pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev Open in urlscan Pro
2606:4700::6812:223 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qmplus.qmul.ac.uk/blocks/accessibility/database.php?redirect=https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/r...
Effective URL:
https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html
Submission: On May 02 via api (May 2nd 2023, 3:46:16 pm UTC) from US — Scanned from GB

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 2 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev.
TLS certificate: Issued by E1 on April 17th 2023. Valid for: 3 months.

This is the only time pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.169.164.108 18.169.164.108	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	95.101.111.132 95.101.111.132	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2

1 18.169.164.108 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-169-164-108.eu-west-2.compute.amazonaws.com

qmplus.qmul.ac.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.111.132 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-132.deploy.static.akamaitechnologies.com

apply.wellsfargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	wellsfargo.com apply.wellsfargo.com — Cisco Umbrella Rank: 66748	5 KB
1	r2.dev pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev	888 B
1	qmul.ac.uk 1 redirects qmplus.qmul.ac.uk — Cisco Umbrella Rank: 779935	496 B
2	3

	Domain	Requested by
1	apply.wellsfargo.com	pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev
1	pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev
1	qmplus.qmul.ac.uk	1 redirects
2	3

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2023-04-17` - `2023-07-16`	3 months	crt.sh
apply.wellsfargo.com Wells Fargo Public Trust Certification Authority 01 G2	`2022-10-12` - `2023-10-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html
Frame ID: 6070AC180250B3AA4B1E7431AF7D5830
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Please wait

Page URL History Show full URLs

https://qmplus.qmul.ac.uk/blocks/accessibility/database.php?redirect=https://pub-c0cb850463fa4a829f359... HTTP 303
https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html Page URL

Page Statistics

2
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

5 kB
Transfer

5 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qmplus.qmul.ac.uk/blocks/accessibility/database.php?redirect=https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html&op=save&size=1&scheme=1 HTTP 303
https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request redirection.html Show response
pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/
Redirect Chain

https://qmplus.qmul.ac.uk/blocks/accessibility/database.php?redirect=https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html&op=save&size=1&scheme=1
https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html

908 B
888 B

303ms
189ms

Document
text/html

2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 92409f4c39d962e1fe7415659e44a5ec0c64f7c107269fdc8cc5a52144f1ba47

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

CF-RAY: 7c1165499f7d496d-LHR
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 02 May 2023 15:46:12 GMT
ETag: W/"c0f12ba33ba956f954a20ea8281b3f1e"
Last-Modified: Sun, 30 Apr 2023 14:51:52 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

age: 0
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-language: en
content-type: text/html; charset=utf-8
date: Tue, 02 May 2023 15:46:11 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubdomains
vary: Accept-Encoding
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-redirect-by: Moodle
x-trace: ip-172-16-18-178->amazon_172_16_18_165
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK status_indicator_alone.gif
apply.wellsfargo.com/img/shared/static/ 4 KB
5 KB 355ms
123ms Image
image/gif 95.101.111.132
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://apply.wellsfargo.com/img/shared/static/status_indicator_alone.gif

Requested by

Host: pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev
URL: https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/redirection.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.132 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-132.deploy.static.akamaitechnologies.com

Software

Resource Hash

7b668be16bb8d9c0f50dfaa1cdd6d74bf53b9b1791fa46a2094b4ea275f246c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Tue, 02 May 2023 15:46:12 GMT
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 20 Nov 2014 23:50:15 GMT
ETag: W/"4161-1416527415000"
X-Frame-Options: DENY
Content-Type: image/gif
X-Cnection: close
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4161
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			qmplus.qmul.ac.uk/	1969-12-31 23:59:59	Name: MoodleSession Value: 1c3e0620b89728fd79e3b40f4f41094a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apply.wellsfargo.com
pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev
qmplus.qmul.ac.uk
18.169.164.108
2606:4700::6812:223
95.101.111.132
7b668be16bb8d9c0f50dfaa1cdd6d74bf53b9b1791fa46a2094b4ea275f246c5
92409f4c39d962e1fe7415659e44a5ec0c64f7c107269fdc8cc5a52144f1ba47

pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev Open in urlscan Pro 2606:4700::6812:223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

5 kBTransfer

5 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

Indicators

pub-c0cb850463fa4a829f359a8b71f77d02.r2.dev Open in urlscan Pro
2606:4700::6812:223 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

5 kB
Transfer

5 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions