production/ 		327 B
336 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.sanity.io/images/t9maew4z/production/cdfabbecd60265ae9246478ddf2b91e6b7240c4b-24x24.svg?w=24&h=24&auto=format
Requested by
Host: f-online.pages.dev
URL: https://f-online.pages.dev/at/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.250.58 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.250.149.34.bc.googleusercontent.com
Software
/
Resource Hash
fa7a54f8bb092a33ada5f5cdb8c73ca61aa8f87699949dcff7143335f34e69a5
Security Headers
Name Value
Content-Security-Policy script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/

Response headers

x-b3-spanid
729876c022d0631f
x-b3-parentspanid
4cc9efc86e093fd9
content-encoding
br
age
235385
x-content-type-options
nosniff
sanity-gateway
k8s-gcp-eu-w1-prod-ing-01
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 18 Nov 2024 09:46:19 GMT
last-modified
Wed, 12 Jan 2022 21:11:38 GMT
content-type
image/svg+xml
vary
origin, accept-encoding
x-sanity-asset-storage
gcs-default
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
script-src 'none'
cache-control
public, max-age=31536000, s-maxage=2592000
x-b3-sampled
0
x-varnish-age
0
via
1.1 google
xkey
project-t9maew4z-production
accept-ranges
bytes
x-b3-traceid
47f077afbefc331c7de5109b0fdb61a3
content-length
192
logo.png
f-online.pages.dev/ 		4 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/logo.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ca71b2226e1393a470200fb818148ba43f9f1c613485f2dde3003a1de2db557
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ecetri6sUX79FZhxSydRJaqB0ELV1xo4Orqqn2Pxa0WSWvlgReJDsgNqChU%2Bm7rRrQQ4PxdkfFGhALFC28arUZVegDnF5e5ENiHcDLoUtmlT9skP%2By6e9TBTi%2BSp3IGGGDThDy7HnIANcETHOh4FENE%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b130eab3807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
logo.svg
f-online.pages.dev/ 		4 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://f-online.pages.dev/logo.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:310c::ac42:2fbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db954ad38dc38c10c96037c7ff0181ee5fbf563daa8a4818cff01cfb05469821
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.31 Safari/537.36
Referer
https://f-online.pages.dev/at/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
gzip
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RvuZ8gyQBXXtgFaGGS6dNKVFiP7kSPpcwuOY6wF6ovChfv%2BCvWXFyLVbn6fztOy3oxPMHvk8utnoza6x%2BCxsWbyYmtZpJE3TBY4TiSPcu%2FP%2BmrEy%2BmiDkyT7LcFMQykwV3TttLzF49QNgF0ousztPrI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e5d7b132eb43807-FRA
date
Thu, 21 Nov 2024 03:09:24 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| dev object| _paq object| start string| pagePath string| ___chunkMapping string| ___webpackCompilationHash object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log

2 Cookies

Domain/Path Name / Value
.f-online.pages.dev/ Name: __cf_mw_byp
Value: UWAVQQ9QJBaFohMU5wSss3MHcw_lpCCDrdUAn5kXuQc-1732158559-0.0.1.1-/at/
f-online.pages.dev/ Name: _pk_id.1.6eb9
Value: 539113a8b1c69f86.1732158564.0.1732158564..

11 Console Messages

Source Level URL
Text
network error URL: https://f-online.pages.dev/at/
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/logo.svg
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/download-app-store.svg
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/download-play-store.svg
Message:
Failed to load resource: the server responded with a status of 403 ()
recommendation verbose URL: https://f-online.pages.dev/at/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://f-online.pages.dev/framework-e58d96144562e1e1a878.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/webpack-runtime-a48e136479e4140e854f.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/app-e099c061ce6d9e10fb00.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/logo.png
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://f-online.pages.dev/logo.svg
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.sanity.io
f-online.pages.dev
piwik.inlupus.at
144.76.88.114
2606:4700:310c::ac42:2fbd
34.149.250.58
055d395c49b237a166586c92974bf879b8b0f006e19a2c51c081658e0210a388
0de3cd4b99c0babed63a2118249398747da1f710f65f0fe291cd73626b9d1d5d
11124d25b00d875cc536a3e2c29fed4de74ffbbf03972e5c1e69c2013823c502
18c5dfedc3dd82f400859be8862f8ad89e71e3089f570b75a7230defb4cd8ff5
1b163141a3a91d5d90b215179a8d97fcdecf0d576b8e50d3303a99bdb6688871
37f31cd2ef051cc40ebcc6b59a32fc9d8ff954f565e8ef03b38f026e10875041
426a797450340fe1aba734e876787a4a1c82c34e76cfe2ad4e729c4c275280ef
52ad1049100fdf161c4986288f8168b86618936b1023834f601ca73f7c864ebf
5ca2d77832def7453e055e53be8453d221de93c9d4a07906ce7d9f9a0c95258a
6cb0580e9262d8cb39d17cd653af55695a3dc1961c79b39b5a22506369171bd1
752906974fbb6884252ed40a3aee277e58bcd2b8953e51a2c5e6b44887274c74
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
9ca71b2226e1393a470200fb818148ba43f9f1c613485f2dde3003a1de2db557
a3746a12c5f494f6f93b0d6e311486484e5a59d16a289de084aa3959d400f72c
a3ea9c00a6bdfc730ccb74f343419a33e68dd4e628b4966b42f38f71b48eeb2f
a6ce075a1162d3d6e3d02979c54d0d42e2803bea7f2ec8969948ba37d31c648b
b3e0d4a28c347c8a7a766191a8ba1a76789e122face9663622320d38fdc2bee1
ba2a0683995a11c3053ce5f535da6470dad84d99f5d4dc49f959f1ac8e4fecb3
ba31677e8caa5f281c65e05a7a215186205d7ab63b1cc58182e7fe89413d0000
c7f570750f3101995e440b22ba3d826772564517d88ed04fa8c6a103bf7ffa56
cc79337d4e0be868add5df6909edd129a41079ed4d4b831492e197842548f3af
db954ad38dc38c10c96037c7ff0181ee5fbf563daa8a4818cff01cfb05469821
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fa7a54f8bb092a33ada5f5cdb8c73ca61aa8f87699949dcff7143335f34e69a5