pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/pmGbHfksgT Page URL
2. https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/indexjs.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	pmGbHfksgT t.co/	347 B 582 B	456ms 232ms	Document text/html	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/pmGbHfksgT Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control private,max-age=300 content-encoding gzip content-length 209 content-type text/html; charset=utf-8 date Sun, 28 Apr 2024 16:38:53 GMT expires Sun, 28 Apr 2024 16:43:53 GMT perf 7402827104 server tsa_o strict-transport-security max-age=0 vary Origin x-connection-hash 4e3806ef6fc40d0885015deaae604dbc8f499d224f8871f1b5553209cfc217be x-response-time 192 x-transaction-id ef22fea8499e9046 x-xss-protection 0
GET H/1.1	200 OK	Primary Request indexjs.html Show response pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/	587 B 896 B	322ms 191ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/indexjs.html Requested by Host: t.co URL: https://t.co/pmGbHfksgT Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dea6c2a6fef7519dc68f6b4478c10431f542692978d4b20b37866815763c4c0 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://t.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes CF-RAY 87b87c38abd78f39-FRA Connection keep-alive Content-Length 587 Content-Type text/html Date Sun, 28 Apr 2024 16:38:53 GMT ETag "66e1d7aa4180be2402e8051300a70b06" Last-Modified Fri, 26 Apr 2024 15:58:24 GMT Server cloudflare Vary Accept-Encoding
GET H2	200	jquery.js Show response dev-sqlmfia.pantheonsite.io/sqlamx/	284 KB 101 KB	273ms 171ms	Script application/x-javascript	2620:12a:8000::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://dev-sqlmfia.pantheonsite.io/sqlamx/jquery.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/indexjs.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:12a:8000::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f Security Headers Name Value Strict-Transport-Security max-age=300 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-pantheon-styx-hostname styx-fe3-a-b789bbb5d-tkvtv strict-transport-security max-age=300 content-encoding gzip via 1.1 varnish, 1.1 varnish date Sun, 28 Apr 2024 16:38:53 GMT age 0 x-cache MISS, MISS expires Sun, 28 Apr 2024 16:38:52 GMT x-served-by cache-chi-kigq8000175-CHI, cache-cph2320049-CPH last-modified Fri, 19 Jan 2024 14:10:23 GMT server nginx x-timer S1714322334.841987,VS0,VE133 etag W/"65aa82cf-47090" vary Accept-Encoding content-type application/x-javascript x-styx-req-id cceecd3f-057d-11ef-bf98-96e5eadd0195 cache-control no-cache, must-revalidate accept-ranges bytes x-robots-tag noindex x-cache-hits 0, 0
GET H2	200	basic.js Show response dev-sqlmfia.pantheonsite.io/sqlamx/	46 KB 13 KB	276ms 174ms	Script application/x-javascript	2620:12a:8000::3 FASTLY
General Check archive.org Show headers Download Go to Full URL https://dev-sqlmfia.pantheonsite.io/sqlamx/basic.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/indexjs.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:12a:8000::3 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 35cecbe10f376c07c1daf9aaaa9e1e45fea812afcea1349c06eb0d12dd91b22c Security Headers Name Value Strict-Transport-Security max-age=300 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-pantheon-styx-hostname styx-fe3-a-b789bbb5d-jcr8r strict-transport-security max-age=300 content-encoding gzip via 1.1 varnish, 1.1 varnish date Sun, 28 Apr 2024 16:38:53 GMT age 0 x-cache MISS, MISS expires Sun, 28 Apr 2024 16:38:52 GMT x-served-by cache-chi-klot8100087-CHI, cache-cph2320049-CPH last-modified Thu, 25 Apr 2024 22:39:54 GMT server nginx x-timer S1714322334.842014,VS0,VE136 etag W/"662adbba-b88b" vary Accept-Encoding content-type application/x-javascript x-styx-req-id ccef2b7f-057d-11ef-92be-ba9a5b6871bf cache-control no-cache, must-revalidate accept-ranges bytes x-robots-tag noindex x-cache-hits 0, 0
GET BLOB	200 OK	9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Show response https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/	34 KB 0		Document text/html
General Check archive.org Show headers Download Go to Full URL blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Requested by Host: dev-sqlmfia.pantheonsite.io URL: https://dev-sqlmfia.pantheonsite.io/sqlamx/basic.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 1ea2b71cc59aee10e3419a2999d54405aa281049ea24160262a424fbbcbc9ba9 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Content-Length 35002 Content-Type text/html
GET		favicon.ico pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/	0 0
GET H2	200	main.css themes-app.netlify.app/css/	8 KB 2 KB	429ms 40ms	Stylesheet text/css	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://themes-app.netlify.app/css/main.css Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 1c18890e44f53c9b0b4a22a56dff0b32e84b5fa38ec1721e6b580f9d26fd7820 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RS7Q8PF585G4C1MWWTD date Sun, 28 Apr 2024 16:38:54 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "ed0bb3e510be713fd48a9fc2f63bbd88-ssl-df" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1633
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	429ms 41ms	Script text/javascript	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 28 Apr 2024 12:15:38 GMT content-encoding gzip x-content-type-options nosniff age 15796 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 28 Apr 2025 12:15:38 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	424ms 36ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 28 Apr 2024 16:38:54 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 19521734 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-cph2320051-CPH last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1714322335.503481,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 88, 3248
GET H2	200	jquery-3.3.1.js Show response code.jquery.com/	265 KB 79 KB	426ms 38ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Origin https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 28 Apr 2024 16:38:54 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 19521682 x-cache HIT, HIT content-length 80268 x-served-by cache-lga21980-LGA, cache-cph2320038-CPH last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1714322335.503505,VS0,VE0 etag W/"28feccc0-42587" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 86, 309
GET H3	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	94ms 50ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Origin https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 28 Apr 2024 16:38:54 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 132151 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6157 last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2niqOV2zEgzH4jN%2BOTSsBl7BJBai5ah4fSo8Q4RWYQKnGWuW17J4UWVD1WnrKoPf6bIWgb%2B1ItVouX4p2H%2FmJYgTYQU3MqeNkHC5anbwF%2F3hEfrj6U9bwTDfett6d9BTd5Fmzi5x"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 87b87c3c8870085c-FRA expires Fri, 18 Apr 2025 16:38:54 GMT
GET H2	200	mt2.png themes-app.netlify.app/img/	2 KB 2 KB	426ms 38ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/mt2.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash d31c57f28cc14b6362f61488eb82a0d2e00f0fa5899765495e1ca871a4e3ea2d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RS7AEEQME2JQER0PAKZ date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "f09753fabf492a25caea39b9b940009f-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1877
GET H2	200	se.png themes-app.netlify.app/img/	693 B 780 B	427ms 39ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/se.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RS78BFSDDHHVSWYPBSK date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "9176a978951d62401855db0c8af6b10a-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 693
GET H2	200	dl.webp themes-app.netlify.app/img/	9 KB 9 KB	38ms 38ms	Image image/webp	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/dl.webp Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RTHT57YN6FAEVXWT587 date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "4594a4c4cf3d9fed4e9079a969112d3f-ssl" content-type image/webp cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 9270
GET H2	200	dw.png themes-app.netlify.app/img/	9 KB 9 KB	39ms 39ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/dw.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RTHK2WA800YPSFWQR5E date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "1981a80fee6538e9d22b16e31eb37c45-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 9050
GET H2	200	tn.gif themes-app.netlify.app/img/	12 KB 12 KB	39ms 39ms	Image image/gif	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/tn.gif Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW3FE799WDP4R0GR2JQ date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "32a2b0694ac3042ef45b9bbedffb44b4-ssl" content-type image/gif cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 11902
GET H2	200	fc.png themes-app.netlify.app/img/	644 B 731 B	38ms 38ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/fc.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW96SES0NYB9FZRQFSX date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "08fb724dc31151233c036f5bab9620e1-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 644
GET H2	200	tw.png themes-app.netlify.app/img/	1 KB 1 KB	39ms 38ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/tw.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW9R24XMKEHRV82MMJS date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "c9375c240809a8d92fcd735cb3b4582f-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1061
GET H2	200	in.png themes-app.netlify.app/img/	8 KB 8 KB	40ms 40ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/in.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW9M7N1ZVMJH083TRMN date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "888a13173b4fd95f54ae15e493c9e3ed-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 8284
GET H2	200	li.png themes-app.netlify.app/img/	764 B 850 B	40ms 40ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/li.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW9NAQ1P0N4H2HEFJHW date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "47c0afb5cbfb3f56c9b5210375261a2e-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 764
GET H2	200	yt.png themes-app.netlify.app/img/	984 B 1 KB	39ms 39ms	Image image/png	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://themes-app.netlify.app/img/yt.png Requested by Host: pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev URL: blob:https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/9bc5ae4f-a344-4f42-ba72-205dae48fbc1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RW9BKBBMBEQC0YY6YK2 date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 12120 cache-status "Netlify Edge"; hit etag "327974b57087925feede2ac36bf07c95-ssl" content-type image/png cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 984
GET H2	200	icon.ico themes-app.netlify.app/img/	1 KB 1 KB	146ms 146ms	Other image/vnd.microsoft.icon	2a05:d014:275:cb02::c8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://themes-app.netlify.app/img/icon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a05:d014:275:cb02::c8 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Netlify / Resource Hash 265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-nf-request-id 01HWJS5RXM711C6H7XH5WF7DY1 date Sun, 28 Apr 2024 16:38:54 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Netlify age 0 cache-status "Netlify Edge"; fwd=miss etag "dfa5d6a823418c0c47bffdcf2fc37c1c-ssl" content-type image/vnd.microsoft.icon cache-control public,max-age=0,must-revalidate accept-ranges bytes content-length 1358

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev

URL

https://pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev/favicon.ico

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Popper

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.t.co/	1970-01-21 05:42:16	Name: muc Value: 69a0db98-9b5e-44a6-b847-94c11f73d777

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
dev-sqlmfia.pantheonsite.io
pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev
t.co
themes-app.netlify.app
pub-970ca05b6be3436ba710a62c4da4c6fe.r2.dev

104.17.25.14
104.244.42.133
2606:4700::6812:223
2620:12a:8000::3
2a00:1450:4001:82f::200a
2a04:4e42:200::649
2a05:d014:275:cb02::c8
011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb
1c18890e44f53c9b0b4a22a56dff0b32e84b5fa38ec1721e6b580f9d26fd7820
1ea2b71cc59aee10e3419a2999d54405aa281049ea24160262a424fbbcbc9ba9
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0
35cecbe10f376c07c1daf9aaaa9e1e45fea812afcea1349c06eb0d12dd91b22c
3dea6c2a6fef7519dc68f6b4478c10431f542692978d4b20b37866815763c4c0
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542
d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0
d31c57f28cc14b6362f61488eb82a0d2e00f0fa5899765495e1ca871a4e3ea2d
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f