n19havucyrwwgyxuz10m8q-on.drv.tw Open in urlscan Pro
54.213.234.222  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/	5 KB 2 KB	4268ms 1914ms	Document text/html	54.213.234.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 54.213.234.222 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-213-234-222.us-west-2.compute.amazonaws.com Software nginx/1.14.2 / Resource Hash 16ace9436f57e55cfd6bbb8c49321713c0732f387ba66b9214f328469f8bd26a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx/1.14.2 date Fri, 05 Nov 2021 09:28:54 GMT content-type text/html last-modified Mon, 01 Nov 2021 18:15:16 GMT cache-control public, max-age=604800 vary Accept-Encoding content-encoding gzip x-cache BYPASS
GET H2	200	all.css use.fontawesome.com/releases/v5.5.0/css/	50 KB 12 KB	80ms 37ms	Stylesheet text/css	2606:4700:3037::6815:4e07 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v5.5.0/css/all.css Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:4e07 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2 Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:55 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 10502454 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id KAWEF1Y8S17D9X2G x-amz-id-2 8A8PS1bVfmGFcK9wNjjntrVOjA+JmJ+cWEkJuzGu/FmjkXEuCzj0t+uuRf4sbkSy9izBNTLJchw= last-modified Wed, 30 Jun 2021 15:43:32 GMT server cloudflare etag W/"1cc6c92172d124fbd305ba3d8e263333" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xLlw2o5Js0uPJRG5s5hrZv17uHhHdf4PKwqnVghfTrMgr1XIH2XyS2h%2FdJ85fZRPYlqu1t46toVeAsrVhBkmCuCwDpvBvRuDUdYHQUy9Q6j74WPqQDeX7fcw0353uCOuG00U0WlardXFgbrbEE5xrmfH"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31556926 cf-ray 6a950e001d8e59e3-MXP
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	47ms 8ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E9E) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 05 Nov 2021 09:28:55 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 16257986 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (frc/8E9E) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0c55977d-f01e-0098-2849-3ebec7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	54ms 17ms	Script application/javascript	2001:4de0:ac18::1:a:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Request headers Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ Origin https://n19havucyrwwgyxuz10m8q-on.drv.tw Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:55 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx etag W/"5a637bd4-1111d" vary Accept-Encoding x-hw 1636104535.dop011.ml1.t,1636104535.cds220.ml1.hn,1636104535.cds003.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24038
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/	20 KB 7 KB	37ms 17ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ Origin https://n19havucyrwwgyxuz10m8q-on.drv.tw Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:55 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 661448 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 6458 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-500f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ryz9mj4VXk5w%2BMHdNZZrxnJFZ%2FOkpfdMklnSitAOBNbaE62x%2F8W20WG4I3kNrpqdN3Ilvp0sMLWTGu0YrpM73HDxgKfMtBb%2Bujo%2BwnaK2JDkrXg3pmBIMYySm6ZwGHRMpNe7KzHuehL6iRbfusa7EhEJ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6a950dffebe34a5b-FRA expires Wed, 26 Oct 2022 09:28:55 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/	49 KB 15 KB	80ms 28ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ Origin https://n19havucyrwwgyxuz10m8q-on.drv.tw Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:55 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 565, 718, 718 age 30651 cdn-cachedat 2021-06-08 18:02:12 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:05 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 8926c9ba859010b5ff31acbe47c27d41 cf-ray 6a950e002de20e1e-MXP cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	ccnn.js Show response n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/js/	37 KB 15 KB	2776ms 2776ms	Script text/javascript	54.213.234.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/js/ccnn.js Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 54.213.234.222 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-213-234-222.us-west-2.compute.amazonaws.com Software nginx/1.14.2 / Resource Hash 5d522186ebee712119eb43cdcc56303a46d19dfc474a3f1729285a42ab0dea98 Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:57 GMT content-encoding gzip last-modified Wed, 27 Oct 2021 08:56:03 GMT server nginx/1.14.2 vary Accept-Encoding x-cache BYPASS content-type text/javascript cache-control public, max-age=604800
GET H2	200	wd.js Show response drv.tw/inc/	365 B 584 B	858ms 211ms	Script application/javascript	54.213.234.222 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://drv.tw/inc/wd.js Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 54.213.234.222 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-213-234-222.us-west-2.compute.amazonaws.com Software nginx/1.14.2 / Resource Hash 621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33 Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:55 GMT last-modified Mon, 28 Dec 2020 05:44:07 GMT server nginx/1.14.2 etag "5fe970a7-16d" x-cache BYPASS content-type application/javascript cache-control max-age=86400 accept-ranges bytes content-length 365 expires Sat, 06 Nov 2021 09:28:55 GMT
GET		bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.1.1/css/	0 0
GET		jquery.min.js cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/	0 0
GET		bootstrap.min.js maxcdn.bootstrapcdn.com/bootstrap/4.1.1/js/	0 0
GET H2	200	bg.jpg n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/js/	277 KB 277 KB	2290ms 2290ms	Image image/jpeg	54.213.234.222 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/js/bg.jpg Requested by Host: n19havucyrwwgyxuz10m8q-on.drv.tw URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 54.213.234.222 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-213-234-222.us-west-2.compute.amazonaws.com Software nginx/1.14.2 / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:57 GMT last-modified Wed, 10 Feb 2021 21:44:52 GMT server nginx/1.14.2 etag 0B2lHLbf3NT3XaEt2bUg1ekpyWkcxbklqdGN6MnBPTW55K1c4PQ vary Accept-Encoding x-cache BYPASS content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes content-length 283351
GET H2	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	64ms 26ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Requested by Host: drv.tw URL: https://drv.tw/inc/wd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b5516664d291a1139308bfe4f4e643efa06d39271327899e7d8d411e6854fe23 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Fri, 05 Nov 2021 09:28:58 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36346 x-xss-protection 0 last-modified Fri, 05 Nov 2021 09:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 05 Nov 2021 09:28:58 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	32ms 7ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 26 Oct 2021 23:24:02 GMT server Golfe2 age 5272 date Fri, 05 Nov 2021 08:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Fri, 05 Nov 2021 10:01:06 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 221 B	16ms 15ms	XHR text/plain	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=715404232&t=pageview&_s=1&dl=https%3A%2F%2Fn19havucyrwwgyxuz10m8q-on.drv.tw%2Fklimnb%2Ffgfdrserdtfygy765esdgvhb%2Fhgfdsewe5r6t7yijdgiuredbjhgf%2F%3Fc%3Dnae%2540spam.org&ul=en-us&de=UTF-8&dt=Office%20365%20Login&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1301863313&gjid=324172265&cid=1838221975.1636104538&tid=UA-85417367-1&_gid=618565080.1636104538&_r=1&gtm=2oub31&z=63190500 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 05 Nov 2021 09:28:58 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://n19havucyrwwgyxuz10m8q-on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 453 B	62ms 20ms	XHR text/plain	2a00:1450:400c:c06::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-85417367-1&cid=1838221975.1636104538&jid=1301863313&gjid=324172265&_gid=618565080.1636104538&_u=YEBAAUAAAAAAAC~&z=343996820 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://n19havucyrwwgyxuz10m8q-on.drv.tw/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 05 Nov 2021 09:28:58 GMT content-type text/plain access-control-allow-origin https://n19havucyrwwgyxuz10m8q-on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

maxcdn.bootstrapcdn.com

URL

http://maxcdn.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css

Domain

cdnjs.cloudflare.com

URL

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Domain

maxcdn.bootstrapcdn.com

URL

http://maxcdn.bootstrapcdn.com/bootstrap/4.1.1/js/bootstrap.min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery object| bootstrap string| wxPf string| QsGf number| suJf function| sOwg function| IGhg function| EXOg string| wRCg object| YSFg function| sikh number| kAWd function| EvNd function| UHle function| wJoe function| saWe object| webkitEventStorage function| AbortSignalRenderer function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.drv.tw/	1969-12-31 23:59:59	Name: uid Value: rBoO0mGE+Va8hAIoG4sNAg==
			.drv.tw/	1970-01-20 15:59:36	Name: _ga Value: GA1.2.1838221975.1636104538
			.drv.tw/	1970-01-19 22:29:50	Name: _gid Value: GA1.2.618565080.1636104538
			.drv.tw/	1970-01-19 22:28:24	Name: _gat_gtag_UA_85417367_1 Value: 1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org(Line 12) Message: Mixed Content: The page at 'https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Message: Mixed Content: The page at 'https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org' was loaded over HTTPS, but requested an insecure script 'http://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Message: Mixed Content: The page at 'https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org' was loaded over HTTPS, but requested an insecure script 'http://maxcdn.bootstrapcdn.com/bootstrap/4.1.1/js/bootstrap.min.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://n19havucyrwwgyxuz10m8q-on.drv.tw/klimnb/fgfdrserdtfygy765esdgvhb/hgfdsewe5r6t7yijdgiuredbjhgf/?c=nae%40spam.org Message: Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js' with computed SHA-256 integrity 'AoNQZpaRmemSTxMy9xcqXX5VLwI6IMPYugO7bFHOW+U='. The resource has been blocked.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
cdnjs.cloudflare.com
code.jquery.com
drv.tw
maxcdn.bootstrapcdn.com
n19havucyrwwgyxuz10m8q-on.drv.tw
stackpath.bootstrapcdn.com
stats.g.doubleclick.net
use.fontawesome.com
www.google-analytics.com
www.googletagmanager.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
152.199.23.37
2001:4de0:ac18::1:a:2a
2606:4700:3037::6815:4e07
2606:4700::6810:125e
2606:4700::6812:bcf
2a00:1450:4001:809::2008
2a00:1450:4001:830::200e
2a00:1450:400c:c06::9a
54.213.234.222
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
16ace9436f57e55cfd6bbb8c49321713c0732f387ba66b9214f328469f8bd26a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
5d522186ebee712119eb43cdcc56303a46d19dfc474a3f1729285a42ab0dea98
621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2
b5516664d291a1139308bfe4f4e643efa06d39271327899e7d8d411e6854fe23
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62