onedrive-d5t.pages.dev Open in urlscan Pro
172.66.47.146  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://onedrive-d5t.pages.dev/?8369bac7147471f5c21c0b0528756aaflwe1caiz=U2FsdGVkX1%2FA9kDQBNcG4RTKIzDOCXcKC95LCOAbVmE%2Fx%2BIELy3kNb8VqUjBekjJlA1uz%2FRkjANhX%2FcMC2xVUXsroad%2BJD7Ld9GKSLvF6Dw3sZZwCZdRjcQtiGIWTxcUs041jqK7kuI7AmO8dVDE%2B90G%2FjL%2F1dcA%2B5%2BEoQ3XFGmWZlnE%2FzXchAk2ioxrs%2FXOKzLMito7wHSSS9ntlZyk6PXaFWKbLxymihFSNLDT1L8uKluuNQvyvHp%2BXuPpwCnjT7toNmMPXn2iF87XWSD7Viw Page URL
2. https://onedrive-d5t.pages.dev/?9594a3f0b3c137bf8dad1ffcdce49b16lwe3a0q8=U2FsdGVkX1%2Bpwuh8Epr2H8bAwL3WDAXGKJOSnzxS6Qiv%2F%2BAC%2Bxztl5MaUEHJ4aFDEGnpkpz53uTJ5LDM9lPW00wd%2FrQAlCiOlua7c3vFBuNZ9rsSts58NmRR0wqhMuvJ%2BT0MsGvUXBSHiZr2baZRu3vf0ku58SPp9RBzEN0XDYb2I5lMnl5X1Xu34Gb24VfM7vbPHy4ysHm%2FmxDtYvlTg7GHxXs9bv%2B1xaVy6%2B08vJdx2HpIHxGD1rScLFytFqVRI1Oe0mZPE4O6hwcI%2FWk%2BnG75vIPrrhah4bcYfaUf2Kc%2FfO%2FNUaP8qGhhuGPDgxSlkhrddH1%2BUZG7Fj3zxDZO1wpbjiATpGkV%2BzHvS0q09iAHDpQK1kJjnmooJlh%2BFL2zCDnThW%2FUkH8HU4Hqi2aJiVE6aFp3AGE4GohcWnOWvnXzXwXs2ULs%2BP%2BaN9hv9j3wsdFwWFDnOHtq8TiIQ7%2BIwVxuLl19%2BA86ruxp05tqemYfpJX8scnA1ivi5gLGlXaOwE2xqd%2BuFO5XcrWnPMY%2FrPjRsyg%2Ft8K4B2mGlXiZ32e%2BEUaQIbgORJim1oySMsDkS692TD1LmJMutUzxBD1A7LV%2BcF5VPlmxdHWDCxKZeSc9jfyO5u0AQrAYpaLoESJmSPLFz%2B5X8Gq7c8KgjwBA8aFskL9W0aBfvzm%2BI2oCPUryIqj9nFcVEAiWvfNfJrV3ltsonOQ1yWfZx6fQFFHj0wdVZi%2FH74oHeJKoLi1I9U5lIp%2Bf0KyAqcDok%2F5sd5WPLxiVpxuMrxeoxtT0AEsGW4KAAC6AVvZYYb6blvueFMIaII3G7mplf1TbdesqZktakQXv0Ll149SZNWi%2FMO2OFCiKzxNU7eKAvKBymttXu6XI8Iqc%2BHn0MW5Gs3MqVAQqueiG98p0%2BZS8IJXbr6e0iMKqyYFfsOYWcbo8HTiUo1IwypE3ITDGMD5cBCUGHLna3zSn9oH2QPWoGRx1bMBydPVABOum%2FHUc1shNpKMr4%2FwRxyEpFC6JGmsDJ5vn0CGHFKIenNzzExy67vqJ9N9biEu3QrLyFuYkiym51boMvJpycF8iqx72uhVvvP%2Bm%2BCqF4iStFssb7xGle2PGSPkwwtZYIggefnKQMLsGE%2BPHuv3KYGlFEvpa1cn3wLbhEuVvIK5Lfpu7K6iMFuDeNCDh8ZMxFsTHqw64maEF4EF2JkAALkvSWAXeZvxAwbn3CvmXeIQR8T0bMepRxquOaCxTdvRLjNhty2N862xIT0V0zxCV7aFZfM7YrzZb9PisRcFaYlHr3h7BFJR8y3zm8axq2aUq91u90T19w%2BrTqtVDUvxBHa62wxp%2BF4RPf4YaD22dIOJxiMxVWaZ0ceibl%2B88j4SAyOpvs9dSNLndJOpX4clV9IH4wQeg%2B%2FpAD1s08DjP0RMAAFvyAKqwc%2Bk5RRwo2NnMREIfqBDkmvXEpnw4WAEakT8O5FbXzZiFVuJkIXokWJyF6fappzb5jDopDrrTFD7ZhA7zb0seR5xl%2Bl74FM30nmmJEgr0D%2F0dURV583PXjWiK1nVqgM%2Frn2paGk%2FmlVn0ZYMApDcP0eupdXmDOkCzzrgu%2FrRdsBmu97Hhqo3vVcuVrvpc4wgF8aa9Si%2Fm3Q%3D%3D Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	/ Show response onedrive-d5t.pages.dev/	519 B 918 B	159ms 94ms	Document text/html	172.66.47.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onedrive-d5t.pages.dev/?8369bac7147471f5c21c0b0528756aaflwe1caiz=U2FsdGVkX1%2FA9kDQBNcG4RTKIzDOCXcKC95LCOAbVmE%2Fx%2BIELy3kNb8VqUjBekjJlA1uz%2FRkjANhX%2FcMC2xVUXsroad%2BJD7Ld9GKSLvF6Dw3sZZwCZdRjcQtiGIWTxcUs041jqK7kuI7AmO8dVDE%2B90G%2FjL%2F1dcA%2B5%2BEoQ3XFGmWZlnE%2FzXchAk2ioxrs%2FXOKzLMito7wHSSS9ntlZyk6PXaFWKbLxymihFSNLDT1L8uKluuNQvyvHp%2BXuPpwCnjT7toNmMPXn2iF87XWSD7Viw Protocol H3 Security QUIC, , AES_128_GCM Server 172.66.47.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f4cd2a84ad56dea7b6c2bc8985820a66159aa5959190ac5100f4864ae575f35 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 886767ff7d609150-FRA content-encoding br content-type text/html; charset=utf-8 date Sun, 19 May 2024 22:08:33 GMT etag W/"e6916f8bd1a92a0c5985651591964c3a" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uAu%2BnGj8KCeEdg5T%2Fb%2Bu670IdRQo55POAGuTWT62ncmb1dZ7G%2FDGJDhuXwdbkZPyDyyX803HVE0EKgJSaNoJowcAlIoHnZwfYi1cgpryBIE4sBFD3tJb4RwfXVgWUl6NQHLrXbT%2B1aF"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	e700b3c7-1f09-473d-8204-a351c7314e93.js Show response cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	1 MB 258 KB	120ms 35ms	Script application/javascript	2a04:4e42:600::347 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Requested by Host: onedrive-d5t.pages.dev URL: https://onedrive-d5t.pages.dev/?8369bac7147471f5c21c0b0528756aaflwe1caiz=U2FsdGVkX1%2FA9kDQBNcG4RTKIzDOCXcKC95LCOAbVmE%2Fx%2BIELy3kNb8VqUjBekjJlA1uz%2FRkjANhX%2FcMC2xVUXsroad%2BJD7Ld9GKSLvF6Dw3sZZwCZdRjcQtiGIWTxcUs041jqK7kuI7AmO8dVDE%2B90G%2FjL%2F1dcA%2B5%2BEoQ3XFGmWZlnE%2FzXchAk2ioxrs%2FXOKzLMito7wHSSS9ntlZyk6PXaFWKbLxymihFSNLDT1L8uKluuNQvyvHp%2BXuPpwCnjT7toNmMPXn2iF87XWSD7Viw Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::347 , United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 5e50f5d172da4a2b703b75ad3eb5517d77596a453fd6af10d404ffdcd413d989 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 1032968 x-cache HIT, HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 263937 x-served-by cache-sjc10065-SJC, cache-fra-etou8220135-FRA server statically etag W/"25f0b8fa4c375322da53e67d9fced24fd989801591b8a077fece62e4e11aec35" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H2	200	/ ipapi.co/json/	743 B 886 B	283ms 215ms	Fetch application/json	2606:4700:20::681a:92c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ipapi.co/json/ Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:20::681a:92c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff referrer-policy same-origin cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Host, origin allow OPTIONS, GET, OPTIONS, POST, HEAD content-type application/json access-control-allow-origin https://onedrive-d5t.pages.dev report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r310RtWcQlH5DsiZcZcoV4kdjXhN2uSSVcWgX9ThGWAAaVl6BZVDdD2l4EnzBK6et55Rcm95%2BqAdXBj2vsTGOmhMg5yZfVRn3ZbSGAIbWPqnKdluMHBf6LMnFM6MRfiMkVpufxdy"}],"group":"cf-nel","max_age":604800} x-frame-options DENY cf-ray 8867680228b0366b-FRA
GET H2	200	css2 fonts.googleapis.com/	23 KB 2 KB	92ms 32ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cfc8eb2364654236f721c3cdc1561fd59a30fec84ed1399ab4aaec6908bf9b5d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Sun, 19 May 2024 22:08:33 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Sun, 19 May 2024 21:34:09 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 19 May 2024 22:08:33 GMT
GET H3	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	81ms 40ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Origin https://onedrive-d5t.pages.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 2653831 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mq83pU%2BcIg%2BjGJMztAFkXGOuorF5IyAZBhOO8vA1YI8bYkd72smW1qtQfrJEl14qQ0E3dgpKU1qvgPG2i3%2BS1mrntky2IdJtxWxZMIdvo1%2Buj9BniPrLKWWMk4qWYgzqZKhu3DM%2B"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 886768020f891da6-FRA expires Fri, 09 May 2025 22:08:33 GMT
GET DATA	200 OK	truncated /	685 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash de35e1476372d3afbc25fc0ac689d7933145099fbd36d63cf049fa6de4814808 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	fa37e6e4fd65b2e85394.ico cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	3 KB 3 KB	26ms 25ms	Other image/vnd.microsoft.icon	2a04:4e42:600::347 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/fa37e6e4fd65b2e85394.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::347 , United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 9ac552c9c42db29135a722f8e7c2d897257115f50432180518b3b63ccf2e6078 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 396409 x-cache HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 2661 x-served-by cache-fra-etou8220135-FRA server statically etag "a7dd61d4086321c9e38405ce8e57211182cf71ea9ba95985abfa251e2282ef82" vary Accept-Encoding content-type image/vnd.microsoft.icon access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H3	200	Primary Request / Show response onedrive-d5t.pages.dev/	519 B 880 B	68ms 67ms	Document text/html	172.66.47.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onedrive-d5t.pages.dev/?9594a3f0b3c137bf8dad1ffcdce49b16lwe3a0q8=U2FsdGVkX1%2Bpwuh8Epr2H8bAwL3WDAXGKJOSnzxS6Qiv%2F%2BAC%2Bxztl5MaUEHJ4aFDEGnpkpz53uTJ5LDM9lPW00wd%2FrQAlCiOlua7c3vFBuNZ9rsSts58NmRR0wqhMuvJ%2BT0MsGvUXBSHiZr2baZRu3vf0ku58SPp9RBzEN0XDYb2I5lMnl5X1Xu34Gb24VfM7vbPHy4ysHm%2FmxDtYvlTg7GHxXs9bv%2B1xaVy6%2B08vJdx2HpIHxGD1rScLFytFqVRI1Oe0mZPE4O6hwcI%2FWk%2BnG75vIPrrhah4bcYfaUf2Kc%2FfO%2FNUaP8qGhhuGPDgxSlkhrddH1%2BUZG7Fj3zxDZO1wpbjiATpGkV%2BzHvS0q09iAHDpQK1kJjnmooJlh%2BFL2zCDnThW%2FUkH8HU4Hqi2aJiVE6aFp3AGE4GohcWnOWvnXzXwXs2ULs%2BP%2BaN9hv9j3wsdFwWFDnOHtq8TiIQ7%2BIwVxuLl19%2BA86ruxp05tqemYfpJX8scnA1ivi5gLGlXaOwE2xqd%2BuFO5XcrWnPMY%2FrPjRsyg%2Ft8K4B2mGlXiZ32e%2BEUaQIbgORJim1oySMsDkS692TD1LmJMutUzxBD1A7LV%2BcF5VPlmxdHWDCxKZeSc9jfyO5u0AQrAYpaLoESJmSPLFz%2B5X8Gq7c8KgjwBA8aFskL9W0aBfvzm%2BI2oCPUryIqj9nFcVEAiWvfNfJrV3ltsonOQ1yWfZx6fQFFHj0wdVZi%2FH74oHeJKoLi1I9U5lIp%2Bf0KyAqcDok%2F5sd5WPLxiVpxuMrxeoxtT0AEsGW4KAAC6AVvZYYb6blvueFMIaII3G7mplf1TbdesqZktakQXv0Ll149SZNWi%2FMO2OFCiKzxNU7eKAvKBymttXu6XI8Iqc%2BHn0MW5Gs3MqVAQqueiG98p0%2BZS8IJXbr6e0iMKqyYFfsOYWcbo8HTiUo1IwypE3ITDGMD5cBCUGHLna3zSn9oH2QPWoGRx1bMBydPVABOum%2FHUc1shNpKMr4%2FwRxyEpFC6JGmsDJ5vn0CGHFKIenNzzExy67vqJ9N9biEu3QrLyFuYkiym51boMvJpycF8iqx72uhVvvP%2Bm%2BCqF4iStFssb7xGle2PGSPkwwtZYIggefnKQMLsGE%2BPHuv3KYGlFEvpa1cn3wLbhEuVvIK5Lfpu7K6iMFuDeNCDh8ZMxFsTHqw64maEF4EF2JkAALkvSWAXeZvxAwbn3CvmXeIQR8T0bMepRxquOaCxTdvRLjNhty2N862xIT0V0zxCV7aFZfM7YrzZb9PisRcFaYlHr3h7BFJR8y3zm8axq2aUq91u90T19w%2BrTqtVDUvxBHa62wxp%2BF4RPf4YaD22dIOJxiMxVWaZ0ceibl%2B88j4SAyOpvs9dSNLndJOpX4clV9IH4wQeg%2B%2FpAD1s08DjP0RMAAFvyAKqwc%2Bk5RRwo2NnMREIfqBDkmvXEpnw4WAEakT8O5FbXzZiFVuJkIXokWJyF6fappzb5jDopDrrTFD7ZhA7zb0seR5xl%2Bl74FM30nmmJEgr0D%2F0dURV583PXjWiK1nVqgM%2Frn2paGk%2FmlVn0ZYMApDcP0eupdXmDOkCzzrgu%2FrRdsBmu97Hhqo3vVcuVrvpc4wgF8aa9Si%2Fm3Q%3D%3D Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H3 Security QUIC, , AES_128_GCM Server 172.66.47.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f4cd2a84ad56dea7b6c2bc8985820a66159aa5959190ac5100f4864ae575f35 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://onedrive-d5t.pages.dev/?9594a3f0b3c137bf8dad1ffcdce49b16lwe3a0q8=U2FsdGVkX1%2Bpwuh8Epr2H8bAwL3WDAXGKJOSnzxS6Qiv%2F%2BAC%2Bxztl5MaUEHJ4aFDEGnpkpz53uTJ5LDM9lPW00wd%2FrQAlCiOlua7c3vFBuNZ9rsSts58NmRR0wqhMuvJ%2BT0MsGvUXBSHiZr2baZRu3vf0ku58SPp9RBzEN0XDYb2I5lMnl5X1Xu34Gb24VfM7vbPHy4ysHm%2FmxDtYvlTg7GHxXs9bv%2B1xaVy6%2B08vJdx2HpIHxGD1rScLFytFqVRI1Oe0mZPE4O6hwcI%2FWk%2BnG75vIPrrhah4bcYfaUf2Kc%2FfO%2FNUaP8qGhhuGPDgxSlkhrddH1%2BUZG7Fj3zxDZO1wpbjiATpGkV%2BzHvS0q09iAHDpQK1kJjnmooJlh%2BFL2zCDnThW%2FUkH8HU4Hqi2aJiVE6aFp3AGE4GohcWnOWvnXzXwXs2ULs%2BP%2BaN9hv9j3wsdFwWFDnOHtq8TiIQ7%2BIwVxuLl19%2BA86ruxp05tqemYfpJX8scnA1ivi5gLGlXaOwE2xqd%2BuFO5XcrWnPMY%2FrPjRsyg%2Ft8K4B2mGlXiZ32e%2BEUaQIbgORJim1oySMsDkS692TD1LmJMutUzxBD1A7LV%2BcF5VPlmxdHWDCxKZeSc9jfyO5u0AQrAYpaLoESJmSPLFz%2B5X8Gq7c8KgjwBA8aFskL9W0aBfvzm%2BI2oCPUryIqj9nFcVEAiWvfNfJrV3ltsonOQ1yWfZx6fQFFHj0wdVZi%2FH74oHeJKoLi1I9U5lIp%2Bf0KyAqcDok%2F5sd5WPLxiVpxuMrxeoxtT0AEsGW4KAAC6AVvZYYb6blvueFMIaII3G7mplf1TbdesqZktakQXv0Ll149SZNWi%2FMO2OFCiKzxNU7eKAvKBymttXu6XI8Iqc%2BHn0MW5Gs3MqVAQqueiG98p0%2BZS8IJXbr6e0iMKqyYFfsOYWcbo8HTiUo1IwypE3ITDGMD5cBCUGHLna3zSn9oH2QPWoGRx1bMBydPVABOum%2FHUc1shNpKMr4%2FwRxyEpFC6JGmsDJ5vn0CGHFKIenNzzExy67vqJ9N9biEu3QrLyFuYkiym51boMvJpycF8iqx72uhVvvP%2Bm%2BCqF4iStFssb7xGle2PGSPkwwtZYIggefnKQMLsGE%2BPHuv3KYGlFEvpa1cn3wLbhEuVvIK5Lfpu7K6iMFuDeNCDh8ZMxFsTHqw64maEF4EF2JkAALkvSWAXeZvxAwbn3CvmXeIQR8T0bMepRxquOaCxTdvRLjNhty2N862xIT0V0zxCV7aFZfM7YrzZb9PisRcFaYlHr3h7BFJR8y3zm8axq2aUq91u90T19w%2BrTqtVDUvxBHa62wxp%2BF4RPf4YaD22dIOJxiMxVWaZ0ceibl%2B88j4SAyOpvs9dSNLndJOpX4clV9IH4wQeg%2B%2FpAD1s08DjP0RMAAFvyAKqwc%2Bk5RRwo2NnMREIfqBDkmvXEpnw4WAEakT8O5FbXzZiFVuJkIXokWJyF6fappzb5jDopDrrTFD7ZhA7zb0seR5xl%2Bl74FM30nmmJEgr0D%2F0dURV583PXjWiK1nVqgM%2Frn2paGk%2FmlVn0ZYMApDcP0eupdXmDOkCzzrgu%2FrRdsBmu97Hhqo3vVcuVrvpc4wgF8aa9Si%2Fm3Q%3D%3D Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 88676803b8f79150-FRA content-encoding br content-type text/html; charset=utf-8 date Sun, 19 May 2024 22:08:33 GMT etag W/"e6916f8bd1a92a0c5985651591964c3a" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GfNbmFi2VSqydi5zHg9I2trti%2FwYeMbNmas%2Bm5eXv%2FAjiDzh8pQeS9%2FbRTa4ySHglI50qeTJADMIXfp8YQAZgLG1LlvG89wNitdcQu3mkWUs%2FZJqc9seU8aD3lXCgqXfcw14VYK0URei"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	e700b3c7-1f09-473d-8204-a351c7314e93.js Show response cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	1 MB 0	120ms 35ms	Script application/javascript	2a04:4e42:600::347 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Requested by Host: onedrive-d5t.pages.dev URL: https://onedrive-d5t.pages.dev/?9594a3f0b3c137bf8dad1ffcdce49b16lwe3a0q8=U2FsdGVkX1%2Bpwuh8Epr2H8bAwL3WDAXGKJOSnzxS6Qiv%2F%2BAC%2Bxztl5MaUEHJ4aFDEGnpkpz53uTJ5LDM9lPW00wd%2FrQAlCiOlua7c3vFBuNZ9rsSts58NmRR0wqhMuvJ%2BT0MsGvUXBSHiZr2baZRu3vf0ku58SPp9RBzEN0XDYb2I5lMnl5X1Xu34Gb24VfM7vbPHy4ysHm%2FmxDtYvlTg7GHxXs9bv%2B1xaVy6%2B08vJdx2HpIHxGD1rScLFytFqVRI1Oe0mZPE4O6hwcI%2FWk%2BnG75vIPrrhah4bcYfaUf2Kc%2FfO%2FNUaP8qGhhuGPDgxSlkhrddH1%2BUZG7Fj3zxDZO1wpbjiATpGkV%2BzHvS0q09iAHDpQK1kJjnmooJlh%2BFL2zCDnThW%2FUkH8HU4Hqi2aJiVE6aFp3AGE4GohcWnOWvnXzXwXs2ULs%2BP%2BaN9hv9j3wsdFwWFDnOHtq8TiIQ7%2BIwVxuLl19%2BA86ruxp05tqemYfpJX8scnA1ivi5gLGlXaOwE2xqd%2BuFO5XcrWnPMY%2FrPjRsyg%2Ft8K4B2mGlXiZ32e%2BEUaQIbgORJim1oySMsDkS692TD1LmJMutUzxBD1A7LV%2BcF5VPlmxdHWDCxKZeSc9jfyO5u0AQrAYpaLoESJmSPLFz%2B5X8Gq7c8KgjwBA8aFskL9W0aBfvzm%2BI2oCPUryIqj9nFcVEAiWvfNfJrV3ltsonOQ1yWfZx6fQFFHj0wdVZi%2FH74oHeJKoLi1I9U5lIp%2Bf0KyAqcDok%2F5sd5WPLxiVpxuMrxeoxtT0AEsGW4KAAC6AVvZYYb6blvueFMIaII3G7mplf1TbdesqZktakQXv0Ll149SZNWi%2FMO2OFCiKzxNU7eKAvKBymttXu6XI8Iqc%2BHn0MW5Gs3MqVAQqueiG98p0%2BZS8IJXbr6e0iMKqyYFfsOYWcbo8HTiUo1IwypE3ITDGMD5cBCUGHLna3zSn9oH2QPWoGRx1bMBydPVABOum%2FHUc1shNpKMr4%2FwRxyEpFC6JGmsDJ5vn0CGHFKIenNzzExy67vqJ9N9biEu3QrLyFuYkiym51boMvJpycF8iqx72uhVvvP%2Bm%2BCqF4iStFssb7xGle2PGSPkwwtZYIggefnKQMLsGE%2BPHuv3KYGlFEvpa1cn3wLbhEuVvIK5Lfpu7K6iMFuDeNCDh8ZMxFsTHqw64maEF4EF2JkAALkvSWAXeZvxAwbn3CvmXeIQR8T0bMepRxquOaCxTdvRLjNhty2N862xIT0V0zxCV7aFZfM7YrzZb9PisRcFaYlHr3h7BFJR8y3zm8axq2aUq91u90T19w%2BrTqtVDUvxBHa62wxp%2BF4RPf4YaD22dIOJxiMxVWaZ0ceibl%2B88j4SAyOpvs9dSNLndJOpX4clV9IH4wQeg%2B%2FpAD1s08DjP0RMAAFvyAKqwc%2Bk5RRwo2NnMREIfqBDkmvXEpnw4WAEakT8O5FbXzZiFVuJkIXokWJyF6fappzb5jDopDrrTFD7ZhA7zb0seR5xl%2Bl74FM30nmmJEgr0D%2F0dURV583PXjWiK1nVqgM%2Frn2paGk%2FmlVn0ZYMApDcP0eupdXmDOkCzzrgu%2FrRdsBmu97Hhqo3vVcuVrvpc4wgF8aa9Si%2Fm3Q%3D%3D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::347 , United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 5e50f5d172da4a2b703b75ad3eb5517d77596a453fd6af10d404ffdcd413d989 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 1032968 x-cache HIT, HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 263937 x-served-by cache-sjc10065-SJC, cache-fra-etou8220135-FRA server statically etag W/"25f0b8fa4c375322da53e67d9fced24fd989801591b8a077fece62e4e11aec35" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H2	200	css2 fonts.googleapis.com/	23 KB 0	92ms 32ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cfc8eb2364654236f721c3cdc1561fd59a30fec84ed1399ab4aaec6908bf9b5d Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Sun, 19 May 2024 22:08:33 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Sun, 19 May 2024 21:34:09 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sun, 19 May 2024 22:08:33 GMT
GET H3	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 0	81ms 40ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: cdn.statically.io URL: https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/e700b3c7-1f09-473d-8204-a351c7314e93.js?hash=096b1515a561abfb0055edce6562ecfd&NRhmINhPeMbW9umkYHCm=KUpqh7FUurdunIpuWn76RuxutCXrAUQSmhxB17e90iDyX2lnWbF6hiZliXUWwzFzsrZhutZpWAvAipic6k82pnZiMDXNN37yIWhwLZAJLjrbPhjjXqEjvcjVN6UCfngs8A60HCCRmJaD1C3aFhEXF9raf4wWwFnqtY4XhMtFzZBbfSusHpaCWcoAPlGBP13hafudf6Yy Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Origin https://onedrive-d5t.pages.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 2653831 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mq83pU%2BcIg%2BjGJMztAFkXGOuorF5IyAZBhOO8vA1YI8bYkd72smW1qtQfrJEl14qQ0E3dgpKU1qvgPG2i3%2BS1mrntky2IdJtxWxZMIdvo1%2Buj9BniPrLKWWMk4qWYgzqZKhu3DM%2B"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 886768020f891da6-FRA expires Fri, 09 May 2025 22:08:33 GMT
GET DATA	200 OK	truncated /	685 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash de35e1476372d3afbc25fc0ac689d7933145099fbd36d63cf049fa6de4814808 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H3	200	847fc5ec58b3a0af255c.svg cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	10 KB 4 KB	36ms 36ms	Image image/svg+xml	151.101.65.91 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/847fc5ec58b3a0af255c.svg Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.65.91 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 93cacbb2f74c55645024c9823873891b4633146a9f6f61c8be080d72924fd0b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:34 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains; preload age 478776 x-cache HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 4186 x-served-by cache-fra-etou8220102-FRA server statically etag "d45d06d2f4837f81a6578f2bb15da5ea4cb8682d790d24b959d6b933587751e1" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H2	200	fa37e6e4fd65b2e85394.ico cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	3 KB 0	0ms 0ms	Other image/vnd.microsoft.icon	2a04:4e42:600::347 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/fa37e6e4fd65b2e85394.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::347 , United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 9ac552c9c42db29135a722f8e7c2d897257115f50432180518b3b63ccf2e6078 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:33 GMT content-encoding br x-content-type-options nosniff age 396409 x-cache HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 2661 x-served-by cache-fra-etou8220135-FRA server statically etag "a7dd61d4086321c9e38405ce8e57211182cf71ea9ba95985abfa251e2282ef82" vary Accept-Encoding content-type image/vnd.microsoft.icon access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H3	200	07308ee98aa47f067087.jpg cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	47 KB 47 KB	40ms 39ms	Image image/jpeg	151.101.65.91 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/07308ee98aa47f067087.jpg Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.65.91 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash 5fe991e3985f36c957bc2a0b9a212052210b988b5536059e5fe8544a5104eb19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff age 489789 x-cache HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 47917 x-served-by cache-fra-etou8220102-FRA server statically etag "7dbfb389c00ba810cdbdbba14898b96fb63a8cde687e4e31ecfd77a6bd4b1586" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	89ms 26ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://fonts.googleapis.com/ Origin https://onedrive-d5t.pages.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sat, 18 May 2024 20:31:08 GMT x-content-type-options nosniff age 92246 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 18 May 2025 20:31:08 GMT
GET H3	200	59947dbf5efae9de77d2.png cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/	39 KB 39 KB	45ms 45ms	Image image/png	151.101.65.91 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.statically.io/gh/justwetdeyplay/philanthropic-release-lvv3bh0w@main/59947dbf5efae9de77d2.png Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.65.91 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software statically / Resource Hash ae9cc64390a76c779bd0da29fcff4dd063438985d6f9c331c3b984534dd5e6cf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://onedrive-d5t.pages.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 19 May 2024 22:08:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff age 334883 x-cache HIT alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 39930 x-served-by cache-fra-etou8220102-FRA server statically etag "13cfc408f178ab83c0f732aeb04633979f7537229d9c16317d01c4553de1efc2" vary Accept-Encoding content-type image/png access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, immutable timing-allow-origin *
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	96ms 34ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://fonts.googleapis.com/ Origin https://onedrive-d5t.pages.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 13 May 2024 18:30:08 GMT x-content-type-options nosniff age 531506 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 May 2025 18:30:08 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	119ms 57ms	Font font/woff2	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://fonts.googleapis.com/ Origin https://onedrive-d5t.pages.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sat, 18 May 2024 00:45:23 GMT x-content-type-options nosniff age 163391 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 18 May 2025 00:45:23 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| a0_0x316a function| a0_0x1e3f

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.statically.io
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
ipapi.co
onedrive-d5t.pages.dev
104.17.25.14
151.101.65.91
172.66.47.146
2606:4700:20::681a:92c
2a00:1450:4001:800::200a
2a00:1450:4001:806::2003
2a04:4e42:600::347
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
4f4cd2a84ad56dea7b6c2bc8985820a66159aa5959190ac5100f4864ae575f35
5e50f5d172da4a2b703b75ad3eb5517d77596a453fd6af10d404ffdcd413d989
5fe991e3985f36c957bc2a0b9a212052210b988b5536059e5fe8544a5104eb19
93cacbb2f74c55645024c9823873891b4633146a9f6f61c8be080d72924fd0b8
9ac552c9c42db29135a722f8e7c2d897257115f50432180518b3b63ccf2e6078
ae9cc64390a76c779bd0da29fcff4dd063438985d6f9c331c3b984534dd5e6cf
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
cfc8eb2364654236f721c3cdc1561fd59a30fec84ed1399ab4aaec6908bf9b5d
de35e1476372d3afbc25fc0ac689d7933145099fbd36d63cf049fa6de4814808
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615