wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev Open in urlscan Pro
188.114.96.3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/	3 KB 1 KB	65ms 28ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6b59a55ffbac10b0a0d8382b76285ada1d0dfb57927e92f0de0a2d60668fe021 Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cf-ray 89eb20f27b294dba-FRA content-encoding br content-type text/html;charset=UTF-8 date Fri, 05 Jul 2024 23:27:57 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kFb5Q1svicD%2FdbJi3v37zsQY1q2ptG4KBpE0wLSM%2BCY83%2Fq8%2Bk3pMNKqh04AWD2r0J%2FakvTYVKNq3JPrggIXRvhNJl%2FOstH3LIA875D3F2NLKbJSfcvxipGYlRTC2wM%2BVT0GDiz46ZfbVOzwqpCS9vVoSsfZguYOWCgqFtUGxP2v7DQnKdUo17zQ2HeQ"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H/1.1	200	main.css c2.icoremail.net/coremail/common/assets/b8f77813/css/dist/	8 KB 3 KB	1206ms 237ms	Stylesheet text/css	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c2.icoremail.net/coremail/common/assets/b8f77813/css/dist/main.css Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash 33daad2c08423a71053ae992de5e89011eee7cf14def07c514cc3b229e4170e6 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:27:58 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 19:45:18 GMT Server nginx ETag W/"7776-1603914318000" Transfer-Encoding chunked X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type text/css Connection keep-alive X-Request-ID 196f32c1246b4ef694b9ae947275f582
GET H/1.1	200	iconfont.css c2.icoremail.net/coremail/common/assets/b8f77813/css/iconfont/	10 KB 2 KB	1328ms 279ms	Stylesheet text/css	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c2.icoremail.net/coremail/common/assets/b8f77813/css/iconfont/iconfont.css Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash 4043b312f5ef717f28cf42496850c3a9bc42854eba672f52e5c749e2b1427a29 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:27:59 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 19:45:18 GMT Server nginx ETag W/"10559-1603914318000" Transfer-Encoding chunked X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type text/css Connection keep-alive X-Request-ID 384b1f0422c141219aecd2570215d0dd
GET H/1.1	200	login.css c2.icoremail.net/coremail/common/assets/login/	7 KB 2 KB	2155ms 1182ms	Stylesheet text/css	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c2.icoremail.net/coremail/common/assets/login/login.css Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash 36b63a1415833670ffbd9164ca5c19c036d25035227ed981b5bedfeeddca779f Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:27:59 GMT Content-Encoding gzip Last-Modified Wed, 31 Aug 2022 00:10:34 GMT Server nginx ETag W/"7285-1661904634000" Transfer-Encoding chunked X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type text/css Connection keep-alive X-Request-ID 2694c4bfe91e426f80beb00c29d9a93e
GET H/1.1	200	loginCommon.b0127.js Show response c2.icoremail.net/coremail/bundle/	361 KB 137 KB	1879ms 550ms	Script application/javascript	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c2.icoremail.net/coremail/bundle/loginCommon.b0127.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash 99e9981b01a73c2b8789dbcb8cb28f25b187c28bcd3c14be59c241f39423a52c Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:27:59 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 19:44:42 GMT Server nginx ETag W/"369647-1603914282000" Transfer-Encoding chunked X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type application/javascript Connection keep-alive X-Request-ID 0f805dace3b148a5aa69ca0498b65f6f
GET H/1.1	200	login.b0127.js Show response c2.icoremail.net/coremail/bundle/	13 KB 6 KB	1452ms 245ms	Script application/javascript	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Full URL https://c2.icoremail.net/coremail/bundle/login.b0127.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash ae17f4c69900774806ac9fc72912abd30e51876ab0ce520b09fe0f8c924a0be6 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:27:59 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 19:44:42 GMT Server nginx ETag W/"13199-1603914282000" Transfer-Encoding chunked X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type application/javascript Connection keep-alive X-Request-ID 3c02ef8e3e5a4792bd14f4fdc5f6144f
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	434ms 41ms	Script application/javascript	151.101.194.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.137 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 05 Jul 2024 23:27:58 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1626649 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-mad22055-MAD last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1720222078.271006,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 45, 406939
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/	18 KB 7 KB	381ms 37ms	Script application/javascript	104.18.187.31 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/popper.min.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.187.31 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 05 Jul 2024 23:27:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 5398291 x-jsd-version 2.9.2 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 6649 x-served-by cache-fra-eddf8230074-FRA, cache-lga21976-LGA x-jsd-version-type version server cloudflare etag W/"48a2-jut79x6Kl4uCoaGYAV8U1z0upZI" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FEs9x%2Fq8b9KrTy4a%2Fc%2F5VdPKxb6RNjgSo9BcAyGCEI7w0RfLWs85a%2F9%2F3K04kYQwuxL6V4oCUhOSiZ0sJngb8XfmldfhHuiUA%2F84ca3CPmzOX5fUCIN4DjtDi3NM6MhHs6k%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin * cf-ray 89eb20f4dd356910-FRA
GET H3	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 16 KB	54ms 30ms	Script application/javascript	104.18.11.207 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 05 Jul 2024 23:27:57 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723 strict-transport-security max-age=31536000; includeSubDomains; preload age 9864410 cdn-cachedat 11/15/2021 23:30:00 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:06 GMT cdn-proxyver 1.0 cdn-requestpullcode 200 server cloudflare vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid a35b0179a28ed953258d0fb41376a09c timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 89eb20f2ddd20493-FRA cdn-requestpullsuccess True
GET H2	200	foot.js Show response cdn.jsdelivr.net/gh/ifeuko89/recordsflew@4be2a0f21ee9433c6d96e84daaa4c3756a99f1bd/	3 KB 2 KB	380ms 36ms	Script application/javascript	104.18.187.31 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/ifeuko89/recordsflew@4be2a0f21ee9433c6d96e84daaa4c3756a99f1bd/foot.js Requested by Host: wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.187.31 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cad5b9afb88074232e9f4d44acbba20611686fff903ff88fb77507264aa593a9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 05 Jul 2024 23:27:58 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 336399 x-jsd-version 4be2a0f21ee9433c6d96e84daaa4c3756a99f1bd x-cache MISS, MISS cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 1002 x-served-by cache-fra-etou8220060-FRA, cache-lga21949-LGA x-jsd-version-type commit server cloudflare etag W/"d3c-dhw93MFr+LL5RRY1JGBDGg7GCK8" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLRz5rf9d28q6IiNbfuEbWIw53DvlNIDci95PvTaGVKnuXIfG45qzY%2BNONSqkxknrNdoxQgX0lI%2F2Szw1ueFGxvNQWe24S7j%2BtWDitQbr6hZ5eJ4EO3msgUPHedb%2FMsmEmQ%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin * cf-ray 89eb20f4dd336910-FRA
GET H/1.1	200	login_bg.jpg c2.icoremail.net/coremail/common/assets/login/	1 KB 2 KB	276ms 275ms	Image image/jpeg	115.236.118.136 CT-HANGZHOU-IDC N...
General Check archive.org Show headers Download Go to Show image Full URL https://c2.icoremail.net/coremail/common/assets/login/login_bg.jpg Requested by Host: c2.icoremail.net URL: https://c2.icoremail.net/coremail/common/assets/login/login.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 115.236.118.136 , China, ASN58461 (CT-HANGZHOU-IDC No.288,Fu-chun Road, CN), Reverse DNS Software nginx / Resource Hash d93d0db7fec4942bb878f37e5078d880ed1df7e2455048518e0b111773750b24 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://c2.icoremail.net/coremail/common/assets/login/login.css Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Fri, 05 Jul 2024 23:28:00 GMT Last-Modified Wed, 31 Aug 2022 00:10:10 GMT Server nginx ETag W/"1231-1661904610000" X-Frame-Options SAMEORIGIN X-Protected-By OpenRASP Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 1231 X-Request-ID c2d55ff5e0ed4396935827dc96f5d2ed
GET H3	200	favicon.ico wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/	3 KB 1 KB	27ms 26ms	Other text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6b59a55ffbac10b0a0d8382b76285ada1d0dfb57927e92f0de0a2d60668fe021 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Fri, 05 Jul 2024 23:28:00 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NTPQiK2EwgiUQhFlrWA71EQ%2FtL8dU5DbIVea%2B9rufEtWdsg1C4XVO4FSVQtS%2BPVQLI1dq0EN8vttU%2FqXxLBXepkfelePCuAO8m%2Ba%2FyyaSJgTVJ2vhSWdh0tA0xLkE6hwkofcXFAvPXu7PmJQjppY3z4cm2CLCzzsSfjIg2pLz2XouA0J%2FmqFU6Xifptd"}],"group":"cf-nel","max_age":604800} content-type text/html;charset=UTF-8 cf-ray 89eb21040a954dba-FRA alt-svc h3=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage object| webpackJsonp function| $ function| jQuery object| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c2.icoremail.net
cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
wandering-forest-c1d0.7808985d1ea09d8228b0da16.workers.dev
104.18.11.207
104.18.187.31
115.236.118.136
151.101.194.137
188.114.96.3
33daad2c08423a71053ae992de5e89011eee7cf14def07c514cc3b229e4170e6
36b63a1415833670ffbd9164ca5c19c036d25035227ed981b5bedfeeddca779f
4043b312f5ef717f28cf42496850c3a9bc42854eba672f52e5c749e2b1427a29
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65
6b59a55ffbac10b0a0d8382b76285ada1d0dfb57927e92f0de0a2d60668fe021
99e9981b01a73c2b8789dbcb8cb28f25b187c28bcd3c14be59c241f39423a52c
ae17f4c69900774806ac9fc72912abd30e51876ab0ce520b09fe0f8c924a0be6
cad5b9afb88074232e9f4d44acbba20611686fff903ff88fb77507264aa593a9
d93d0db7fec4942bb878f37e5078d880ed1df7e2455048518e0b111773750b24
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e