urlscan.io logo urlscan.io
SecurityTrails logo

pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev Open in urlscan Pro
2a06:98c1:58::eb  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Submission: On November 14 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 2 countries across 7 domains to perform 18 HTTP transactions. The main IP is 2a06:98c1:58::eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev.
TLS certificate: Issued by E5 on September 29th 2024. Valid for: 3 months.
This is the only time pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

Domain & IP information

IP Address AS Autonomous System
3 2a06:98c1:58::eb 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
3 2a04:4e42:600... 54113 (FASTLY)
2 104.17.24.14 13335 (CLOUDFLAR...)
2 104.18.10.207 13335 (CLOUDFLAR...)
2 104.18.11.207 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
2 142.250.65.227 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 172.253.63.94 15169 (GOOGLE)
18 12
3    2a06:98c1:58::eb (United States)

ASN13335 (CLOUDFLARENET, US)
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1    2607:f8b0:4004:c1f::8a (Washington, United States)

ASN15169 (GOOGLE, US)
translate.google.com
3    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
2    104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2607:f8b0:4004:c1b::5f (Washington, United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    142.250.65.227 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f3.1e100.net
www.gstatic.com
1    2607:f8b0:4006:81c::200a (United States)

ASN15169 (GOOGLE, US)
translate.googleapis.com
1    172.253.63.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f94.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
4 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3697
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1436
54 KB
3 gstatic.com
www.gstatic.com
fonts.gstatic.com
9 KB
3 jquery.com
code.jquery.com — Cisco Umbrella Rank: 923
77 KB
3 r2.dev
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
177 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 478
translate.googleapis.com — Cisco Umbrella Rank: 1240
104 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 275
14 KB
1 google.com
translate.google.com — Cisco Umbrella Rank: 1491
29 KB
18 7
Domain Requested by
3 code.jquery.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
3 pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 www.gstatic.com www.gstatic.com
2 maxcdn.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 stackpath.bootstrapcdn.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
2 cdnjs.cloudflare.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 fonts.gstatic.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.googleapis.com
1 ajax.googleapis.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
1 translate.google.com pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
18 10

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E5		 2024-09-29 -
2024-12-28		 3 months crt.sh
*.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
bootstrapcdn.com
WE1		 2024-09-20 -
2024-12-19		 3 months crt.sh
upload.video.google.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh
*.gstatic.com
WR2		 2024-10-21 -
2025-01-13		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Frame ID: A4D2C444687ED2BDFCB68E7E9D2A8FF5
Requests: 24 HTTP requests in this frame

Frame: data://truncated
Frame ID: FA9CF5121C21CDCA90865C51CE084061
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Credentials

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

7
Domains

10
Subdomains

12
IPs

2
Countries

464 kB
Transfer

1051 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request owasecure.htm
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		150 KB
151 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8e2951818dfe2ecc-LAX
Connection
keep-alive
Content-Length
153823
Content-Type
text/html
Date
Thu, 14 Nov 2024 19:13:22 GMT
ETag
"09b3347f28753600d23d1d97dbf7db98"
Last-Modified
Tue, 15 Oct 2024 00:34:43 GMT
Server
cloudflare
Vary
Accept-Encoding
element.js
translate.google.com/translate_a/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1f::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
01c7dc710d998606c0116a8b92067971dc8f5adc833edde8a3757f7ea440d5a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin-allow-popups
content-encoding
gzip
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 19:13:22 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-1538f"
age
5061276
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 19:13:22 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
14, 99665
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga13622-LGA, cache-bur-kbur8200056-BUR
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731611603.825947,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30288
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-500f"
age
178291
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N1IiZwWXyLWS8E8cBEe66cIYNL8N6kAHJU43tzSiY2TiLK48KbrV9Qtqoeu4RZPlF7%2Bdr4WznbYEcdPL92UfvCZ%2B72i91sF0BYceCGOr9IegptZiTdoGElS9CaeScYQX2%2F1Reqni"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 19:13:22 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 19:13:22 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e2951854978072b-SJC
accept-ranges
bytes
access-control-allow-origin
*
content-length
6458
server
cloudflare
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"ce6e785579ae4cb555c9de311d1b9271"
age
778656
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 14 Nov 2024 19:13:22 GMT
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
09/26/2024 10:32:53
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
d9761adaac5341ea1778ff82bc06efeb
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2951853b9a2aaf-LAX
access-control-allow-origin
*
cdn-edgestorageid
995
server
cloudflare
cdn-requestcountrycode
US
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-1111d"
age
1575105
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 19:13:22 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
26, 12092
x-served-by
cache-lga21982-LGA, cache-bur-kbur8200145-BUR
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731611603.825730,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
24038
server
nginx
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"5869c96cc8f19086aee625d670d741f9"
age
84482
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 14 Nov 2024 19:13:22 GMT
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
10/09/2024 17:15:56
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
2eae5dd636060d2c453d9e92c928a90c
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e29518538c82f5e-LAX
access-control-allow-origin
*
cdn-edgestorageid
1109
server
cloudflare
cdn-requestcountrycode
US
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-10fdd"
age
1943626
x-cache
HIT, HIT
date
Thu, 14 Nov 2024 19:13:22 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
46, 29574
x-served-by
cache-lga21963-LGA, cache-bur-kbur8200145-BUR
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1731611603.825851,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
23856
server
nginx
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03fa9-4af4"
age
80788
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U%2FMsy7TzwYLRmJemyjUBvO7D1Oi37hKrCqLyNJ4oXl3K%2B%2BGgOgJ%2BcRqB6BsAYyMp%2BCeYMZoChTkRXc3V1lKnkunVM0p0mjn4STnBRae4OGzcMwui8OWpsxXr%2F8vebKpsOWYOrPsx"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Tue, 04 Nov 2025 19:13:22 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 19:13:22 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:15:37 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8e295185497c072b-SJC
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
server
cloudflare
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"14d449eb8876fa55e1ef3c2cc52b0c17"
age
2633040
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
content-type
application/javascript; charset=utf-8
cdn-cachedat
09/26/2024 11:59:36
cdn-cache
HIT
priority
u=1,i=?0
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
cdn-pullzone
252412
cdn-proxyver
1.04
cdn-triggerededgerule
572817ab-2873-4760-8981-0132b6a2299e, cf31a005-2e3c-44f6-b953-b8e290a7a46a, c1a973b5-a84a-4683-8b33-9ecca22c4b68, a9841ad5-01f0-4e2a-8f0b-b2757cb10c8c, 3bfb2eee-3581-4a9c-8162-a4adf5fe8e3e, ae1df8d8-8ccd-4986-a814-6c70053e3c56, aa9d6962-b964-45ba-9961-53d19a1d79f9, fce06edf-465b-445b-839a-48b8ac604776
cdn-edgestorageid
1001
server
cloudflare
cdn-requestcountrycode
US
date
Thu, 14 Nov 2024 19:13:22 GMT
vary
Accept-Encoding
cdn-requestpullcode
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cdn-requesttime
1
timing-allow-origin
*
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8a023ffd75e06a9c7cb3715cb58dcb12
cross-origin-resource-policy
cross-origin
cf-ray
8e29518538cb2f5e-LAX
access-control-allow-origin
*
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
49134
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Fri, 14 Nov 2025 05:34:28 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 05:34:28 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"67176c242e1bdc20603c878dee836df3"
age
1077688
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Thu, 14 Nov 2024 19:13:22 GMT
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
cdn-cache
HIT
cdn-cachedat
09/26/2024 10:32:51
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
1
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
1766a1a03c04a1816bee6a9ac2761824
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
8e2951853b5b1032-LAX
access-control-allow-origin
*
cdn-edgestorageid
900
server
cloudflare
cdn-requestcountrycode
US
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=GAw/d=1/rs=AN8SPfperZTWc9db843A0DVCAAainhyX2Q/m=el_conf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s73-in-f3.1e100.net
Software
sffe /
Resource Hash
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
176320
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 18:14:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 12 Nov 2024 18:14:43 GMT
last-modified
Thu, 04 Apr 2024 07:26:25 GMT
content-type
text/css; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
4144
x-xss-protection
0
server
sffe
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfr_tCeR31cIgy2F0639_cakYeTY6A/ 		214 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=AEA/d=1/exm=el_conf/ed=1/rs=AN8SPfr_tCeR31cIgy2F0639_cakYeTY6A/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.en_US.K0xKbIbEKMw.O/am=GAw/d=1/rs=AN8SPfperZTWc9db843A0DVCAAainhyX2Q/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
3644
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
x-content-type-options
nosniff
expires
Fri, 14 Nov 2025 18:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 14 Nov 2024 18:12:39 GMT
last-modified
Wed, 13 Nov 2024 22:15:54 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="rosetta"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
accept-ranges
bytes
access-control-allow-origin
*
content-length
75181
x-xss-protection
0
server
sffe
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
segoeui-regular.ttf
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv

Response headers

CF-RAY
8e295188685b2ecc-LAX
Content-Length
27150
Date
Thu, 14 Nov 2024 19:13:23 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare
truncated
/ Frame FA9C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Content-Type
text/html;charset=UTF-8
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 		6 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg
Requested by
Host: pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.63.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bi-in-f94.1e100.net
Software
sffe /
Resource Hash
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/

Response headers

content-encoding
gzip
age
452776
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 09 Nov 2025 13:27:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 09 Nov 2024 13:27:08 GMT
last-modified
Wed, 20 Apr 2022 14:24:23 GMT
content-type
image/svg+xml
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
3340
x-xss-protection
0
server
sffe
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s73-in-f3.1e100.net
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=GAw/d=0/rs=AN8SPfoV6mMC6tlFnBTPsgfPv12vhvDMnA/m=el_main_css

Response headers

age
70594
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options
nosniff
expires
Thu, 13 Nov 2025 23:36:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 23:36:50 GMT
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
content-type
image/png
vary
Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
content-length
1842
x-xss-protection
0
server
sffe
favicon.ico
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ 		27 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv

Response headers

CF-RAY
8e29518edae32ecc-LAX
Content-Length
27150
Date
Thu, 14 Nov 2024 19:13:24 GMT
Content-Type
text/html
Vary
Accept-Encoding
Connection
keep-alive
Server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online) Generic Email (Online) Outlook (Online)

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| setCookie function| getLanguageCode function| googleTranslateElementInit function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| mainLogonDiv function| $ function| jQuery function| Popper object| bootstrap object| closure_lm_331574

1 Cookies

Domain/Path Name / Value
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/ Name: googtrans
Value: /en/en

16 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owasecure.htm?top=z********@w*******.lmv
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/owa/auth/15.1.1591/themes/resources/segoeui-regular.ttf
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
pub-d44e201c1f3e400586cb81b0f2d48f61.r2.dev
stackpath.bootstrapcdn.com
translate.google.com
translate.googleapis.com
www.gstatic.com
104.17.24.14
104.18.10.207
104.18.11.207
142.250.65.227
172.253.63.94
2607:f8b0:4004:c1b::5f
2607:f8b0:4004:c1f::8a
2607:f8b0:4006:81c::200a
2a04:4e42:600::649
2a06:98c1:58::eb
01c7dc710d998606c0116a8b92067971dc8f5adc833edde8a3757f7ea440d5a1
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2efad2f3974e2d5e1a55d3039e357294e320360a30d59413dbd9e0cf5fde6218
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
800d8acf2e823438ee70bf7b9d79741ff6cfd5ef2d6c617e3e57fd4310aec737
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b