production.calm-limit-671e.ralph2481.workers.dev Open in urlscan Pro
2606:4700:3035::6815:502c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response production.calm-limit-671e.ralph2481.workers.dev/	7 KB 3 KB	288ms 156ms	Document text/html	2606:4700:3035::6815:502c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://production.calm-limit-671e.ralph2481.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:502c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 05303d2d8e8578a239f9ba7016ff499b5ca264c31ea5f35da7de6f66f971818c Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language en-GB,en;q=0.9 Response headers date Mon, 06 Dec 2021 12:31:35 GMT content-type text/html; charset=utf-8 cf-ray 6b9588343bd7375d-MXP cache-control max-age=3600 last-modified Thu, 02 Dec 2021 04:46:39 GMT strict-transport-security max-age=31556926; includeSubDomains; preload vary x-fh-requested-host, accept-encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-cache HIT x-cache-hits 1 x-served-by cache-mxp6971-MXP x-timer S1638793895.169502,VS0,VE1 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UPtdrPi4h6TuMbbhOG2GwGi63o3sykGqDgERqIW41ju0AAeEpdLyy%2FVgYMNomiMsCDl0wd86eeydwTokQWxvvxkCGO7piIcEoqgZA3oIJx%2BhY2EGGP6TIzzcvXefH%2FkGfLuaKA1VqVoJUdYE7CIx5Em7qiuRDdJRK5gZFLKEv%2Fpq4BahnUrNYeVmt4QajdI%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	166ms 55ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: production.calm-limit-671e.ralph2481.workers.dev URL: https://production.calm-limit-671e.ralph2481.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers Accept-Language en-GB,en;q=0.9 Referer https://production.calm-limit-671e.ralph2481.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 06 Dec 2021 12:31:35 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-15283" vary Accept-Encoding x-hw 1638793895.dop029.ml1.t,1638793895.cds224.ml1.hn,1638793895.cds202.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	178ms 62ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: production.calm-limit-671e.ralph2481.workers.dev URL: https://production.calm-limit-671e.ralph2481.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language en-GB,en;q=0.9 Referer https://production.calm-limit-671e.ralph2481.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Mon, 06 Dec 2021 12:31:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723, 617, 617 age 9481515 cdn-cachedat 2021-07-24 10:52:10 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid c60073e21cbf9fb14834b984d87d67f4 cf-ray 6b9588363a2a5a19-MXP cdn-requestcountrycode EG cdn-status 200 cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
production.calm-limit-671e.ralph2481.workers.dev
stackpath.bootstrapcdn.com
2001:4de0:ac18::1:a:3b
2606:4700:3035::6815:502c
2606:4700::6812:bcf
05303d2d8e8578a239f9ba7016ff499b5ca264c31ea5f35da7de6f66f971818c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de