urlscan.io logo urlscan.io
SecurityTrails logo

pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3...
Effective URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/de...
Submission: On December 15 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 10 domains to perform 9 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev.
TLS certificate: Issued by E1 on December 9th 2023. Valid for: 3 months.
This is the only time pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
1 1 54.237.174.142 14618 (AMAZON-AES)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:600... 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 198.200.139.195 32824 (WWT-ASN1)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
9 8
1    167.89.115.54 (Herndon, United States)

ASN11377 (SENDGRID, US)
PTR: o16789115x54.outbound-mail.sendgrid.net
u39913023.ct.sendgrid.net
1    54.237.174.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-174-142.compute-1.amazonaws.com
splendidedwin142413.lt.emlnk.com
2    2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    198.200.139.195 (Ballwin, United States)

ASN32824 (WWT-ASN1, US)
PTR: wwt.com
www.wwt.com
1    2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
t2.gstatic.com
Apex Domain
Subdomains		 Transfer
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 988
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2842
28 KB
2 r2.dev
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
125 KB
1 gstatic.com
t2.gstatic.com
962 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
285 B
1 wwt.com
www.wwt.com — Cisco Umbrella Rank: 296775
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 340
30 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 204
7 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 735
24 KB
1 emlnk.com
splendidedwin142413.lt.emlnk.com
298 B
1 sendgrid.net
u39913023.ct.sendgrid.net
827 B
9 10
Domain Requested by
2 pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 t2.gstatic.com
1 www.google.com 1 redirects
1 www.wwt.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 stackpath.bootstrapcdn.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 ajax.googleapis.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 maxcdn.bootstrapcdn.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 cdnjs.cloudflare.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 code.jquery.com pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
1 splendidedwin142413.lt.emlnk.com 1 redirects
1 u39913023.ct.sendgrid.net 1 redirects
9 11

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2023-12-09 -
2024-03-08		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
bootstrapcdn.com
GTS CA 1P5		 2023-11-30 -
2024-02-28		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
wwt.com
GeoTrust TLS RSA CA G1		 2023-05-24 -
2024-05-23		 a year crt.sh

This page contains 2 frames:

Primary Page: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Frame ID: FA90D581A99062FA5F4A0AA76FB7BEA3
Requests: 11 HTTP requests in this frame

Frame: https://www.wwt.com/
Frame ID: 8D680520827FBD3ADA065734603B71F5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Documents Portal Login - wwt.com

Page URL History Show full URLs

  1. https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUN... HTTP 302
    https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1... HTTP 302
    https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/ob... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

70 %
IPv6

10
Domains

11
Subdomains

8
IPs

2
Countries

215 kB
Transfer

558 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3zXzTFPBUN54hyR2TZyjeopdyDH7Tr1yIb4MhTOLOYs2uhmtplKWXgd5hK1Tj8fTlQuCIUnbvPO3RMRWDjA2rAsfZFOuHU-2FpURWaRM8AVPjxl0N7-2B4khXQgvxtudq9FyGrq55mEsjiX51r1PtQZ-2BbSu-2FxVqrovZWvkQkrfQk-2Frr-2FbzgcYpTTBnFHk8QZWd0BiFtW4gbDXAwPA4-2FrINws-2F6hVo0MSjAGNhwT1f-2FY-2B4wUPphO3-2Fp16W5uFaRRsNk634ksu2kffw6mYs-2BjkzzMww41tEh6kcpWsMNbnwDvpdV-2FaHbrv4ou5Rp2DKYAeAFsAEhc0WsNm27buQJPrW8nhphalIDOBF9ygTYSVc16-2FKyjf6P9bgSQbqkIRf6ez6H-2FDpV2n7JbHyXoJFJp0AnGcWRKeyUtta3TK-2BnRwZ2IkCHjMDdSgsnFn2s-2FlCU992SMfDc8aAibHrWYUljjuOMV7NSpm8wToRLkptAM5lWS6RYz7WNN2SQ-2BJ7-2FZSp9AoR8-2Fj-2B8c2RRvULzRc0CemDJ-2BafBXngm88-2FQXQgHWUP-2F1RupsPFOtMRK0LAEGzTq5L7UDWFbLXjXM8psEJQMqAPW-2F3UHym5Y0WieOEsljNabcMX3oeOHRTVjxfQAilvgXqYXrfVmOFR-2BToZ64Mnm9OaimhAfr3ncj5v15QR0dPntPoY90QzlD3T8J1LjoTOl1HDPPnmrmrs5p9-2BdVDZKAfejW-2FHekX-2ByZJI38FPhSu850nGL8B10bCjraHlieoEbejWYiG5LIM3g-3D-3Dh8xO_bizJ3rQjIh9-2F40eorGOn5dPv9T0F4BBuGLsmY2vDG6-2FmAV8GqMMHXOBBZ38MfxCRtf87OXdp4I2m-2Fhxe9zWbN9-2F6H70Ykw8E8liKt1nOwppI0-2Ff9TUMDqgGzQ8jnWv1ipk7y5G5jGkedbStDETVOQKBCXSz67w0aF51gc2Hhj6pu8YyEWSdya0wvbF2HTzbWQUCavP9J5N722GsZMJ4V2rP96q7iXss3y6CJh3yqpQtvCWiutUiMHOBMb2Gf-2F-2FhoV7oHU0KEVGodpjYJ2J6MVkGMUFPi-2BAcQn1hYy2HKWkq1LpYkVpFPhm31FqR8VH5FKzSRA-2BjVMvctkRqIy064K3F1TI8UHy2om9QeQ5mEGbKDGpDPEHOarzs8S5qS8ebDxkKugTjk7lziYNpJ6x5NJT2-2Bq0M-2BgtLx1GoEapZJrh-2B342ytL6Ges0cjc2zLMUEU6bnn2uFGCoCfk81bZe0wEzr8Pt4ypm797wKmk0t7I-2FkXot-2F4xcPwiVKThGqpKa3e2lv-2Fx8swIaNl-2Bec5BREVtSpLQdk58-2Bls-2BlX0reIy4O17FmU-2Bkctkaf-2F12kxV6KJ6-2Bwg3T9DYUK5iIAqMmk0lcfxLQelPz3TTwh-2FGzvkMRm7VbvgQxWlYUZPJfPPc74tMsF8Ofk9jTBLSaVW9OFChbX3-2BGSzFnTerpY1zgvMvXHMTHVKlNPYDaDU6fcFOZQLLndeSsTtI1S3fzQkbiBuCyzL3K-2BzKtDOfTzdOggoPb9vnmPIkbtbnbB1eUGZ4AL44iXl05rohW8Ck7SqpVms5PVJvWpy0C25bkb7NMkVNgIGy96L8aEMgOfUYBk9NBb4LQsahg-2B3eKHgVe4BFoT5L-2BsAUgaVV1Ruzw3hq2k8KySR2BFcLSi1j7PD6vdaMwfX0cc9BntnHwY-2FnOFjxzWwO9PkYRuRglub2pBxzRW4G-2F-2BeRCsBo1p7C5xcHb4LVoL5Y HTTP 302
    https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1MmQyNDNiYWE2YjhlNTFmYmExZDgzZTUucjIuZGV2JTJGd2VibG9jay5odG0lM0YxOGM5ZGQzODlkOTc0NzkyNzJkYjkzNzk3Mzg1NzhhYiUyRnIyJTJGZGVmYXVsdCUyRmJ1Y2tldHMlMkZzc2tza3Nza3MlMkZvYmplY3RzJTJGd2VibG9jay5odG0lMkZkZXRhaWxz&sig=88B7MAw5ihn6A8yH8d54FKqx4VcRuMrNxyHCE7HdQEFp&iat=1702564065&a=%7C%7C226617553%7C%7C&account=splendidedwin142413%2Eactivehosted%2Ecom&email=7HwisZpC21uH0perTY1y8afxtssM%2FN8LSGrNnYNAtmsN%2BTPaUPPOHg%3D%3D%3AOvBzphT7JYDGhWPVOwJMIiBxwZ8B59IW&s=3834941fbb829496edc41ec58674ea4f&i=1A3A0A9 HTTP 302
    https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://www.google.com/s2/favicons?domain=wwt.com HTTP 301
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://wwt.com&size=16

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request weblock.htm
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Redirect Chain
  • https://u39913023.ct.sendgrid.net/ls/click?upn=-2FpF1fwICjmg4r0v2ztM4auDfwA5tsebjRThgJ36P8TFLDVgDs3hVRYiuOpSUNOZkzjqRg3o1JYH0XeUW3zXzTFPBUN54hyR2TZyjeopdyDH7Tr1yIb4MhTOLOYs2uhmtplKWXgd5hK1Tj8fTlQuC...
  • https://splendidedwin142413.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItMTRjZGM5NmQ1MmQyNDNiYWE2YjhlNTFmYmExZDgzZTUucjIuZGV2JTJGd2VibG9jay5odG0lM0YxOGM5ZGQzODlkOTc0...
  • https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
207 KB
99 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
028a72d5208d928c85b3b43e7dbeddb309497a7b00f578919837f52bf5d426b7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-RAY
835f945d3df837e4-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Fri, 15 Dec 2023 15:04:31 GMT
ETag
W/"23e9b4e5564492f4d875a25da07c9e40"
Last-Modified
Thu, 14 Dec 2023 14:16:31 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

content-length
0
content-type
application/json
date
Fri, 15 Dec 2023 15:04:31 GMT
location
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
x-amz-apigw-id
P_Wn8EeYoAMEcsA=
x-amzn-requestid
8f4e3733-18a6-4404-8613-56b14613e4e6
x-amzn-trace-id
Root=1-657c6aff-0033e870141116e4214a1a54;Sampled=0;lineage=12ce62b2:0
favicons
pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/favicons
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Fri, 15 Dec 2023 15:04:31 GMT
Content-Encoding
gzip
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html
Connection
keep-alive
CF-RAY
835f945dff6137e4-FRA
truncated
/ 		55 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		558 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		520 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type
image/png
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 15 Dec 2023 15:04:31 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
7748871
x-cache
HIT, HIT
content-length
23856
x-served-by
cache-lga21963-LGA, cache-fra-eddf8230097-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1702652672.733570,VS0,VE0
etag
W/"28feccc0-10fdd"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
2, 69638
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 15 Dec 2023 15:04:31 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
3010773
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6157
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-4af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8wlUWpVHZgLNXOhffm%2BlHMQZIezu1jmTggUv2h8CbCjOnVQwR%2FeeVbf0d%2F3W9l%2FRZgE3Z%2FeLqkPqoxRbBQrYo1b0yE%2FT4y7%2BUgu0vS1%2Bh6mXsQsKOeYOXB9LAgSwxh%2BBeTBoIPn1RAkZnNlqAIH3dksB"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
835f945e5f039223-FRA
expires
Wed, 04 Dec 2024 15:04:31 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Origin
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 15 Dec 2023 15:04:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
865
age
87469
cdn-cachedat
10/31/2023 18:55:57
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
380c1d6f7eb227178a5b3ba2c1409c1c
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
835f945e5f883624-FRA
cdn-requestpullsuccess
True
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 15 Dec 2023 04:12:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
39126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 14 Dec 2024 04:12:25 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 15 Dec 2023 15:04:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
723
age
3120596
cdn-cachedat
11/15/2021 23:30:00
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
a35b0179a28ed953258d0fb41376a09c
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
835f945e5d06bbb0-FRA
cdn-requestpullsuccess
True
/
www.wwt.com/ Frame 8D68 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wwt.com/
Requested by
Host: pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev
URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.200.139.195 Ballwin, United States, ASN32824 (WWT-ASN1, US),
Reverse DNS
wwt.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
none
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Fri, 15 Dec 2023 15:04:33 GMT
Etag
"a1b16-xRCgogevY/ywoDjTMRauCGJpfcA"
Server-Timing
total;dur=709;desc="Nuxt Server Time"
Strict-Transport-Security
max-age=15552000; includeSubDomains
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Dns-Prefetch-Control
off
X-Download-Options
noopen
X-Frame-Options
SAMEORIGIN
X-Permitted-Cross-Domain-Policies
none
X-Vcap-Request-Id
a97d9ce3-c5e9-47c1-6cbb-ed6118e069c3
X-Xss-Protection
1; mode=block
faviconV2
t2.gstatic.com/
Redirect Chain
  • https://www.google.com/s2/favicons?domain=wwt.com
  • https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://wwt.com&size=16
425 B
962 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://wwt.com&size=16
Protocol
H2
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
145362992e62b2a80e8d0f8bf4243201807b6f0b041e342327edaa9435853f9f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Fri, 15 Dec 2023 15:04:31 GMT
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
425
x-xss-protection
0
last-modified
Thu, 05 Aug 2021 22:15:24 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="media-favicon"
report-to
{"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-location
https://www.wwt.com/favicon-16x16.png
expires
Fri, 22 Dec 2023 15:04:31 GMT

Redirect headers

date
Fri, 15 Dec 2023 15:04:31 GMT
x-content-type-options
nosniff
server
sffe
content-type
text/html; charset=UTF-8
location
https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://wwt.com&size=16
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
327
x-xss-protection
0
expires
Fri, 15 Dec 2023 15:34:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery object| _0x29a3 function| _0x40b2 function| _0x2e20a0 string| hash number| n function| goNow function| _0x2861f7 function| _0x5b22 function| _0x7c5c function| Popper object| bootstrap

0 Cookies

8 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/weblock.htm?18c9dd389d97479272db9379738578ab/r2/default/buckets/sskskssks/objects/weblock.htm/details(Line 106)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://pub-14cdc96d52d243baa6b8e51fba1d83e5.r2.dev/images/favicons
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://www.wwt.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.