living.fiamir.com Open in urlscan Pro
2606:4700:3037::6815:2403  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Show response living.fiamir.com/post/guidance/	71 KB 13 KB	179ms 92ms	Document text/html	2606:4700:3037::6815:2403 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2403 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b64ba811583d4ae88f59b882bba9254430d074e11ee661344ac871e800f2ee7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 766a1a856f6d90d4-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 08 Nov 2022 00:13:34 GMT last-modified Tuesday, 08-Nov-2022 00:13:34 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=17XCSZTyuGNHECvTAgAtf7GtmC076b%2Fpt8SOWk0SlqsG37dhIEEDGxWwl4xSLskVRXAdoSCz0Al21wB5IsUzCnSUyYA3J8J0z5OMwUMuPAdZz7eHkZbAp4yHQfg8x7M%2B5gEv8D5lXfCJcRPmYUVI%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css www.gov.uk/assets/static/	201 KB 18 KB	160ms 39ms	Stylesheet text/css	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash c3d0744eedad16b9a5c1bc06a821fddd8a78e9f808fb58c4b3fc253250055164 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-cache-hits 10843 strict-transport-security max-age=31536000; preload content-encoding br via 1.1 varnish date Tue, 08 Nov 2022 00:13:35 GMT age 1502860 x-cache HIT content-length 17865 x-served-by cache-hhn4067-HHN last-modified Fri, 21 Oct 2022 14:45:29 GMT server nginx fastly-backend-name origin x-timer S1667866415.186155,VS0,VE0 etag "6352b089-3253a" vary Accept-Encoding, Accept-Encoding content-type text/css cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	application-69450ed4fc007ef22e313f1c73a1f02c3aba8f2eab45d754ce20b3c7eb538e4c.css www.gov.uk/assets/government-frontend/	219 KB 22 KB	175ms 55ms	Stylesheet text/css	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/government-frontend/application-69450ed4fc007ef22e313f1c73a1f02c3aba8f2eab45d754ce20b3c7eb538e4c.css Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b6eb84f9776380d9b2702d0e74567e2a3933af6814431b381f15cdf49c66e9d7 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-cache-hits 720 strict-transport-security max-age=31536000; preload content-encoding br via 1.1 varnish date Tue, 08 Nov 2022 00:13:35 GMT age 1469276 x-cache HIT content-length 22508 x-served-by cache-hhn4067-HHN last-modified Thu, 22 Sep 2022 14:44:09 GMT server nginx fastly-backend-name origin x-timer S1667866415.186462,VS0,VE0 etag "632c74b9-36a53" vary Accept-Encoding, Accept-Encoding content-type text/css cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	email-decode.min.js Show response living.fiamir.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	41ms 38ms	Script application/javascript	2606:4700:3037::6815:2403 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://living.fiamir.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2403 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 00:13:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 04 Nov 2022 12:48:09 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"63650a09-4d7" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gt4LHcdYOQjSxTGbeJqAF22ETDZHmAgQWpnrqxkzAxsoan9tsXs6KRkeor%2BRRuOr2xSCu19WbC4Yh0gsJF5eDYvG0jndI5FsblqmvaI5N9BJZl77qF1TLHPesWU%2B2kSjv%2B4y8Svbo9Aj2rE529inDQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-frame-options DENY cache-control max-age=172800, public cf-ray 766a1a86280390d4-FRA expires Thu, 10 Nov 2022 00:13:35 GMT
GET H2	200	jsnext.js Show response cloud.nextagc.com/	2 KB 2 KB	402ms 308ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cloud.nextagc.com/jsnext.js?uid=81&m=dash Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67772f782d65056c02d98ef488b631be28694330462ec9aceafb2765e9a34204 Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 00:13:35 GMT content-encoding br cf-cache-status BYPASS last-modified Tuesday, 08-Nov-2022 00:13:35 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding access-control-allow-methods POST,GET,OPTIONS content-type application/javascript;charset=utf-8 access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TM7BH8LIUyBrwVjBZBrSyUCJJQo4%2Boy%2FQZzMp%2FLK3tT3x8%2F1X1R%2BBo2KAe%2Bscn0aJZAVjxvjE5Mb5D48mw1kFK5OWDefxq0Lx2YFqg1NB8mWuszY39Oj2KwnTGcxdlLTslw3%2FZLxX8VDtKsOxjPhWQ%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control no-store, no-cache cf-ray 766a1a86bb26bb8c-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	print-e46a9d924a5eedb529468b565b8b5a1b308f218f19f0afc6998d0f295b24af48.css www.gov.uk/assets/static/	61 KB 7 KB	127ms 52ms	Stylesheet text/css	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/static/print-e46a9d924a5eedb529468b565b8b5a1b308f218f19f0afc6998d0f295b24af48.css Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 020ddc74c1b71f1330a60c199855b9268b16bc2660752105a97a0a45a07bba15 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-cache-hits 10034 strict-transport-security max-age=31536000; preload content-encoding br via 1.1 varnish date Tue, 08 Nov 2022 00:13:35 GMT age 1820023 x-cache HIT content-length 6629 x-served-by cache-hhn4067-HHN last-modified Wed, 12 Oct 2022 15:26:01 GMT server nginx fastly-backend-name origin x-timer S1667866415.186446,VS0,VE0 etag "6346dc89-f3d9" vary Accept-Encoding, Accept-Encoding content-type text/css cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	print-bcb988c58a27d6eb2bbce8bdaa46a916550927b9715bd8bf8b69a36c3716d40f.css www.gov.uk/assets/government-frontend/	72 KB 8 KB	123ms 48ms	Stylesheet text/css	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/government-frontend/print-bcb988c58a27d6eb2bbce8bdaa46a916550927b9715bd8bf8b69a36c3716d40f.css Requested by Host: living.fiamir.com URL: https://living.fiamir.com/post/guidance/how-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b477e5c3052eb2e85dc28d5e020ce7d7c7bbb9b8709a63e36ffba60199875571 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-cache-hits 704 strict-transport-security max-age=31536000; preload content-encoding br via 1.1 varnish date Tue, 08 Nov 2022 00:13:35 GMT age 596934 x-cache HIT content-length 8145 x-served-by cache-hhn4067-HHN last-modified Fri, 09 Sep 2022 11:27:48 GMT server nginx fastly-backend-name origin x-timer S1667866415.186406,VS0,VE0 etag "631b2334-12174" vary Accept-Encoding, Accept-Encoding content-type text/css cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET DATA	200 OK	truncated /	304 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cac87729911a75b3745a3bfbe3ce104b95c9aea895003d239db0434718c45eba Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	304 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4fcb2a72f43f4732c8e2fbce05ea8b6dd61a921aba38a0bb0d0d9120b8f20554 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	304 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2a1656a5fb683aad2cba8e66613c546d0b73b751a1aa4eee6677cb524228f81a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	304 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 20117f46414b4af3d8da60d1ae871bbcf55abfcb730cc353125cb2cf3bf9ab94 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	govuk-crest-87038e62e594b5f83ea40e0fb480fe7a5f41ba0db3917f709dfb39043f19a0f7.png www.gov.uk/assets/static/	4 KB 4 KB	41ms 40ms	Image image/png	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.gov.uk/assets/static/govuk-crest-87038e62e594b5f83ea40e0fb480fe7a5f41ba0db3917f709dfb39043f19a0f7.png Requested by Host: www.gov.uk URL: https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-cache-hits 395 strict-transport-security max-age=31536000; preload date Tue, 08 Nov 2022 00:13:35 GMT via 1.1 varnish age 1646550 x-cache HIT content-length 3584 x-served-by cache-hhn4067-HHN last-modified Mon, 04 Apr 2022 10:25:36 GMT server nginx fastly-backend-name origin x-timer S1667866415.288181,VS0,VE0 etag "624ac7a0-e00" content-type image/png cache-control max-age=315360000, public, immutable accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	light-94a07e06a1-v2-01565b0034e61d4609689bbb7ae0be844701f3812c8fe029fa1659b7ef3aa94f.woff2 www.gov.uk/assets/static/	33 KB 33 KB	127ms 41ms	Font font/woff2	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/static/light-94a07e06a1-v2-01565b0034e61d4609689bbb7ae0be844701f3812c8fe029fa1659b7ef3aa94f.woff2 Requested by Host: www.gov.uk URL: https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Origin https://living.fiamir.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers expires Thu, 31 Dec 2037 23:55:55 GMT strict-transport-security max-age=31536000; preload date Tue, 08 Nov 2022 00:13:35 GMT via 1.1 varnish age 1811574 x-cache HIT content-length 33382 x-served-by cache-hhn4068-HHN last-modified Mon, 04 Apr 2022 10:25:37 GMT server nginx fastly-backend-name origin x-timer S1667866415.374441,VS0,VE0 etag "624ac7a1-8266" access-control-allow-methods GET, OPTIONS content-type font/woff2 access-control-allow-origin * cache-control max-age=315360000 accept-ranges bytes access-control-allow-headers origin, authorization x-cache-hits 3776
GET H2	200	bold-b542beb274-v2-35bf540bb39615b6a517986f3aa83f7fefa1efd1878603eeeb196488078542d1.woff2 www.gov.uk/assets/static/	31 KB 31 KB	128ms 42ms	Font font/woff2	2a04:4e42:200::144 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.gov.uk/assets/static/bold-b542beb274-v2-35bf540bb39615b6a517986f3aa83f7fefa1efd1878603eeeb196488078542d1.woff2 Requested by Host: www.gov.uk URL: https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::144 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers Referer https://www.gov.uk/assets/static/application-3434686a3ec58a0977b779a183a52570890df607fcea7e0f16dcfb23cdf6c9d5.css Origin https://living.fiamir.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers expires Thu, 31 Dec 2037 23:55:55 GMT strict-transport-security max-age=31536000; preload date Tue, 08 Nov 2022 00:13:35 GMT via 1.1 varnish age 9666061 x-cache HIT content-length 31480 x-served-by cache-hhn4068-HHN last-modified Mon, 04 Apr 2022 10:25:37 GMT server nginx fastly-backend-name origin x-timer S1667866415.374560,VS0,VE0 etag "624ac7a1-7af8" access-control-allow-methods GET, OPTIONS content-type font/woff2 access-control-allow-origin * cache-control max-age=315360000 accept-ranges bytes access-control-allow-headers origin, authorization x-cache-hits 3763
GET H/1.1	403 Forbidden	invoke.js drawingwheels.com/82d4b0f6495aa90a07471062d1163f87/	0 0	822ms 132ms	Script application/javascript	192.243.59.13 ADVANCEDHOSTERS-AS
General Check archive.org Show headers Download Go to Full URL https://drawingwheels.com/82d4b0f6495aa90a07471062d1163f87/invoke.js Requested by Host: cloud.nextagc.com URL: https://cloud.nextagc.com/jsnext.js?uid=81&m=dash Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.13 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL), Reverse DNS Software nginx/1.17.6 / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 00:13:36 GMT Server nginx/1.17.6 Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin * Content-Type application/javascript Connection keep-alive Content-Length 0
GET H2	200	js15_as.js Show response s10.histats.com/	11 KB 5 KB	132ms 40ms	Script application/javascript	46.105.201.240 OVH
General Check archive.org Show headers Download Go to Full URL https://s10.histats.com/js15_as.js Requested by Host: cloud.nextagc.com URL: https://cloud.nextagc.com/jsnext.js?uid=81&m=dash Protocol H2 Security TLS 1.3, , AES_256_GCM Server 46.105.201.240 , France, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 00:09:15 GMT content-encoding br last-modified Thu, 16 Apr 2020 10:44:16 GMT x-cacheable Matched cache x-cdn-pop-ip 137.74.120.0/27 etag "-375139978" content-type application/javascript; charset=UTF-8 x-cdn-pop sbg accept-ranges bytes content-length 4364 x-request-id 754385103
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	50 B 184 B	375ms 122ms	Script text/html	192.99.0.58 OVH
General Check archive.org Show headers Download Go to Full URL https://s4.histats.com/stats/0.php?4710651&@f16&@g1&@h1&@i1&@j1667866415590&@k0&@l1&@mOne%20of%20the%20best%20theme%20park%20Halloween%20events%20is%20at%20Six%20Flags%2C%20USA%20Today%20says%20%F0%9F%99%81%F0%9F%A4%95%F0%9F%98%A1%20How%20to%20set%20up%20an%20account%20to%20defer%20duty%20payments%20when%20you%20import%20goods%20-%20GOV.UK&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-118154261&@b3:1667866416&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fliving.fiamir.com%2Fpost%2Fguidance%2Fhow-to-set-up-an-account-to-defer-duty-payments-when-you-import-goods&@w Requested by Host: s10.histats.com URL: https://s10.histats.com/js15_as.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.99.0.58 Gatineau, Canada, ASN16276 (OVH, FR), Reverse DNS ns500326.ip-192-99-0.net Software / Resource Hash 989ed27a4e8c7285fd67f7b419a6c647ee72fee687ac0179a420f4014e082b1b Request headers accept-language de-DE,de;q=0.9 Referer https://living.fiamir.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 00:13:35 GMT Connection close Content-Length 50 Content-Type text/html;charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| setInnerHTML function| inject object| _Hasync object| atOptions function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstCfa4710651 Value: 1667866415590
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstCla4710651 Value: 1667866415590
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstCmu4710651 Value: 1667866415590
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstPn4710651 Value: 1
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstPt4710651 Value: 1
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstCnv4710651 Value: 1
			living.fiamir.com/	1970-01-20 16:03:22	Name: HstCns4710651 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://drawingwheels.com/82d4b0f6495aa90a07471062d1163f87/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.nextagc.com
drawingwheels.com
living.fiamir.com
s10.histats.com
s4.histats.com
www.gov.uk
192.243.59.13
192.99.0.58
2606:4700:3037::6815:2403
2a04:4e42:200::144
2a06:98c1:3121::3
46.105.201.240
020ddc74c1b71f1330a60c199855b9268b16bc2660752105a97a0a45a07bba15
06eba01b1af0f4014b484c711771fef1db30becbf0edf481498da1e4958d3d47
20117f46414b4af3d8da60d1ae871bbcf55abfcb730cc353125cb2cf3bf9ab94
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2a1656a5fb683aad2cba8e66613c546d0b73b751a1aa4eee6677cb524228f81a
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
4fcb2a72f43f4732c8e2fbce05ea8b6dd61a921aba38a0bb0d0d9120b8f20554
67772f782d65056c02d98ef488b631be28694330462ec9aceafb2765e9a34204
7b64ba811583d4ae88f59b882bba9254430d074e11ee661344ac871e800f2ee7
989ed27a4e8c7285fd67f7b419a6c647ee72fee687ac0179a420f4014e082b1b
b477e5c3052eb2e85dc28d5e020ce7d7c7bbb9b8709a63e36ffba60199875571
b6eb84f9776380d9b2702d0e74567e2a3933af6814431b381f15cdf49c66e9d7
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c3d0744eedad16b9a5c1bc06a821fddd8a78e9f808fb58c4b3fc253250055164
cac87729911a75b3745a3bfbe3ce104b95c9aea895003d239db0434718c45eba
eedfb3c2f7945caebd0b15522b59d6c7f01be17fecd6102fd76452ad4042f7b0