e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2d0b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5
Effective URL:
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2...
Submission Tags: phishing
Submission: On October 28 via api (October 28th 2024, 6:10:13 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:310c::ac42:2d0b, located in United States and belongs to CLOUDFLARENET, US. The main domain is e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev.
TLS certificate: Issued by WE1 on October 7th 2024. Valid for: 3 months.

This is the only time e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:310... 2606:4700:310c::ac42:2f15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
4	192.64.118.50 192.64.118.50	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 2	2606:4700:310... 2606:4700:310c::ac42:2d0b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1		() ()
1	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
12	7

3 2606:4700:310c::ac42:2f15 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.64.118.50 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server315-5.web-hosting.com

external-files.minimalactionshandler.store	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
getor.roundupactions.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:310c::ac42:2d0b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 (None, )

ASN- ()

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

firebasestorage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	pages.dev 2 redirects 291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	14 KB
4	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412 firebasestorage.googleapis.com — Cisco Umbrella Rank: 7245	229 KB
2	roundupactions.shop getor.roundupactions.shop	16 KB
2	minimalactionshandler.store external-files.minimalactionshandler.store	5 KB
12	4

	Domain	Requested by
3	e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev	1 redirects 291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
3	ajax.googleapis.com	291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
3	291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev	1 redirects
2	getor.roundupactions.shop	ajax.googleapis.com
2	external-files.minimalactionshandler.store	291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev
1	firebasestorage.googleapis.com	e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
12	6

This site contains links to these domains. Also see Links.

Domain
www.att.com
attreg.att.net
about.att.com

Subject Issuer	Validity	Valid
94bc06ef.sni.cloudflaressl.com WE1	`2024-10-03` - `2025-01-01`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
external-files.minimalactionshandler.store Sectigo RSA Domain Validation Secure Server CA	`2024-09-30` - `2025-09-30`	a year	crt.sh
getor.roundupactions.shop Sectigo RSA Domain Validation Secure Server CA	`2024-09-30` - `2025-09-30`	a year	crt.sh
bc08b04c.sni.cloudflaressl.com WE1	`2024-10-07` - `2025-01-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false
Frame ID: 0431D7E2A950ADE75A2A4233751F5B03
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Screen

Page URL History Show full URLs

https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5 HTTP 308
https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/ Page URL
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-p... HTTP 308
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

308 kB
Transfer

559 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3D203F7Geroe%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3Dqj1lXHEq1y%26client_id%3Dm40842
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://attreg.att.net/PortalRegWeb/PortalRegController?callingAppId=OP
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/support/article/wireless/KM1375558/
Title: Learn about ZenKey

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal info

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5 HTTP 308
https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/ Page URL
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false HTTP 308
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5 HTTP 308
https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/

12 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

/ Show response
291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/
Redirect Chain

https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5
https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/

5 KB
4 KB

73ms
73ms

Document
text/html

2606:4700:310c::ac42:2f15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2f15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f52bb82c8f34944851f4d3a7ac3ff4e1d3eef1df1ed6fe42baa2c222ff66907

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8d9ce185cef1dca6-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 28 Oct 2024 18:10:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UV8zMDQHvf7XjhFFfC9TYBqp%2Flmt%2F4b0v3fAZFtplFD4k%2FXhTuwY2ivImtbcwd0glyCFD99YFifVBookHykO0gK015rj3HMnPdjcsJXXIQrholjg8%2BM7OeDjHFCC%2F7TUIPhweeHEh6TjdwMdM2Y3BqSKlLPbTrSV7ZWYjNhYhDt2YhK%2FtTlv%2FxsNI5yG5ydJKU2RFD8EANxycNpDhn3f1hKTNA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=24176&sent=13&recv=12&lost=0&retrans=0&sent_bytes=5029&recv_bytes=4947&delivery_rate=17160&cwnd=12000&unsent_bytes=0&cid=5b1eeb97e40ccb78&ts=315&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-ray: 8d9ce1844aabdca6-FRA
content-length: 0
date: Mon, 28 Oct 2024 18:10:08 GMT
location: /14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mvaI0iCFjmraNnd4nQGBIDX9PWoOtOi5mke%2Fx044IjBhVIdU9UBX%2FSK0SUWq0VOQajtED62Utxx2kgR2cvTjEu1P4clMaMwBBxVOf0V3nuc%2F%2BUDBh5lz%2FPl7XMnOVLKGbcoPMsc3vB8pGsQuo3nzuA51sChhKXJvxP%2B9E6uUll96faM5TjLmie%2Bj26uyW%2BlGYmEy%2Bgsi1ss0MJrAiWONjSGggA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=24700&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4224&recv_bytes=4473&delivery_rate=637&cwnd=12000&unsent_bytes=0&cid=5b1eeb97e40ccb78&ts=178&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ 88 KB
31 KB 154ms
65ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js

Requested by

Host: 291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev
URL: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/

Response headers

content-encoding: gzip
age: 524253
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:32:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:32:36 GMT
last-modified: Tue, 04 Apr 2023 03:27:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31154
x-xss-protection: 0
server: sffe

GET
H2 200 att-logo.png
external-files.minimalactionshandler.store/thegifloader/ 5 KB
5 KB 560ms
175ms Image
image/png 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external-files.minimalactionshandler.store/thegifloader/att-logo.png
Requested by: Host: 291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev
URL: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed /
Resource Hash: b9d335ef26ff5819ae1a07f6a1185cbd9df6bc3383b4c934fe6a2ef02693f71c

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/

Response headers

cache-control: public, max-age=604800
expires: Mon, 04 Nov 2024 18:10:09 GMT
accept-ranges: bytes
content-length: 4760
date: Mon, 28 Oct 2024 18:10:09 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/png
last-modified: Mon, 30 Sep 2024 06:48:14 GMT
server: LiteSpeed

POST
H2 200 get.php
getor.roundupactions.shop/ 209 B
332 B 1174ms
767ms XHR
text/html 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://getor.roundupactions.shop/get.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed / PHP/8.1.30
Resource Hash

Request headers

Referer: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Accept: text/html, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
access-control-allow-origin: *
content-length: 160
date: Mon, 28 Oct 2024 18:10:10 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.30
vary: Accept-Encoding
server: LiteSpeed

GET
H3 404 favicon.ico
291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/ 0
684 B 40ms
39ms Other
text/plain 2606:4700:310c::ac42:2f15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:310c::ac42:2f15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/

Response headers

cache-control: no-store
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8NgBjY3o6%2BpmsbumMHUgJjdL9QvzeaBkhZwZGqyLL6IXri%2BH3yJ5qZrtWUsI1aBwfJ4D8wWz3v5bPVj02P22CvnueTxuSV5x4zIfkE0UiSG774taXfB23bGR1aLe3suUFwxamj5pX0DXhwy%2FHRnRLsXPlarKWXzdNLpo8gKfTqZTr2PBEfdv%2BfMLUISpMgJka0tNuJWlBpV9QeQfJiszhiUp%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d9ce18a1cdadca6-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfL4;desc="?proto=QUIC&rtt=22738&sent=19&recv=16&lost=0&retrans=0&sent_bytes=9072&recv_bytes=5506&delivery_rate=56065&cwnd=12000&unsent_bytes=0&cid=5b1eeb97e40ccb78&ts=975&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 28 Oct 2024 18:10:09 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H3

200

Primary Request / Show response
e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/
Redirect Chain

https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e...
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82...

13 KB
8 KB

82ms
82ms

Document
text/html

2606:4700:310c::ac42:2d0b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2d0b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68e2278ba1a03b82971b156c206a19aa246a2cdd2e676b926667dd7675074f34

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/
Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8d9ce191bd4c1b35-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 28 Oct 2024 18:10:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b43WE0x0D55J4Ax367nDap7%2FB9egEpUXjPROJMRYWsm33E%2F%2FXzbsFUigl49vvcE%2Bv3rtQ%2Bx4BUuDItyhdOtDFF6Bn0SAXq2uIiV%2BOCSL3jsjRE9xl8hwKdKlC9C2ZjMN8cqnvv05dEiNvPp5D2yZOBSrTYaSC3HEKqPCksUg7Qch84D3vsO6WoU7nMYzXKurgycz3VWISrO%2FsOx%2FGMP%2Bf0Wn5w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=31532&sent=13&recv=11&lost=0&retrans=0&sent_bytes=5090&recv_bytes=5145&delivery_rate=36069&cwnd=12000&unsent_bytes=0&cid=731f1e355d0ca9f9&ts=485&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-ray: 8d9ce18f5b2e1b35-FRA
content-length: 0
date: Mon, 28 Oct 2024 18:10:10 GMT
location: /a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKB%2Bb21SavyCRfeBwzIjFyQhO2ulO7ZpULIAas%2Bjj2OOf5ULhSZgHjGgo1%2BJzK5yYHlMpQ52%2FdxuimTlv7aNytWlau9lX7iplFeVygSI3I3VFjD2JGC8%2FFOmuzJFSpp5qM2EDDL2Uh%2F%2FlNJzwtFTVJezruxsfclYMKba9V3Yum4xkOxkshA21lSF%2BVQmBr2dOHjbihrB83aJDBxbJ2gVnDcz%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=32651&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4211&recv_bytes=4591&delivery_rate=338&cwnd=12000&unsent_bytes=0&cid=731f1e355d0ca9f9&ts=400&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.4/ 88 KB
31 KB 78ms
21ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/

Response headers

content-encoding: gzip
age: 524255
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 16:32:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 16:32:36 GMT
last-modified: Tue, 04 Apr 2023 03:27:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31154
x-xss-protection: 0
server: sffe

GET
H2 200 loading.gif
external-files.minimalactionshandler.store/thegifloader/ 24 KB
0 531ms
179ms Image
image/gif 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://external-files.minimalactionshandler.store/thegifloader/loading.gif
Requested by: Host: 291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev
URL: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/14208285ebb2a62b6a/3ea10d1a85b64feeb6cbbb5/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed /
Resource Hash

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/

Response headers

cache-control: public, max-age=604800
expires: Mon, 04 Nov 2024 18:10:11 GMT
accept-ranges: bytes
content-length: 68682
date: Mon, 28 Oct 2024 18:10:11 GMT
x-turbo-charged-by: LiteSpeed
content-type: image/gif
last-modified: Mon, 30 Sep 2024 06:48:16 GMT
server: LiteSpeed

POST
H2 200 ready-page.php
getor.roundupactions.shop/ 35 KB
16 KB 682ms
341ms XHR
text/html 192.64.118.50
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://getor.roundupactions.shop/ready-page.php
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.64.118.50 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server315-5.web-hosting.com
Software: LiteSpeed / PHP/8.1.30
Resource Hash

Request headers

Referer: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Accept: text/html, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-encoding: br
access-control-allow-origin: *
content-length: 15944
date: Mon, 28 Oct 2024 18:10:11 GMT
x-turbo-charged-by: LiteSpeed
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.30
vary: Accept-Encoding
server: LiteSpeed

GET
BLOB 200
OK 6ae3f6e0-13b1-45ad-8764-e8d002b60868 Show response
https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/ 26 KB
0 Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/6ae3f6e0-13b1-45ad-8764-e8d002b60868
Requested by: Host: e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
URL: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/a6a8be667a/a6ce5b8c26f3ee6ce/?15yvh=9x4socl&2j7b=DOvQ-0H-oZx-JQ6I-UM-elxL59-pp9&cael186yv=f889c2edd909c8b3aead2be9478a82e480ab4e1df46false
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ad10b706c03608dbabf98013ed251ab37c9e99369066a385ea8ba8530005607

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Content-Length: 26533
Content-Type: text/html

GET
H2 200 styles.css
firebasestorage.googleapis.com/v0/b/external-files-f9026.appspot.com/o/ 137 KB
138 KB 774ms
670ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://firebasestorage.googleapis.com/v0/b/external-files-f9026.appspot.com/o/styles.css?alt=media&token=10f29176-5bcb-4f25-9313-662dbee1d1c7
Requested by: Host: e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
URL: blob:https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/6ae3f6e0-13b1-45ad-8764-e8d002b60868
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: b75bff3b40ff1b9a0fa35c39b0c2b89ea15d6f49ae6656dc7856f4d454647521

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=QBW3zQ==, md5=R8K5Fk9KzGqbQI3M0l860Q==
etag: "47c2b9164f4acc6a9b408dccd25f3ad1"
x-goog-stored-content-encoding: identity
expires: Mon, 28 Oct 2024 18:10:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 140181
date: Mon, 28 Oct 2024 18:10:12 GMT
last-modified: Thu, 29 Aug 2024 16:20:10 GMT
content-type: text/css
content-disposition: inline; filename*=utf-8''styles.css
x-guploader-uploadid: AHmUCY3EUpA6HHyehX8L8unKRp2QonvrMZ5zK65gq3wWDWwwHy6k3ql6F7wY0GapDkjj1J5GiYavZUz0eQ
cache-control: private, max-age=0
x-goog-storage-class: STANDARD
x-goog-meta-firebasestoragedownloadtokens: 10f29176-5bcb-4f25-9313-662dbee1d1c7
accept-ranges: bytes
x-goog-generation: 1724948410872982
content-length: 140181
server: UploadServer

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 50ms
37ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
URL: blob:https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev/6ae3f6e0-13b1-45ad-8764-e8d002b60868

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

content-encoding: gzip
age: 31615
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Tue, 28 Oct 2025 09:23:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 28 Oct 2024 09:23:16 GMT
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30462
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 22 KB
22 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07b3a3d0f02092988f8b70fa51992fa109b23bbc82638fc857dee5ee0e3ad5dc

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Origin: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
Referer

Response headers

Content-Type: application/x-font-woff

GET
DATA 200
OK truncated
/ 373 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bde0c02c23f58bacdd0622f928446c1512fdc85d9c141ceabffd36aee8aba60c

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 23 KB
23 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3664f91baec63678fabaa2afa2411aa50292e47cacb796aaf7c862620698d11e

Request headers

User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Origin: https://e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
Referer

Response headers

Content-Type: application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

291d3d1a73d369f08c706f24895607a4be3f84b676d6515e93cfa9319a.pages.dev
ajax.googleapis.com
e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev
external-files.minimalactionshandler.store
firebasestorage.googleapis.com
getor.roundupactions.shop

192.64.118.50
2606:4700:310c::ac42:2d0b
2606:4700:310c::ac42:2f15
2a00:1450:4001:80e::200a
2a00:1450:4001:830::200a
07b3a3d0f02092988f8b70fa51992fa109b23bbc82638fc857dee5ee0e3ad5dc
1ad10b706c03608dbabf98013ed251ab37c9e99369066a385ea8ba8530005607
3664f91baec63678fabaa2afa2411aa50292e47cacb796aaf7c862620698d11e
68e2278ba1a03b82971b156c206a19aa246a2cdd2e676b926667dd7675074f34
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
7f52bb82c8f34944851f4d3a7ac3ff4e1d3eef1df1ed6fe42baa2c222ff66907
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b75bff3b40ff1b9a0fa35c39b0c2b89ea15d6f49ae6656dc7856f4d454647521
b9d335ef26ff5819ae1a07f6a1185cbd9df6bc3383b4c934fe6a2ef02693f71c
bde0c02c23f58bacdd0622f928446c1512fdc85d9c141ceabffd36aee8aba60c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2d0b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

67 %IPv6

4 Domains

6 Subdomains

7 IPs

2 Countries

308 kBTransfer

559 kBSize

0 Cookies

9 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

5 Console Messages

Security Headers

Indicators

e8e7411dbe75539ffaddce76c1d367f8bc1a268dd9c3eb6974d6851e81.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2d0b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

308 kB
Transfer

559 kB
Size

0
Cookies

12 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!