deuba-update.net Open in urlscan Pro
2a06:98c1:3121::3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

• https://anal-lytics.gay/pixel/P4rWhkWDR9eFmohF HTTP 0
• http://ww12.anal-lytics.gay/pixel/P4rWhkWDR9eFmohF

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response deuba-update.net/	6 KB 3 KB	261ms 224ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13c4df4242435dde44d649e5ab096d0032ca31783e58faece50363ab80763c5f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, must-revalidate cf-cache-status DYNAMIC cf-ray 813d9b35aa852c16-FRA content-encoding br content-type text/html; charset=UTF-8 date Tue, 10 Oct 2023 08:48:47 GMT expires -1 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l7WrKf2c6T%2BT8Yqm3bJxWoyJByPGMVVEh8V6oJ%2BtXtyD19BOID4FaevHysOYWttFXeBRDBg8n6sbEY7j1%2BxRy9o35njH2pOigczDe9F5bBbl9G6BcGMWvytZcHbboZbu%2F%2BgdBG94ucQ%2FlLee%2FcGX"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	olea.css deuba-update.net/css/	2 KB 1 KB	48ms 47ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://deuba-update.net/css/olea.css Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2307760cc1d2d90094b99c5bc71c476d8ee9d435d31f1de2ee22087364339f0e Request headers accept-language de-DE,de;q=0.9 Referer https://deuba-update.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT content-encoding br cf-cache-status MISS last-modified Mon, 18 Sep 2023 11:32:06 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"7e1-605a07def3980-gzip" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D0Fc1PQw1uEgk6%2BX0Bl0F%2BvLNN%2BObi%2BB3bkT0v0GWsEtyGX%2F35e0YzB688pzFEIrQFIJ2DQQ249SJt0UTJK5qLV40VNUIvWlBAftAXM0aJfkIwKE2YNxpoIVcA1iKbgPKrgIUDU6Zpn6FOQfrqEx"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 813d9b371c382c16-FRA alt-svc h3=":443"; ma=86400
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/	190 KB 29 KB	63ms 21ms	Stylesheet text/css	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://deuba-update.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 3520926 x-jsd-version 5.2.3 content-encoding br x-cache HIT, MISS cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230122-FRA, cache-yyz4534-YYZ x-jsd-version-type version server cloudflare etag W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lv0bVsGLgyJ7jmSc3Gf0%2FeqiZiECwyfghjobFufzrvJWsHx4T0Uys9xbxMX3YiRrH%2BaMYErMibTVGR%2FMLMkxcWN1L%2Fahk5z%2BwKDeQVIL%2F8H2dUQT5CUOpSWd2aNLcu6sLSh%2BEO17BYdgmSon%2Bzo%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 813d9b375df03a97-FRA
GET H2	200	jquery-3.6.1.min.js Show response code.jquery.com/	88 KB 31 KB	41ms 12ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.1.min.js Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Request headers Referer https://deuba-update.net/ Origin https://deuba-update.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 2125528 x-cache HIT, HIT content-length 30957 x-served-by cache-lga13629-LGA, cache-fra-eddf8230104-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1696927727.240023,VS0,VE0 etag W/"28feccc0-15e40" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 27, 120024
GET H2	200	api.js Show response www.google.com/recaptcha/	1 KB 1 KB	50ms 17ms	Script text/javascript	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 7667d41929dbee536024b3381aa9e72c4c711d03c5c75fdf227a0537483bbf99 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://deuba-update.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Tue, 10 Oct 2023 08:48:47 GMT
GET H2	200	all.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/	58 KB 11 KB	31ms 14ms	Stylesheet text/css	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://deuba-update.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 35007 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 10462 last-modified Mon, 13 Sep 2021 19:10:03 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "613fa20b-28de" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1jpRHTUf0UUQB5ON23atskSuvqPqNkFGaOYivMQMfU%2F5VUOtMbcTiN47Qm%2BkKbZRvrYIxeIiCZYuMELdozks7MGudshSi9XIXn65BKFWeaEKkp25yFl3McYXG7q7Dfj67UKFoCf%2BYp%2FriCAxcY4boMYt"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 813d9b37283f9c10-FRA expires Sun, 29 Sep 2024 08:48:47 GMT
GET		P4rWhkWDR9eFmohF ww12.anal-lytics.gay/pixel/ Redirect Chain https://anal-lytics.gay/pixel/P4rWhkWDR9eFmohF http://ww12.anal-lytics.gay/pixel/P4rWhkWDR9eFmohF	0 0
GET H3	200	TheBG.jpg deuba-update.net/img/	842 KB 843 KB	48ms 48ms	Image image/jpeg	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://deuba-update.net/img/TheBG.jpg Requested by Host: deuba-update.net URL: https://deuba-update.net/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 108ea472fbc35a815f48cc8318522e42ab0db442ca39a5fed69e52735fd8dadf Request headers accept-language de-DE,de;q=0.9 Referer https://deuba-update.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT cf-cache-status REVALIDATED last-modified Mon, 18 Sep 2023 11:50:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "d2951-605a0be303300" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VMqC67syIxGx45lh7JTKiaEnZyo6fLIE7%2BzrODi99fY9Thqox7jAx2jcNGhz8gi2APwGzdBPUhojHTE46RY1RSWC%2FenV3hGBvRlPp%2BYlg3lxMzvmQLeThbbsYcphf1GQE3q%2Fm5jxlAQztd2lMZm5"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 813d9b37bd6a9c0d-FRA alt-svc h3=":443"; ma=86400 content-length 862545
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/	466 KB 187 KB	44ms 7ms	Script text/javascript	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://deuba-update.net/ Origin https://deuba-update.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sun, 08 Oct 2023 14:43:12 GMT content-encoding gzip x-content-type-options nosniff age 151535 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 190978 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Mon, 07 Oct 2024 14:43:12 GMT
GET H2	200	anchor Show response www.google.com/recaptcha/api2/ Frame 9E39	58 KB 33 KB	30ms 29ms	Document text/html	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4&co=aHR0cHM6Ly9kZXViYS11cGRhdGUubmV0OjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=t9fbeqhwkiu Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 3288b58d79842f56aef262084d2df36acf02e2971be1412e8446f4c14802c89e Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-zNp-bWS9uQOHiQr4P-9DxQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://deuba-update.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-zNp-bWS9uQOHiQr4P-9DxQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Tue, 10 Oct 2023 08:48:47 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	styles__ltr.css www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 9E39	55 KB 24 KB	23ms 8ms	Stylesheet text/css	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4&co=aHR0cHM6Ly9kZXViYS11cGRhdGUubmV0OjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=t9fbeqhwkiu Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 03:08:47 GMT content-encoding gzip x-content-type-options nosniff age 20400 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 24606 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 09 Oct 2024 03:08:47 GMT
GET H3	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 9E39	466 KB 187 KB	21ms 7ms	Script text/javascript	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4&co=aHR0cHM6Ly9kZXViYS11cGRhdGUubmV0OjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=t9fbeqhwkiu Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sun, 08 Oct 2023 14:43:12 GMT content-encoding gzip x-content-type-options nosniff age 151535 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 190978 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Mon, 07 Oct 2024 14:43:12 GMT
GET H3	200	webworker.js www.google.com/recaptcha/api2/ Frame 9E39	102 B 135 B	17ms 16ms	Other text/javascript	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=lLirU0na9roYU3wDDisGJEVT Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4&co=aHR0cHM6Ly9kZXViYS11cGRhdGUubmV0OjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=t9fbeqhwkiu Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4&co=aHR0cHM6Ly9kZXViYS11cGRhdGUubmV0OjQ0Mw..&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=normal&cb=t9fbeqhwkiu User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 08:48:47 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE cross-origin-embedder-policy require-corp x-frame-options SAMEORIGIN report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Tue, 10 Oct 2023 08:48:47 GMT
GET H3	200	bframe Show response www.google.com/recaptcha/api2/ Frame 3C9D	7 KB 1 KB	22ms 22ms	Document text/html	2a00:1450:4001:82b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4 Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 29c9f8402b9de286129c883a523be82ea58069f58d13cbdef18ec7d05f3cc2c1 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-ve4sITkKzVjFGCKmV8FCZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://deuba-update.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-ve4sITkKzVjFGCKmV8FCZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Tue, 10 Oct 2023 08:48:47 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	styles__ltr.css www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 3C9D	55 KB 24 KB	7ms 7ms	Stylesheet text/css	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Tue, 10 Oct 2023 03:08:47 GMT content-encoding gzip x-content-type-options nosniff age 20400 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 24606 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 09 Oct 2024 03:08:47 GMT
GET H3	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 3C9D	466 KB 187 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=lLirU0na9roYU3wDDisGJEVT&k=6LfnSEMoAAAAAKa5gtnBTiGap-v8TltSAqBho9x4 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sun, 08 Oct 2023 14:43:12 GMT content-encoding gzip x-content-type-options nosniff age 151535 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 190978 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Mon, 07 Oct 2024 14:43:12 GMT
GET DATA	200 OK	truncated / Frame 9E39	14 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9E39	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET H3	200	logo_48.png www.gstatic.com/recaptcha/api2/ Frame 9E39	2 KB 2 KB	7ms 7ms	Image image/png	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/recaptcha/api2/logo_48.png Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:15:26 GMT x-content-type-options nosniff age 408805 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2228 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type image/png cache-control public, max-age=604800 accept-ranges bytes expires Thu, 12 Oct 2023 15:15:26 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 9E39	15 KB 16 KB	30ms 7ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.google.com/ Origin https://www.google.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 02:58:03 GMT x-content-type-options nosniff age 280248 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 06 Oct 2024 02:58:03 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ww12.anal-lytics.gay

URL

http://ww12.anal-lytics.gay/pixel/P4rWhkWDR9eFmohF

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Deutsche Bank (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| $ function| jQuery function| myFunction function| CheckRecaptcha function| Reload function| setCookie object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_964303

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			deuba-update.net/	1970-01-20 15:22:14	Name: XSRF-TOKEN Value: eyJpdiI6IitSUzdOQVRmYm92cVZyeEN0Z1hQc3c9PSIsInZhbHVlIjoiZ3BWNnUwaS90dHdaR2gwMzlrYzVGTUVUV2dyYUY2d1JHaGg3Zlo5cElGUGswZWNDS3RuV1RORnMxUDRZUmJSZ3pVaEsrRk8xTE5CQXFTa3ltMjMvdllWTlN0NDF0LzJQNE9mVFhKQ3pGMXFab1c2czVKcXpPbm1mSG9MaE91SDQiLCJtYWMiOiI0ZjU5OWE5NGU3MDRjZDNmMzRkYWUxOTZmNDk2NGQ2NTRlYjM5N2E4NGZkYWY1MmM4MjE2ZDQ3ZWUyMGYwNTg5IiwidGFnIjoiIn0%3D
			deuba-update.net/	1970-01-20 15:22:14	Name: laravel_session Value: eyJpdiI6ImowNVJncmdaN29jUHI4Yjc1U1BPM2c9PSIsInZhbHVlIjoiclBTZW5VVTRDNW1wSDBLR2ZjbmJ6QlNBOGJML1ZSNXR4VUtmRlVDOW5zYU5vb0JCMko1SGZIZm5uaEkyR0VseUxkL01ISlczNWZiQkdqSGRnUW1LeHhKRW5IQ2JNMFp4OEYvdElNRWFFOFV3cEt2WENGakdmblQydzBKSkNmdzciLCJtYWMiOiJhYmJlN2JjMzk0MDBjYmQxOGI2NWNiNmE2ZmM3NmVjZGVkZTQwOWE5ZTM2ZDM0NTAwODQ1NzZkODA3ZmNjOWNjIiwidGFnIjoiIn0%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://deuba-update.net/ Message: Mixed Content: The page at 'https://deuba-update.net/' was loaded over HTTPS, but requested an insecure script 'http://ww12.anal-lytics.gay/pixel/P4rWhkWDR9eFmohF'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
deuba-update.net
fonts.gstatic.com
ww12.anal-lytics.gay
www.google.com
www.gstatic.com
ww12.anal-lytics.gay
2606:4700::6810:5814
2606:4700::6811:190e
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a04:4e42:600::649
2a06:98c1:3121::3
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
108ea472fbc35a815f48cc8318522e42ab0db442ca39a5fed69e52735fd8dadf
13c4df4242435dde44d649e5ab096d0032ca31783e58faece50363ab80763c5f
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
2307760cc1d2d90094b99c5bc71c476d8ee9d435d31f1de2ee22087364339f0e
29c9f8402b9de286129c883a523be82ea58069f58d13cbdef18ec7d05f3cc2c1
3288b58d79842f56aef262084d2df36acf02e2971be1412e8446f4c14802c89e
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
7667d41929dbee536024b3381aa9e72c4c711d03c5c75fdf227a0537483bbf99
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df
fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6