pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Effective URL:
https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Submission: On February 03 via api (February 3rd 2024, 9:57:22 pm UTC) from US — Scanned from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 17 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev.
TLS certificate: Issued by E1 on December 9th 2023. Valid for: 3 months.

This is the only time pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7 17	2602:fea2:2::1 2602:fea2:2::1	40680 (PROTOCOL) (PROTOCOL)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.150.189.106 185.150.189.106	23470 (RELIABLESITE) (RELIABLESITE)
1	62.146.176.154 62.146.176.154	40021 (NL-811-40021) (NL-811-40021)
17	7

2 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2602:fea2:2::1 (United States) 7 redirects

ASN40680 (PROTOCOL, US)

dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.150.189.106 (Piscataway, United States)

ASN23470 (RELIABLESITE, US)

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.146.176.154 (Burgthann, Germany)

ASN40021 (NL-811-40021, US)
PTR: ip-154-176-146-62.ptr.fybeservers.com

us-central-1.fybeobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	dweb.link 7 redirects dweb.link — Cisco Umbrella Rank: 180240 bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link Failed bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link	120 KB
2	r2.dev pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev	38 KB
1	fybeobjects.com us-central-1.fybeobjects.com	4 KB
1	postimg.cc i.postimg.cc — Cisco Umbrella Rank: 18755	411 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	7 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 760	24 KB
17	6

	Domain	Requested by
8	dweb.link	7 redirects pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
2	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	us-central-1.fybeobjects.com	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	i.postimg.cc	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	cdnjs.cloudflare.com	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	code.jquery.com	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
1	bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link	pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
17	15

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2023-12-09` - `2024-03-08`	3 months	crt.sh
dweb.link R3	`2023-11-20` - `2024-02-18`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
postimg.cc R3	`2023-12-23` - `2024-03-22`	3 months	crt.sh
*.fybeobjects.com R3	`2024-01-03` - `2024-04-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Frame ID: 7BA2A5EE53CF7905BC476870083E5A09
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm HTTP 307
https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

SweetAlert (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

sweet(?:-)?alert(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

53 %
HTTPS

67 %
IPv6

6
Domains

15
Subdomains

7
IPs

2
Countries

599 kB
Transfer

987 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm HTTP 307
https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://dweb.link/ipfs/QmRJEENewudtFXP4Q6GzkWvKcm1WTMDrSca7QbGwSdrtMm?filename=bootstrap.css HTTP 301
https://bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link/?filename=bootstrap.css

Request Chain 1

https://dweb.link/ipfs/QmTgavUm1wZU5UMoUwb1to6zVgCo7nR7p7ic6H44RRPrX9?filename=font-awesome.css HTTP 301
https://bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link/?filename=font-awesome.css

Request Chain 2

https://dweb.link/ipfs/Qmf7y59RuutyHLhsgQXGDBWGohxMZPfeU4M6ZiVDSC7bma?filename=animate.css HTTP 301
https://bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link/?filename=animate.css

Request Chain 3

https://dweb.link/ipfs/QmRbr6GPmMaXViCSY6fErfB14WWdCMBESyRzTPdk6VvjDu?filename=jquery.js HTTP 301
https://bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link/?filename=jquery.js

Request Chain 4

https://dweb.link/ipfs/QmUiVYsNJuaBoCQ1hYeQE8uXVu6LwDSEBUuA3PxKe7zUFX?filename=popper.js HTTP 301
https://bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link/?filename=popper.js

Request Chain 6

https://dweb.link/ipfs/QmRnpMNJrtmXUfNwYvar6xWLQJxUs65hDtHZUHQfowNRCm?filename=sweetalert.js HTTP 301
https://bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link/?filename=sweetalert.js

Request Chain 8

https://dweb.link/ipfs/QmSgatZddgpVbC7qiSzcy7TRTe24FKvADHfP4psTqZthyP?filename=logo.jpg HTTP 301
https://bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link/?filename=logo.jpg

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index3.htm Show response
pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
Redirect Chain

http://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

38 KB
38 KB

248ms
151ms

Document
text/html

2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ff7e68ca2735e4e6a98b386debb83d16fe8656f9be09ec7b2429e0049ad7d12

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
CF-RAY: 84fdedbb0f277497-MIA
Connection: keep-alive
Content-Length: 38741
Content-Type: text/html
Date: Sat, 03 Feb 2024 21:57:16 GMT
ETag: "3950beb8f150463f09150057389da197"
Last-Modified: Fri, 02 Feb 2024 04:24:39 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Non-Authoritative-Reason: HSTS

GET
H2

200

/
bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmRJEENewudtFXP4Q6GzkWvKcm1WTMDrSca7QbGwSdrtMm?filename=bootstrap.css
https://bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link/?filename=bootstrap.css

141 KB
19 KB

169ms
141ms

Stylesheet
text/css

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link/?filename=bootstrap.css

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="bootstrap.css"; filename*=UTF-8''bootstrap.css
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona
etag: "bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link/?filename=bootstrap.css
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 141
x-proxy-cache: MISS

GET
H2

200

/
bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmTgavUm1wZU5UMoUwb1to6zVgCo7nR7p7ic6H44RRPrX9?filename=font-awesome.css
https://bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link/?filename=font-awesome.css

21 KB
6 KB

96ms
72ms

Stylesheet
text/css

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link/?filename=font-awesome.css

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="font-awesome.css"; filename*=UTF-8''font-awesome.css
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a
etag: "bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link/?filename=font-awesome.css
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 144
x-proxy-cache: MISS

GET
H2

200

/
bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/Qmf7y59RuutyHLhsgQXGDBWGohxMZPfeU4M6ZiVDSC7bma?filename=animate.css
https://bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link/?filename=animate.css

52 KB
5 KB

99ms
74ms

Stylesheet
text/css

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link/?filename=animate.css

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="animate.css"; filename*=UTF-8''animate.css
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee
etag: "bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link/?filename=animate.css
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 139
x-proxy-cache: MISS

GET
H2

200

/ Show response
bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmRbr6GPmMaXViCSY6fErfB14WWdCMBESyRzTPdk6VvjDu?filename=jquery.js
https://bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link/?filename=jquery.js

85 KB
30 KB

161ms
136ms

Script
text/javascript

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link/?filename=jquery.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="jquery.js"; filename*=UTF-8''jquery.js
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq
etag: "bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link/?filename=jquery.js
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 137
x-proxy-cache: MISS

GET
H2

200

/ Show response
bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmUiVYsNJuaBoCQ1hYeQE8uXVu6LwDSEBUuA3PxKe7zUFX?filename=popper.js
https://bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link/?filename=popper.js

19 KB
7 KB

159ms
135ms

Script
text/javascript

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link/?filename=popper.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="popper.js"; filename*=UTF-8''popper.js
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy
etag: "bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link/?filename=popper.js
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 137
x-proxy-cache: MISS

GET
H2 410 QmeheeqeAGN8QeMMXY2Pusp4gwJH99dKPqUCfsX6vwoRKQ
dweb.link/ipfs/ 0
0 206ms
66ms Script
text/html 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://dweb.link/ipfs/QmeheeqeAGN8QeMMXY2Pusp4gwJH99dKPqUCfsX6vwoRKQ?filename=bootstrap.js
Requested by: Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H2

200

/ Show response
bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmRnpMNJrtmXUfNwYvar6xWLQJxUs65hDtHZUHQfowNRCm?filename=sweetalert.js
https://bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link/?filename=sweetalert.js

40 KB
12 KB

100ms
83ms

Script
text/javascript

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link/?filename=sweetalert.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="sweetalert.js"; filename*=UTF-8''sweetalert.js
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi
etag: "bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link/?filename=sweetalert.js
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 141
x-proxy-cache: MISS

GET
H/1.1 404
Not Found webfont.js
pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index_files/ 0
0 103ms
102ms Script
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index_files/webfont.js
Requested by: Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sat, 03 Feb 2024 21:57:17 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 84fdedbee8c27497-MIA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

GET
H2

200

/
bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link/
Redirect Chain

https://dweb.link/ipfs/QmSgatZddgpVbC7qiSzcy7TRTe24FKvADHfP4psTqZthyP?filename=logo.jpg
https://bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link/?filename=logo.jpg

7 KB
7 KB

139ms
125ms

Image
image/jpeg

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link/?filename=logo.jpg

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

f8caf3207186e803510b7c02c6de2818abda8d0720f2764cb4e720a35a4d991e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="logo.jpg"; filename*=UTF-8''logo.jpg
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y
etag: "bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

Redirect headers

date: Sat, 03 Feb 2024 21:54:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/html; charset=utf-8
location: https://bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link/?filename=logo.jpg
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
content-length: 136
x-proxy-cache: MISS

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 120ms
39ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:57:16 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 12093636
x-cache: HIT, HIT
content-length: 23856
x-served-by: cache-lga21963-LGA, cache-mia-kmia1760086-MIA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1706997437.888525,VS0,VE0
etag: W/"28feccc0-10fdd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 13, 116924

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 136ms
61ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
Origin: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:57:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 96295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6157
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NI%2F%2BUfRDIgEFRW6hvEzQg7w64iOM4RzmYjFt%2BZf00bF8qRh8FqX2AhMZ6czzma%2BTEhLY2JI3teNh6kUlN0r8PgyZBoIv2UTRW2YrHQUBuubiaDl1n6KCQxiTo1Y1oSUqOc5Ln%2BNzE2ccIZuYO0wgQJYW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84fdedbd5a98749c-MIA
expires: Thu, 23 Jan 2025 21:57:17 GMT

GET /
bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/ 0
0

GET
H2 200 / Show response
bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link/ 84 KB
29 KB 115ms
82ms Script
text/javascript 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link/?filename=jquery.min.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

7496a1a9d658f14a47f7ee8dfa70840e47efa61b55b02cda8b316b0fc8dcc2c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:54:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-disposition: inline; filename="jquery.min.js"; filename*=UTF-8''jquery.min.js
x-ipfs-pop: rainbow
server: openresty
x-ipfs-lb-pop: gateway-bank1-dc13
x-ipfs-roots: bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu
etag: "bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
x-ipfs-path: /ipfs/bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu/
timing-allow-origin: *
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
x-proxy-cache: MISS

GET
H2 200 bg1.png
i.postimg.cc/v8q2YKDS/ 410 KB
411 KB 229ms
64ms Image
image/png 185.150.189.106
RELIABLESITE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/v8q2YKDS/bg1.png
Requested by: Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.150.189.106 Piscataway, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software: nginx /
Resource Hash: 3194d315e706c0723bf5469637ef9dda08784aa0c5e61319efbfea1bbc03cdc6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 21:57:17 GMT
last-modified: Sun, 15 Oct 2023 12:50:46 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 420039
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 410 /
bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/ 0
0 64ms
62ms Script
text/html 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/?filename=bootstrap.min.js
Requested by: Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

GET
H/1.1 200
OK jquery.js Show response
us-central-1.fybeobjects.com/155cb2119b6942fd92e3871a024662a8:wetrakpaty/ 4 KB
4 KB 511ms
84ms Script
text/javascript 62.146.176.154
NL-811-40021

General

Check archive.org

Show headers Download Go to

Full URL

https://us-central-1.fybeobjects.com/155cb2119b6942fd92e3871a024662a8:wetrakpaty/jquery.js

Requested by

Host: pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

62.146.176.154 Burgthann, Germany, ASN40021 (NL-811-40021, US),

Reverse DNS

ip-154-176-146-62.ptr.fybeservers.com

Software

nginx /

Resource Hash

dd1eaf84b07b595bee12db7448f7690006786109fa735ee36006d8481db3c8ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

ratelimit-reset: 1
date: Sat, 03 Feb 2024 21:57:17 GMT
strict-transport-security: max-age=16000000; includeSubDomains; preload;
x-ratelimit-limit-second: 250
x-amz-request-id: tx0000061cc6c9460a8cb56-0065beb604-406553-default
x-ratelimit-remaining-second: 249
ratelimit-limit: 250
content-length: 4005
last-modified: Fri, 02 Feb 2024 04:03:12 GMT
server: nginx
etag: "def3e8dc38d46ca0b266c71c07820ea6"
content-type: text/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
accept-ranges: bytes
ratelimit-remaining: 249
x-proxy-cache: HIT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link
URL: https://bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/?filename=bootstrap.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://dweb.link/ipfs/QmeheeqeAGN8QeMMXY2Pusp4gwJH99dKPqUCfsX6vwoRKQ?filename=bootstrap.js Message: Failed to load resource: the server responded with a status of 410 ()
javascript	error	URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm Message: Access to script at 'https://bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/?filename=bootstrap.min.js' from origin 'https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/?filename=bootstrap.min.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index_files/webfont.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link/?filename=bootstrap.min.js Message: Failed to load resource: the server responded with a status of 410 ()
javascript	warning	URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm(Line 133) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://us-central-1.fybeobjects.com/155cb2119b6942fd92e3871a024662a8:wetrakpaty/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev/index3.htm(Line 133) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://us-central-1.fybeobjects.com/155cb2119b6942fd92e3871a024662a8:wetrakpaty/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafybeibl6q4lz3so3hbhc2vbzxcpitws5yd3wcrkfewuerr3l5ohj4mona.ipfs.dweb.link
bafybeibqo6sij2nxln2lh3l4bhpufkriqsc6vtcni44smmcw2hskahjtxq.ipfs.dweb.link
bafybeibti4iinvd5b2p775563ygtudzqktihggrtnksbmphezza3hn4eoi.ipfs.dweb.link
bafybeic6x2fp4tittdgm62ih5upavzl5cd7mfqheybck3e262z3mwy4xpy.ipfs.dweb.link
bafybeicarifyatgz3sd2cfgucp3bo5bddjyou7vevbvy3bd5epwtmbyu3y.ipfs.dweb.link
bafybeicpmxcovgwlyxv4eqnea4eikta2zqxrymbkggdyjaredhcaatcc5a.ipfs.dweb.link
bafybeigeqhk7awdadjfe7mg764ts37prfajxfqry7gsdhb3ku47uwk2tiu.ipfs.dweb.link
bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link
bafybeihzk3r5vvkorkyw6yhdrq6ybyddsqbstgcv563nc4kooxaup7lqee.ipfs.dweb.link
cdnjs.cloudflare.com
code.jquery.com
dweb.link
i.postimg.cc
pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev
us-central-1.fybeobjects.com
bafybeihtdqp4mpo54jpiwxw4kaxtsv2eg7vfbtauaky25f4lelnwd542pm.ipfs.dweb.link
185.150.189.106
2602:fea2:2::1
2606:4700::6811:190e
2606:4700::6812:223
2a04:4e42::649
62.146.176.154
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
3194d315e706c0723bf5469637ef9dda08784aa0c5e61319efbfea1bbc03cdc6
7496a1a9d658f14a47f7ee8dfa70840e47efa61b55b02cda8b316b0fc8dcc2c5
7ff7e68ca2735e4e6a98b386debb83d16fe8656f9be09ec7b2429e0049ad7d12
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
dd1eaf84b07b595bee12db7448f7690006786109fa735ee36006d8481db3c8ca
f8caf3207186e803510b7c02c6de2818abda8d0720f2764cb4e720a35a4d991e

pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

53 %HTTPS

67 %IPv6

6 Domains

15 Subdomains

7 IPs

2 Countries

599 kBTransfer

987 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

7 Console Messages

Indicators

pub-4739c3fb82ad4d819b7b1d4bcfbb022e.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

53 %
HTTPS

67 %
IPv6

6
Domains

15
Subdomains

7
IPs

2
Countries

599 kB
Transfer

987 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!