eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev Open in urlscan Pro
2606:4700:3034::ac43:a903  Malicious Activity! Public Scan

URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Submission: On January 03 via api from BY — Scanned from DE

Summary

This website contacted 14 IPs in 2 countries across 10 domains to perform 21 HTTP transactions. The main IP is 2606:4700:3034::ac43:a903, located in United States and belongs to CLOUDFLARENET, US. The main domain is eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on November 5th 2023. Valid for: 3 months.
This is the only time eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 2a04:4e42:400... 54113 (FASTLY)
1 ()
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 173.208.137.67 32097 (WII)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2606:4700:e0:... 13335 (CLOUDFLAR...)
21 14
Apex Domain
Subdomains
Transfer
3 gstatic.com
encrypted-tbn0.gstatic.com
16 KB
3 fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3594
ka-f.fontawesome.com — Cisco Umbrella Rank: 7350
22 KB
3 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 708
fonts.googleapis.com — Cisco Umbrella Rank: 115
61 KB
3 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1219
83 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1761
35 KB
2 workers.dev
eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1018 KB
1 pngdownload.id
img2.pngdownload.id
54 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 395
7 KB
1 similarpng.com
image.similarpng.com — Cisco Umbrella Rank: 587761
68 KB
1 pinclipart.com
www.pinclipart.com — Cisco Umbrella Rank: 351427
43 KB
21 10
Domain Requested by
3 encrypted-tbn0.gstatic.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
3 code.jquery.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
2 ka-f.fontawesome.com kit.fontawesome.com
2 maxcdn.bootstrapcdn.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
2 ajax.googleapis.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
2 eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 img2.pngdownload.id eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 cdnjs.cloudflare.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 image.similarpng.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 www.pinclipart.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 kit.fontawesome.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
1 fonts.googleapis.com eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
21 12

This site contains no links.

Subject Issuer Validity Valid
ereoaeggnlscihkt.workers.dev
GTS CA 1P5
2023-11-05 -
2024-02-03
3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2023-07-11 -
2024-07-14
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
bootstrapcdn.com
GTS CA 1P5
2023-11-30 -
2024-02-28
3 months crt.sh
*.fontawesome.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-12-04 -
2025-01-03
a year crt.sh
pinclipart.com
R3
2024-01-01 -
2024-03-31
3 months crt.sh
similarpng.com
E1
2023-12-08 -
2024-03-07
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-11-20 -
2024-02-12
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
pngdownload.id
E1
2023-12-27 -
2024-03-26
3 months crt.sh
ka-f.fontawesome.com
GTS CA 1P5
2023-11-08 -
2024-02-06
3 months crt.sh

This page contains 1 frames:

Primary Page: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Frame ID: 1A7972E855252240741FAE4C935516CE
Requests: 23 HTTP requests in this frame

Screenshot

Page Title

Onedrive

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • kit\.fontawesome\.com/([0-9a-z]+).js

Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

95 %
HTTPS

85 %
IPv6

10
Domains

12
Subdomains

14
IPs

2
Countries

1408 kB
Transfer

5543 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
2 MB
1018 KB
Document
General
Full URL
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:a903 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15c750b3829fe7306c22c6a83bcca33168ca12607a4833a6df32705e282df91b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
83fb6e17bade67dc-SJC
content-encoding
br
content-type
text/html;charset=UTF-8
date
Wed, 03 Jan 2024 13:01:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0cQjvzRSgnAPlzBXLp45SsNnHklYjpAF4P16V%2BLUuhSEfK1Y%2FEiPmPHdZB1Xet43aq35Zps%2FXwuk8FlPknwSMqk5Js%2BViicyvNhHkUJgSDdZU0bZvvHrQ%2BoI95dSNvJkV0W2m1QOFNDAKE6Gq58KhrrOoGyGruCebEYNo6cA8cj3JFZpY%2FdZv2DiJwjWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
jquery-3.4.1.min.js
code.jquery.com/
86 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:22 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9484682
x-cache
HIT, HIT
content-length
30638
x-served-by
cache-lga21965-LGA, cache-fra-eddf8230090-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1704286883.662376,VS0,VE0
etag
W/"28feccc0-15851"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
454, 2459675
296227e3-219b-4308-b738-e0295d66dfa6
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
2 MB
0
Document
General
Full URL
blob:https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/296227e3-219b-4308-b738-e0295d66dfa6
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a834e973e9e1d0ed8f3495ccb0d4ab56819426b88fb8c5f837d726b311efa29a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
1964494
Content-Type
text/html
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
29 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Tue, 02 Jan 2024 02:15:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
125138
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 01 Jan 2025 02:15:46 GMT
jquery-3.1.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9486282
x-cache
HIT, HIT
content-length
30070
x-served-by
cache-lga21947-LGA, cache-fra-eddf8230090-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1704286885.684172,VS0,VE0
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
93, 342896
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/
141 KB
21 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
752
age
64313
cdn-cachedat
10/31/2023 18:48:44
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"450fc463b8b1a349df717056fbb3e078"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
2584669a2b795ebc68dab5fb13ec721e
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
83fb6e2569c3371b-FRA
cdn-requestpullsuccess
True
css
fonts.googleapis.com/
1 KB
903 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ad5f1ca3a94cebd89d45b7cf6a963a535bf28144862cffa3a41a31540f7a409f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 03 Jan 2024 13:01:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 03 Jan 2024 13:01:24 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 03 Jan 2024 13:01:24 GMT
585b051251.js
kit.fontawesome.com/
12 KB
5 KB
Script
General
Full URL
https://kit.fontawesome.com/585b051251.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a

Request headers

Referer
Origin
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
server
cloudflare
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age
3000
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
*
content-type
text/javascript
cache-control
max-age=60, public, stale-while-revalidate=30
cf-ray
83fb6e25688b9b7a-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
F6bKmlatLbuC0IQ3Yq0B
80-804103_office-365-is-securable-but-not-secure-microsoft.png
www.pinclipart.com/picdir/middle/
107 KB
43 KB
Image
General
Full URL
https://www.pinclipart.com/picdir/middle/80-804103_office-365-is-securable-but-not-secure-microsoft.png
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.208.137.67 , United States, ASN32097 (WII, US),
Reverse DNS
srv1-67.dzldns.net
Software
nginx/1.14.0 /
Resource Hash
c11e0dff418ff81f05a64998df774bf601715aeac44341959b918c34b41d3251

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Wed, 03 Jan 2024 13:01:25 GMT
Content-Encoding
gzip
Last-Modified
Sun, 22 Dec 2019 06:56:00 GMT
Server
nginx/1.14.0
ETag
W/"5dff1380-1ab6d"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
image/png
Connection
keep-alive
Outlook-icon-on-transparent-background-PNG.png
image.similarpng.com/very-thumbnail/2021/09/
68 KB
68 KB
Image
General
Full URL
https://image.similarpng.com/very-thumbnail/2021/09/Outlook-icon-on-transparent-background-PNG.png
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:cc0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4aaea8bc5be7cc2e82bd23355aa9a29b5f8c58a234293e188b90d589e9033db
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:25 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-cache-status
HIT
x-amz-request-id
tx000000000000071d9ee72-00656a349a-4d33653d-nyc3b
x-envoy-upstream-healthchecked-cluster
content-length
69286
last-modified
Mon, 13 Sep 2021 14:14:39 GMT
server
cloudflare
etag
"023bff6503a7c777fb61eb08bc9ce84a"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
image/png
x-do-cdn-uuid
072a0ebe-bbef-4350-ab6e-e04d2ac99d6c
x-rgw-object-type
Normal
cache-control
max-age=3600
accept-ranges
bytes
cf-ray
83fb6e26cca4bb3e-FRA
images
encrypted-tbn0.gstatic.com/
4 KB
4 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSwt0Wr5uodzG7-sVzAC53bWMdf9_lngTlrKiQsRxw48YJ6hAOCn-GFa__IymxiQseYF0s&usqp=CAU
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ac9ca3052e8894414df2ca5f150f03ea086e07899634a98c9452ae73a86ac9b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 18:22:42 GMT
x-content-type-options
nosniff
age
67122
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3974
x-xss-protection
0
last-modified
Wed, 13 Nov 2019 04:48:28 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 01 Jan 2025 18:22:42 GMT
images
encrypted-tbn0.gstatic.com/
5 KB
5 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQEgm6xT0Oa1ZGAnJKTY4Ijvse1mMtUmNS43Ee1fTLRmkzvBaqkRFvykICJdk9KLfVV46Q&usqp=CAU
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f278759a7bacecd4acecee9386bd0937cd0da327967de61c48381c8fe9a1963b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 18:22:42 GMT
x-content-type-options
nosniff
age
67122
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4896
x-xss-protection
0
last-modified
Sat, 13 Oct 2018 22:03:27 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 01 Jan 2025 18:22:42 GMT
images
encrypted-tbn0.gstatic.com/
7 KB
7 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR8X9YX2EtdgLet95X7sJ_9UI7Jst0vgxUMYNTt3m8npKpU6K_Wi9379Twj3GwyTnqrUiU&usqp=CAU
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2b5e34b465ea48aa40348054e373b5cc8d72a04452cabaa1d54c1a3d0cab54a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Tue, 02 Jan 2024 18:22:42 GMT
x-content-type-options
nosniff
age
67122
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7164
x-xss-protection
0
last-modified
Thu, 17 Oct 2019 04:38:22 GMT
server
sffe
report-to
{"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="images-tbn"
expires
Wed, 01 Jan 2025 18:22:42 GMT
jquery-3.2.1.slim.min.js
code.jquery.com/
68 KB
24 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer
Origin
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9383084
x-cache
HIT, HIT
content-length
23856
x-served-by
cache-lga21963-LGA, cache-fra-eddf8230046-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1704286885.697133,VS0,VE0
etag
W/"28feccc0-10fdd"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
2, 307170
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/
19 KB
7 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
642105
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6157
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-4af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F5tnLvHG9Fh42h5eMA0WZR7%2BxNqyKqhg4NfOf80mQEVmIz2F4bCRFlQc78fnUuZARNco4Y32xlgdKkjo4DyZc2qgvbCVx2S1t%2Fy18b1i5QYUuA07mUJ%2FEHUtv%2Fhrvl4AekyX0MT%2F3uSkZNaUgPImu0%2FM"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
83fb6e256e5a9bb2-FRA
expires
Mon, 23 Dec 2024 13:01:24 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/
48 KB
14 KB
Script
General
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
865
age
64312
cdn-cachedat
12/21/2023 20:03:03
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
bca074bbe9b4e3aa7e77ea0440ce0a47
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
83fb6e2569c4371b-FRA
cdn-requestpullsuccess
True
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 29 Dec 2023 08:14:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
449219
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30306
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 28 Dec 2024 08:14:25 GMT
kisspng-microsoft-office-365-office-online-computer-softwa-office-5abb01d66a0b39.1638325715222051424344.jpg
img2.pngdownload.id/20180327/wfq/
53 KB
54 KB
Image
General
Full URL
https://img2.pngdownload.id/20180327/wfq/kisspng-microsoft-office-365-office-online-computer-softwa-office-5abb01d66a0b39.1638325715222051424344.jpg
Requested by
Host: eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
URL: https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:b6a2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6e8d049eae71adc7885cd270fb033e975af9ead0ca3535a40debdd00a78e502

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:25 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
54110
alt-svc
h3=":443"; ma=86400
content-length
54749
last-modified
Wed, 28 Mar 2018 02:45:42 GMT
server
cloudflare
etag
"5abb01d6-d5dd"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UDVDxVKmD294wFuhIKUr5NSFeuBLkLoARPxIDUGrNSf%2F8wFxNwz7G8y454icJfKELpJPOnTeUtTc4ndD%2Fg7XRjhSn%2BNHR41zJSRLofooK1Y0vOnUsK0XP3wBo9OFDU8RqeuNH6Mw9C4on7Y908%2BfF2vW"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=864000
accept-ranges
bytes
cf-ray
83fb6e287bb24d4f-FRA
expires
Fri, 12 Jan 2024 21:57:38 GMT
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/
59 KB
13 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/585b051251.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6b17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
via
1.1 1396f0307ab4835adf6e4163507d4c8a.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
AMS54-C1
age
64312
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QmBRs0vDQRV08q3OveSrtZ%2FHL2Ql2Md9ZyGvcDeNXUO6qRvO11BNn4cxmrO%2BUhjU8fsDYHYpN1pSci6P4N1lGxa%2F4xoDj2tSrhwgklQIjtI5hrakG5YX271UZo53wveUGBm5EjHZuwf7cSY5oj7R3rLGlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
83fb6e265fae3815-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
amSx_t50ltETkbXjDts-r7EcO9DDy5khCI3AAMieUX5cMHx7F1ai8g==
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/
26 KB
5 KB
Fetch
General
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/585b051251.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:6b17 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Wed, 03 Jan 2024 13:01:24 GMT
via
1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA56-C2
age
64312
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"76f34b71fc9fb641507ff6a822cc07f5"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IzoGpWGyLaSQFhIGVBNRfpcFJlG3V%2BcpBo8QxkTgDFERBVwNVdow5CR3E1yqf9vIe6UM9gQ1fh%2FuYGNVOLI5Ed7XdCq7L1%2FM6%2BtKt%2FUWNyJXIVDEC7UfDNC%2BCeJpDklyv8xcR8AkGnkNj57BzQM8a1OXuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=31556926
vary
Accept-Encoding
cf-ray
83fb6e265fad3815-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
3sLn91CPrU-AOfdBevoOMlpJhUpL2S4zmELBsFQ3KNPSvi8SbMNNJA==
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.10.2/
0
0

truncated
/
27 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
83 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
990e62cf9f4a4c76ea6406df72453e97d8fb439b77ca975f08d1d727acfdb071

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/jpeg

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ajax.googleapis.com
URL
http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

211 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture string| s string| m function| _0x1f8e function| _0x43dc7a function| _0x55b4 function| _0x261a75 function| _0x26d2 function| _0x3a0b function| $ function| jQuery object| FontAwesomeKitConfig string| message function| rtclickcheck string| version_ function| _0x4c55 function| _0x5a8349 function| _0x1369 function| _0x140e function| _0x545f function| _0x1295 function| _0xeee000 function| _0x268f function| _0x3047 function| _0x1f0043 function| _0x22c9 function| _0x1fde function| _0x1795 function| _0x29e93a function| _0x7a88 function| _0x4bc7e5 function| _0x3a27 function| _0x30cd function| _0x190c function| _0x3a87 function| _0x1d0364 function| _0x3d31 function| _0x5d52 function| _0x24bb function| _0x49a2 function| _0xa305 function| _0x192e function| _0x284e08 function| _0x2314 function| _0x186794 function| _0x29c3 function| _0x20e3f8 function| _0x10a7 function| _0x5e76 function| _0x173c function| _0x468f function| _0x5b105e function| _0x3bbc function| _0x1ee5 function| _0x4671 function| _0x19c1 function| _0x31954f function| _0xe576 function| _0x4051 function| _0x305e function| _0x522a3a function| _0x38ca function| _0x3b5b function| _0x5228 function| _0x17c7be function| _0x2c10 function| _0x226ee6 function| _0x5610 function| _0x4f4e function| _0x226b function| _0x15e2d1 function| _0x4eb7 function| _0x5249 function| _0x4ee4 function| Popper object| bootstrap function| llll6y4ca56nc1o2nfu6se6iii function| lLlLL6Y4ca56Nc1o2nfu6se6llll function| iiiI6Y4Ca56nC1o2nfu6se6iiii string| dF4dLBj object| J0Adwa function| AyNxJaZ object| YtQSbB number| pB_YPCZ object| CVUhCM6 string| BO8KJ1 string| VGrf6d string| A21vVy string| F3KvxQO string| d6WaD8 string| AcB0ia string| FHRAdtX string| QBAONtM string| ryZBAGU string| KJdMyz_ string| d44o58 string| ihcFocb string| xTsNod string| YlPB63 string| BaS35w string| w1v7rrd string| jc5BBK string| Ujb_q1 string| csQGQN5 string| BXO3lH string| coBdA2l string| A3Cd82w string| rj3QHp string| cLPM7NZ string| jAhe4S string| MWS3bSi string| MaUg0N4 string| H74ZJHN string| tvBQH2W string| zH8kygI string| yUGDNh string| N2o94bz string| _q7pxbG string| NWfRRM string| ZMjPsX3 string| JcQpyQW string| ocrccC string| p0eURs string| TOjqDqV string| v5eZA3T string| cjs96A string| n6oLNe string| O3d_al3 string| eCqVLd string| hk3kJ5 string| FV9qvw string| jH2GvK string| FzhvVh string| QuCo8N string| GcRaDD string| R6fvTQ string| SPsRxin string| xfTQlzc string| LHq2oq string| MTuQtcO string| pRLIlFL string| KDnGDHk string| CxvsRY string| xQo5Ue string| l6fdU_ string| uxLgyRb string| jGV2usi string| ygfYXq string| bnRJVY9 string| HZWsAUv string| IgPKfv string| nZSmiJ string| vWglbE5 string| Atpf1Zn string| rjaRmY string| o78P_Q string| CPCsdk string| ZfAq181 string| L9t9tP string| DE6LEr7 string| V5GmTc string| rQaf82s string| StTG9x string| yyiVcOv string| McuXSi1 function| llll6y4ca56nc1o2nfu6se6lii string| ruLTMP object| agdtbT object| usplT2 object| uXNEHBB object| EwPbaxD function| GyxlewT function| el1VL18 undefined| Eb4Iq_I function| DIqBX2v function| liii6y4ca56nc1o2nfu6se6iiii function| HEC5XG function| gCdrZAL function| PngiQ2 function| cdfNWe function| bHyLMB function| r4lBxE function| isBCg3J function| llli6y4ca56nc1o2nfu6se6iiii function| _0x51eff8 function| _0x25ef function| _0x4ba03d function| _0x2d3b function| _0x23e5 function| _0xbc82 function| _0x3c7593 function| _0x4191 function| _0x2c5d function| _0x19f3 function| _0x3a01 function| _0x29aa function| _0x4a44 function| _0x4965f1 function| _0xd65abb function| _0xfd56 function| _0x4cbb function| _0x364f function| _0x2dd1fb function| _0x5246 function| _0x4f6ad6 function| _0x32e4 function| _0x4b8d function| _0x2c2a function| _0x23d7 function| _0x1016 function| _0x28ba

1 Cookies

Domain/Path Name / Value
.image.similarpng.com/ Name: __cf_bm
Value: AvbuYt6n.w4GXugUvJQGsihE1IgiPhLZlra.ENMkKf0-1704286885-1-Ada5bhlsJowbfHQLwIqYoECC3FL7CWAC5awnGtomsPTeLzMgXXw6DJLmvYhz/rnIB2MZGS18M2n9ruQiPUrcCsE=

10 Console Messages

Source Level URL
Text
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://kit.fontawesome.com/585b051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security error URL: blob:https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/296227e3-219b-4308-b738-e0295d66dfa6
Message:
Mixed Content: The page at 'blob:https://eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev/296227e3-219b-4308-b738-e0295d66dfa6' was loaded over HTTPS, but requested an insecure script 'http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
encrypted-tbn0.gstatic.com
eng-doc-shape-a7e8.ereoaeggnlscihkt.workers.dev
fonts.googleapis.com
image.similarpng.com
img2.pngdownload.id
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
www.pinclipart.com
ajax.googleapis.com

173.208.137.67
2606:4700:3032::ac43:b6a2
2606:4700:3034::ac43:a903
2606:4700:4400::6812:2844
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:cc0
2606:4700:e0::ac40:6b17
2a00:1450:4001:806::200a
2a00:1450:4001:80f::200e
2a00:1450:4001:82f::200a
2a04:4e42:400::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
15c750b3829fe7306c22c6a83bcca33168ca12607a4833a6df32705e282df91b
2b5e34b465ea48aa40348054e373b5cc8d72a04452cabaa1d54c1a3d0cab54a1
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899
990e62cf9f4a4c76ea6406df72453e97d8fb439b77ca975f08d1d727acfdb071
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a834e973e9e1d0ed8f3495ccb0d4ab56819426b88fb8c5f837d726b311efa29a
ac9ca3052e8894414df2ca5f150f03ea086e07899634a98c9452ae73a86ac9b0
ad5f1ca3a94cebd89d45b7cf6a963a535bf28144862cffa3a41a31540f7a409f
c11e0dff418ff81f05a64998df774bf601715aeac44341959b918c34b41d3251
e4aaea8bc5be7cc2e82bd23355aa9a29b5f8c58a234293e188b90d589e9033db
e6e8d049eae71adc7885cd270fb033e975af9ead0ca3535a40debdd00a78e502
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f278759a7bacecd4acecee9386bd0937cd0da327967de61c48381c8fe9a1963b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda