urlscan.io logo urlscan.io
SecurityTrails logo

bakery.breadheads.dev Open in urlscan Pro
76.76.21.241  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bakery.breadheads.dev/a
Effective URL: https://bakery.breadheads.dev/a
Submission: On February 10 via api from RU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 19 HTTP transactions. The main IP is 76.76.21.241, located in Walnut, United States and belongs to AMAZON-02, US. The main domain is bakery.breadheads.dev.
TLS certificate: Issued by R3 on January 4th 2023. Valid for: 3 months.
This is the only time bakery.breadheads.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 76.76.21.241 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
3 108.138.7.103 16509 (AMAZON-02)
1 52.22.239.239 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
3 54.187.159.182 16509 (AMAZON-02)
2 2600:9000:223... 16509 (AMAZON-02)
1 52.89.247.128 16509 (AMAZON-02)
19 9
6    76.76.21.241 (Walnut, United States)

ASN16509 (AMAZON-02, US)
bakery.breadheads.dev
2    2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    108.138.7.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-7-103.fra56.r.cloudfront.net
js.stripe.com
1    52.22.239.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-239-239.compute-1.amazonaws.com
candy-shop.liqnft.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com
q.stripe.com
2    2600:9000:223e:2400:19:7d10:bd80:93a1 (United States)

ASN16509 (AMAZON-02, US)
m.stripe.network
1    52.89.247.128 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-247-128.us-west-2.compute.amazonaws.com
m.stripe.com
Apex Domain
Subdomains		 Transfer
7 stripe.com
js.stripe.com — Cisco Umbrella Rank: 973
q.stripe.com — Cisco Umbrella Rank: 6111
m.stripe.com — Cisco Umbrella Rank: 972
110 KB
6 breadheads.dev
bakery.breadheads.dev
1 MB
2 stripe.network
m.stripe.network — Cisco Umbrella Rank: 1035
16 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34
1 KB
1 gstatic.com
fonts.gstatic.com
18 KB
1 liqnft.com
candy-shop.liqnft.com
843 B
19 6
Domain Requested by
6 bakery.breadheads.dev bakery.breadheads.dev
3 q.stripe.com bakery.breadheads.dev
3 js.stripe.com bakery.breadheads.dev
js.stripe.com
2 m.stripe.network js.stripe.com
m.stripe.network
2 fonts.googleapis.com bakery.breadheads.dev
1 m.stripe.com m.stripe.network
1 fonts.gstatic.com fonts.googleapis.com
1 candy-shop.liqnft.com bakery.breadheads.dev
19 8

This site contains no links.

Subject Issuer Validity Valid
bakery.breadheads.dev
R3		 2023-01-04 -
2023-04-04		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-01-31 -
2023-04-25		 3 months crt.sh
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA		 2023-02-06 -
2023-05-13		 3 months crt.sh
*.liqnft.com
Amazon		 2023-01-12 -
2024-02-11		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-01-31 -
2023-04-25		 3 months crt.sh
*.stripe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-11-12 -
2023-03-09		 4 months crt.sh
m.stripe.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-08 -
2023-04-08		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://bakery.breadheads.dev/a
Frame ID: 8A2B59F404DD77FE3047F22FAA488E99
Requests: 12 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-93afeeb17bc37e711759584dbfc50d47.html
Frame ID: E670A763835CD1043C44F0835EF2FA04
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 5A34E80BAE619DEC048DEF5A261B992C
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bread Heads Bakery

Page URL History Show full URLs

  1. http://bakery.breadheads.dev/a HTTP 307
    https://bakery.breadheads.dev/a Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • js\.stripe\.com
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

19
Requests

100 %
HTTPS

38 %
IPv6

6
Domains

8
Subdomains

9
IPs

2
Countries

1672 kB
Transfer

6022 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bakery.breadheads.dev/a HTTP 307
    https://bakery.breadheads.dev/a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request a
bakery.breadheads.dev/
Redirect Chain
  • http://bakery.breadheads.dev/a
  • https://bakery.breadheads.dev/a
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
d328321e950953b8fd5b95b86d70a44c99e6d0a3766542e04a93c5b9c1e9a3f1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
age
448575
cache-control
s-maxage=0
content-disposition
inline; filename="index.html"
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 10 Feb 2023 21:24:18 GMT
etag
W/"31829c55a064afe461e92ea1742438ee"
server
Vercel
strict-transport-security
max-age=63072000
x-vercel-cache
HIT
x-vercel-id
fra1:fra1::22bk5-1676064258772-46756b354e70

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://bakery.breadheads.dev/a
Non-Authoritative-Reason
HSTS
css2
fonts.googleapis.com/ 		1 KB
854 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Patrick+Hand&display=swap
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d3633a48e63d4b24f74952995f16d2f6b1a95d20a6fa49111f6e24de9277afbc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 10 Feb 2023 21:24:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 10 Feb 2023 19:56:00 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 10 Feb 2023 21:24:18 GMT
2.18b7c1a4.chunk.css
bakery.breadheads.dev/static/css/ 		559 KB
78 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bakery.breadheads.dev/static/css/2.18b7c1a4.chunk.css
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
5593211a585716c9a0b02918df9fd0441d31c4a8d312907d3cf6bad717120eb9
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 21:24:18 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1:fra1::22bk5-1676064258817-2cd2d7c346d4
age
448574
etag
W/"688a29a91b59b438a50d851357144141"
x-vercel-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
s-maxage=31536000, immutable
content-disposition
inline; filename="2.18b7c1a4.chunk.css"
main.5734057e.chunk.css
bakery.breadheads.dev/static/css/ 		664 B
851 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bakery.breadheads.dev/static/css/main.5734057e.chunk.css
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
e98df3a8bfa72c1af56ee9c6c30ed5353bbe8fb4121181032f5068eb2b552244
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 21:24:18 GMT
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1:fra1::gzfdh-1676064258805-7ef4fa3c5c36
age
448574
etag
"73c3bd6a7e08536e5f712d1959e90221"
x-vercel-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
s-maxage=31536000, immutable
content-disposition
inline; filename="main.5734057e.chunk.css"
accept-ranges
bytes
content-length
664
2.30763a1a.chunk.js
bakery.breadheads.dev/static/js/ 		5 MB
1 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://bakery.breadheads.dev/static/js/2.30763a1a.chunk.js
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
1e6fc40f2b8a04555a31453ce59d26c03944d76fd1df33fe5c429fa7ebfdab44
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 21:24:18 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1:fra1::94g87-1676064258805-5931f1de770d
age
823
etag
W/"e6f394db89580edc02bcbb6f60f24aee"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
s-maxage=31536000, immutable
content-disposition
inline; filename="2.30763a1a.chunk.js"
main.497475f7.chunk.js
bakery.breadheads.dev/static/js/ 		82 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bakery.breadheads.dev/static/js/main.497475f7.chunk.js
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
640b3cc9452c009b72a173f44ce7e1828fb596ffe5b87532ce0f8e3745ec12d3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 21:24:18 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1:fra1::pg7nl-1676064258805-3a0218efbc97
age
448574
etag
W/"4af17aa260778ef2575a6fa8f9f5d9ec"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
s-maxage=31536000, immutable
content-disposition
inline; filename="main.497475f7.chunk.js"
css2
fonts.googleapis.com/ 		2 KB
657 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@600&display=swap
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/static/css/2.18b7c1a4.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
60ff87a3fb21305e4b4a735f0d20c55fc5aacead2c5c51a98b256c9f5083187a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 10 Feb 2023 21:24:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 10 Feb 2023 21:13:08 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 10 Feb 2023 21:24:18 GMT
truncated
/ 		29 KB
29 KB 		Other
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67d12d34f82ef700ec3a3795a77590252858c70330908a87ed1e73efc268cb4b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type
application/wasm
v3
js.stripe.com/ 		436 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/static/js/2.30763a1a.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.7.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-7-103.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
1e6e2516b73285bedf40e79a10f11286ad90e4e27ef3e9b3c7c4284ac4bc7750
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
date
Fri, 10 Feb 2023 21:24:19 GMT
via
1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P6
x-cache
Hit from cloudfront
last-modified
Fri, 10 Feb 2023 20:24:17 GMT
server
Cloudfront
etag
W/"b6eff90e9e41aeced81ee8212bba1cea"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=60
timing-allow-origin
*
x-amz-cf-id
nJQACM56Nwwc25cxzKBcV_cDh69NLyVnHyh3bICEBfsFmPhPJYJWlw==
logo.png
bakery.breadheads.dev/ 		136 KB
136 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bakery.breadheads.dev/logo.png
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
a309e0ee52eaf56489d5c35805e0d10dfd0cebc7d031f49708929ed9313b2df2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bakery.breadheads.dev/a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Fri, 10 Feb 2023 21:24:19 GMT
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1:fra1::wlc2q-1676064259724-a3b1aac05bf8
age
448572
etag
"e6663266400a272c0b2d2961fe7fab1c"
x-vercel-cache
HIT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
content-disposition
inline; filename="logo.png"
accept-ranges
bytes
content-length
139377
csbMUULiQfGjT8ezT16EoEBaiarS6VWRevTw1JMydrS
candy-shop.liqnft.com/api/shop/owner/3AajDgUy6p8cYNr7FUGjN1tsph1PdNdqcp7bHmHVdqsB/mint/Bqf4Ep42BVL6gbFc47WUrV1jWhkPxYVbzqtMHaE7L63F/programId/ 		685 B
843 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://candy-shop.liqnft.com/api/shop/owner/3AajDgUy6p8cYNr7FUGjN1tsph1PdNdqcp7bHmHVdqsB/mint/Bqf4Ep42BVL6gbFc47WUrV1jWhkPxYVbzqtMHaE7L63F/programId/csbMUULiQfGjT8ezT16EoEBaiarS6VWRevTw1JMydrS
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/static/js/2.30763a1a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.239.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-239-239.compute-1.amazonaws.com
Software
/ Express
Resource Hash
032008af6445c1af4c70c92851d7a79382593e58193980bc917f00b82b60e0ed

Request headers

Accept
application/json, text/plain, */*
Referer
https://bakery.breadheads.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 10 Feb 2023 21:24:20 GMT
x-powered-by
Express
content-length
685
etag
W/"2ad-0GfP3wxg43azTtIA5JebPQ9jOdw"
content-type
application/json; charset=utf-8
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuGKYAZ9hiA.woff2
fonts.gstatic.com/s/inter/v12/ 		17 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/inter/v12/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuGKYAZ9hiA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@600&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
048d136d592e66896cccc1fe4fada4feb16b7f6af671cd49a2fe6ed6b2276c6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://bakery.breadheads.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Thu, 09 Feb 2023 13:49:04 GMT
x-content-type-options
nosniff
age
113715
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17660
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 21:02:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 09 Feb 2024 13:49:04 GMT
m-outer-93afeeb17bc37e711759584dbfc50d47.html
js.stripe.com/v3/ Frame E670 		200 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/m-outer-93afeeb17bc37e711759584dbfc50d47.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.7.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-7-103.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f22005da41e15b7adb453814b37a794f7c6b955f086a6c5fc9980e3c3f6c8bca
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bakery.breadheads.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
2909
cache-control
max-age=31536000
content-length
200
content-security-policy
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 10 Feb 2023 21:00:17 GMT
etag
"93afeeb17bc37e711759584dbfc50d47"
last-modified
Thu, 09 Feb 2023 23:29:43 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
x-amz-cf-id
cRdA58GjB97h1p1n9zwVH1yQlI5vgMvco_bYO4zxk2Usbs8lXbX_0g==
x-amz-cf-pop
FRA56-P6
x-cache
Hit from cloudfront
x-content-type-options
nosniff
csp-report
q.stripe.com/ Frame E670 		0
601 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 10 Feb 2023 21:24:20 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-envoy-upstream-service-time
1
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://js.stripe.com
access-control-expose-headers
Server, Range, Content-Type
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
csp-report
q.stripe.com/ Frame E670 		0
600 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 10 Feb 2023 21:24:20 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://js.stripe.com
access-control-expose-headers
Server, Range, Content-Type
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
m-outer-8cb24ab2d649fd36a488d04d8c457933.js
js.stripe.com/v3/fingerprinted/js/ Frame E670 		631 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/fingerprinted/js/m-outer-8cb24ab2d649fd36a488d04d8c457933.js
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-93afeeb17bc37e711759584dbfc50d47.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.7.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-7-103.fra56.r.cloudfront.net
Software
Cloudfront /
Resource Hash
250a0782da875705bd206ee23c2a46abf90656645a81e084126c5e8c53eeb9d6
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.stripe.com/v3/m-outer-93afeeb17bc37e711759584dbfc50d47.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Fri, 10 Feb 2023 20:47:35 GMT
x-content-type-options
nosniff
via
1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P6
age
3093
x-cache
Hit from cloudfront
content-length
631
last-modified
Mon, 06 Feb 2023 18:41:51 GMT
server
Cloudfront
etag
"f8f6a4584135f737b26927596ce6e0a7"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
I8JuPF8jKm5xQNbARE5JCqra-WSAJL-AxgvkTVXzjFK-nUed1q3P1w==
inner.html
m.stripe.network/ Frame 5A34 		930 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://m.stripe.network/inner.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-8cb24ab2d649fd36a488d04d8c457933.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:2400:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Cloudfront /
Resource Hash
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
27
cache-control
max-age=300, public
content-length
930
content-security-policy
base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 10 Feb 2023 21:23:52 GMT
etag
"fc2e029628f163bb59adc6fa5a31161c"
last-modified
Thu, 17 Mar 2022 19:03:12 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront)
x-amz-cf-id
vGX6iAfqfwfcjBHToUkXdNuQlMIKnuMa3fCsUZsTKcI12xCmWZu-1g==
x-amz-cf-pop
FRA56-P4
x-cache
Hit from cloudfront
x-content-type-options
nosniff
csp-report
q.stripe.com/ Frame 5A34 		0
374 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: bakery.breadheads.dev
URL: https://bakery.breadheads.dev/a
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
application/csp-report

Response headers

x-stripe-bg-intended-route-color
green
pragma
no-cache
date
Fri, 10 Feb 2023 21:24:20 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
server
nginx
cross-origin-opener-policy
same-origin
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
1
x-robots-tag
none
content-length
0
expires
0
out-4.5.42.js
m.stripe.network/ Frame 5A34 		86 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.stripe.network/out-4.5.42.js
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/inner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:2400:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Cloudfront /
Resource Hash
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://m.stripe.network/inner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
date
Fri, 10 Feb 2023 21:22:15 GMT
last-modified
Thu, 17 Mar 2022 19:03:12 GMT
server
Cloudfront
via
1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
etag
W/"21df7244385e5c0bdf32da01d0dad6c0"
age
125
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
cache-control
max-age=300, public
x-amz-cf-id
0vW_LLVuNBHHC43oQej9kEYTzhH-NZluQa2F-85BcNFTrP2yK2ogqw==
6
m.stripe.com/ Frame 5A34 		156 B
553 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.stripe.com/6
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.42.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.89.247.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-89-247-128.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
ca61e41cf0a8bf5eaa5f2abee263948d4430b7eb457d977ca2421d20825d45dd
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color
green
date
Fri, 10 Feb 2023 21:24:20 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
server
nginx
content-type
application/json;charset=utf-8
access-control-allow-origin
https://m.stripe.network
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
156

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| oncontentvisibilityautostatechange object| webpackJsonpcandy-shop-storefront object| regeneratorRuntime function| setImmediate function| clearImmediate object| _ethers function| MerkleTree object| litHtmlVersions function| JSCompiler_renameProperty object| litElementVersions string| __THREE__ object| webpackChunkStripeJSouter function| noop function| Stripe

3 Cookies

Domain/Path Name / Value
m.stripe.com/ Name: m
Value: 05d56e3a-ef63-45c5-b28c-4bc23989add0665159
.bakery.breadheads.dev/ Name: __stripe_mid
Value: e72b6dba-8a39-4e01-97c9-98066a01623b9a4798
.bakery.breadheads.dev/ Name: __stripe_sid
Value: 3f7c9b58-36bc-444e-9a23-c2dd07b7fa7f6a76f4

1 Console Messages

Source Level URL
Text
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bakery.breadheads.dev
candy-shop.liqnft.com
fonts.googleapis.com
fonts.gstatic.com
js.stripe.com
m.stripe.com
m.stripe.network
q.stripe.com
108.138.7.103
2600:9000:223e:2400:19:7d10:bd80:93a1
2a00:1450:4001:82a::2003
2a00:1450:4001:831::200a
52.22.239.239
52.89.247.128
54.187.159.182
76.76.21.241
032008af6445c1af4c70c92851d7a79382593e58193980bc917f00b82b60e0ed
048d136d592e66896cccc1fe4fada4feb16b7f6af671cd49a2fe6ed6b2276c6c
1e6e2516b73285bedf40e79a10f11286ad90e4e27ef3e9b3c7c4284ac4bc7750
1e6fc40f2b8a04555a31453ce59d26c03944d76fd1df33fe5c429fa7ebfdab44
250a0782da875705bd206ee23c2a46abf90656645a81e084126c5e8c53eeb9d6
5593211a585716c9a0b02918df9fd0441d31c4a8d312907d3cf6bad717120eb9
60ff87a3fb21305e4b4a735f0d20c55fc5aacead2c5c51a98b256c9f5083187a
640b3cc9452c009b72a173f44ce7e1828fb596ffe5b87532ce0f8e3745ec12d3
67d12d34f82ef700ec3a3795a77590252858c70330908a87ed1e73efc268cb4b
a309e0ee52eaf56489d5c35805e0d10dfd0cebc7d031f49708929ed9313b2df2
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
ca61e41cf0a8bf5eaa5f2abee263948d4430b7eb457d977ca2421d20825d45dd
d328321e950953b8fd5b95b86d70a44c99e6d0a3766542e04a93c5b9c1e9a3f1
d3633a48e63d4b24f74952995f16d2f6b1a95d20a6fa49111f6e24de9277afbc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e98df3a8bfa72c1af56ee9c6c30ed5353bbe8fb4121181032f5068eb2b552244
f22005da41e15b7adb453814b37a794f7c6b955f086a6c5fc9980e3c3f6c8bca
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083