Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 23.48.203.11, located in Ashburn, United States and belongs to AKAMAI-ASN1 Akamai International B.V., NL. The main domain is img1.wsimg.com. The Cisco Umbrella rank of the primary domain is 11436. 10yr old
TLS certificate: Issued by Starfield Secure Certificate Authorit... on September 5th 2025. Valid for: 1yr.
This is the only time img1.wsimg.com was scanned on urlscan.io!

Domain & IP information

IP Address AS Autonomous System
2 23.48.203.11 23.48.203.11 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1 () ()
4 3
Apex Domain
Subdomains
Transfer
2 wsimg.com
img1.wsimg.com — Cisco Umbrella Rank: 11436 10yr old
321 B
1
function sub() { [native code] }.
4 2
Domain Requested by
2 img1.wsimg.com
1 mhjfbmdgcfjbbpaeojofohoefgiehjai
4 2

This site contains no links.

Subject Issuer Validity Valid
*.wsimg.com
Starfield Secure Certificate Authority - G2
2025-09-05 -
2026-10-07
1yr crt.sh

This page contains 2 frames:

Primary Page: https://img1.wsimg.com/blobby/go/9bb1211e-5634-4d43-b272-c1e6e5f62c2e/downloads/how_much_is_medio_litro.pdf
Frame ID: 0B4E8E03CCA8153D1A25E3C5186B85A7
Requests: 3 HTTP requests in this frame

Frame: chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index.html
Frame ID: 9178EDA0AB3F64EFDBC11C1589EDC02A
Requests: 1 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.


Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

0 kB
Transfer

3 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
Primary Request how_much_is_medio_litro.pdf Show response
img1.wsimg.com/blobby/go/9bb1211e-5634-4d43-b272-c1e6e5f62c2e/downloads/
536 B
0
544ms
135ms
Document
application/pdf
23.48.203.11
AKAMAI-ASN1 Akama...
General
Full URL
https://img1.wsimg.com/blobby/go/9bb1211e-5634-4d43-b272-c1e6e5f62c2e/downloads/how_much_is_medio_litro.pdf
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.203.11 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-48-203-11.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fccf1b52139a9453966aaa16b953240d439feb5bb53e00981fbb0abbbc4e2d33

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
access-control-allow-credentials
true
access-control-allow-headers
*
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
237971
content-type
application/pdf
date
Wed, 09 Sep 2026 10:43:00 GMT
etag
"56053d4df760b1606a5f2f71c6270938"
expires
Thu, 09 Sep 2027 10:43:00 GMT
last-modified
Sat, 21 Oct 2023 12:56:05 GMT
timing-allow-origin
*
vary
Accept-Encoding
x-amzn-trace-id
Root=1-6533ca64-2d353042570e1b242aa6e353
x-forwarded-for
50.63.4.66
x-forwarded-port
443
x-forwarded-proto
https
x-version
0.7.3+sha-fa2a35c
GET
CHROME-EXTENSION
200
OK
pdf_embedder.css
mhjfbmdgcfjbbpaeojofohoefgiehjai/
552 B
0
Stylesheet
text/css

General
Full URL
chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/pdf_embedder.css
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/blobby/go/9bb1211e-5634-4d43-b272-c1e6e5f62c2e/downloads/how_much_is_medio_litro.pdf
Protocol
CHROME-EXTENSION
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6033c947772f072b2b1a29260ffd652f1a9171e2953efd62ebc8b77602a2ad2d
Security Headers
Name Value
Content-Security-Policy script-src 'self' blob: filesystem: chrome://resources chrome://webui-test; object-src * blob: externalfile: file: filesystem: data:;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Referer

Response headers

Content-Security-Policy
script-src 'self' blob: filesystem: chrome://resources chrome://webui-test; object-src * blob: externalfile: file: filesystem: data:;
Access-Control-Allow-Origin
*
Content-Length
552
Content-Type
text/css
Cross-Origin-Resource-Policy
cross-origin
GET
CHROME-EXTENSION
200
OK
index.html
mhjfbmdgcfjbbpaeojofohoefgiehjai/ Frame 9178
0
0
Document
text/html

General
Full URL
chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index.html
Protocol
CHROME-EXTENSION
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'self' blob: filesystem: chrome://resources chrome://webui-test; object-src * blob: externalfile: file: filesystem: data:;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Access-Control-Allow-Origin
*
Content-Length
493
Content-Security-Policy
script-src 'self' blob: filesystem: chrome://resources chrome://webui-test; object-src * blob: externalfile: file: filesystem: data:;
Content-Type
text/html
Cross-Origin-Resource-Policy
cross-origin
GET
H2
200
favicon.ico
img1.wsimg.com/
2 KB
321 B
38ms
37ms
Other
image/x-icon
23.48.203.11
AKAMAI-ASN1 Akama...
General
Full URL
https://img1.wsimg.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.48.203.11 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-48-203-11.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b5b14410ffdf0f4a5c3a84cb3d020d0d82f25d3c525bf4e4dd162864c7c4fdee

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://img1.wsimg.com/blobby/go/9bb1211e-5634-4d43-b272-c1e6e5f62c2e/downloads/how_much_is_medio_litro.pdf
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=31536000
timing-allow-origin
*
content-encoding
gzip
etag
"6d73404f853ac31:0"
expires
Thu, 09 Sep 2027 10:43:01 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
125
date
Wed, 09 Sep 2026 10:43:01 GMT
content-type
image/x-icon
last-modified
Tue, 24 Jun 2003 19:17:53 GMT
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

0 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img1.wsimg.com
mhjfbmdgcfjbbpaeojofohoefgiehjai

23.48.203.11
6033c947772f072b2b1a29260ffd652f1a9171e2953efd62ebc8b77602a2ad2d
b5b14410ffdf0f4a5c3a84cb3d020d0d82f25d3c525bf4e4dd162864c7c4fdee
fccf1b52139a9453966aaa16b953240d439feb5bb53e00981fbb0abbbc4e2d33