URL: https://my.nativeforms.com/TdVQn1jZmUDMzRDTq1Db
Submission Tags: phishing
Submission: On May 01 via api from US — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 151.101.65.195, located in United States and belongs to FASTLY, US. The main domain is my.nativeforms.com.
TLS certificate: Issued by GTS CA 1D4 on March 13th 2023. Valid for: 3 months.
This is the only time my.nativeforms.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

This site contains links to these domains. Also see Links.

Domain
yahoo.com
nativeforms.com
Subject Issuer Validity Valid
focuswall.madebyayan.com
GTS CA 1D4
2023-03-13 -
2023-06-11
3 months crt.sh
misc.google.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh

This page contains 1 frames:

Primary Page: https://my.nativeforms.com/TdVQn1jZmUDMzRDTq1Db
Frame ID: 4F789690369D85692E831713DFE266BC
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

AT&T

Page Statistics

7
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

102 kB
Transfer

280 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request TdVQn1jZmUDMzRDTq1Db
my.nativeforms.com/
5 KB
934 B
Document
General
Full URL
https://my.nativeforms.com/TdVQn1jZmUDMzRDTq1Db
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a204613f857cc67ce16b2d6c6720c56393ce3dc4b95425dc4fd2810205208271
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=3600
content-encoding
br
content-length
585
content-type
text/html; charset=utf-8
date
Mon, 01 May 2023 20:43:12 GMT
etag
"ed16e6f3de11234484a25e25c8f20cfc08a205d82cbad8f1b7db062a08010d7f-br"
last-modified
Tue, 11 Apr 2023 14:37:47 GMT
strict-transport-security
max-age=31556926
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
x-cache-hits
0
x-served-by
cache-fra-eddf8230055-FRA
x-timer
S1682973792.229490,VS0,VE48
main.a70973fe.js
my.nativeforms.com/static/js/
229 KB
54 KB
Script
General
Full URL
https://my.nativeforms.com/static/js/main.a70973fe.js
Requested by
Host: my.nativeforms.com
URL: https://my.nativeforms.com/TdVQn1jZmUDMzRDTq1Db
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0a075cba90b77653da2dada68c38d8af4534ca6aa1e6733cd7cce04df4afe90c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.nativeforms.com/TdVQn1jZmUDMzRDTq1Db
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

x-served-by
cache-fra-eddf8230055-FRA
strict-transport-security
max-age=31556926
content-encoding
br
date
Mon, 01 May 2023 20:43:12 GMT
last-modified
Tue, 11 Apr 2023 14:37:47 GMT
x-timer
S1682973792.289733,VS0,VE2
etag
"5bc9f585cbac3929414c946b0d227589fca77e09713bb453538053a387797b39-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=31536000
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
55381
x-cache-hits
1
opened
us-central1-nativeforms-prod.cloudfunctions.net/backend/form-inbox/
0
0
Preflight
General
Full URL
https://us-central1-nativeforms-prod.cloudfunctions.net/backend/form-inbox/opened
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-security-policy,content-type
Access-Control-Request-Method
POST
Origin
https://my.nativeforms.com
Sec-Fetch-Mode
cors
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

access-control-allow-headers
content-security-policy,content-type
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html
date
Mon, 01 May 2023 20:43:12 GMT
function-execution-id
ee2t4wrst6bx
server
Google Frontend
vary
Access-Control-Request-Headers
x-cloud-trace-context
6832210825209c0b9db32749b7bc4604
x-powered-by
Express
opened
us-central1-nativeforms-prod.cloudfunctions.net/backend/form-inbox/
1 KB
1 KB
Fetch
General
Full URL
https://us-central1-nativeforms-prod.cloudfunctions.net/backend/form-inbox/opened
Requested by
Host: my.nativeforms.com
URL: https://my.nativeforms.com/static/js/main.a70973fe.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
b646bc917fc3f9bee2650f4b13446d61bee46d506524319372aeb70f32dc9fa3

Request headers

Content-Security-Policy
connect-src 'self' https://us-central1-nativeforms-prod.cloudfunctions.net
Referer
https://my.nativeforms.com/
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type
application/json

Response headers

date
Mon, 01 May 2023 20:43:12 GMT
server
Google Frontend
x-powered-by
Express
etag
W/"455-w4w5abTeLTLNBDOImEhfew7RKk4"
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
20a99a0b90da79afd620fcc918048fd4
function-execution-id
b48yv9bje8nq
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1109
logo%2FjL4s05%2FgAWS%2Flogo0aig2.png
firebasestorage.googleapis.com/v0/b/nativeforms-prod.appspot.com/o/
15 KB
16 KB
Image
General
Full URL
https://firebasestorage.googleapis.com/v0/b/nativeforms-prod.appspot.com/o/logo%2FjL4s05%2FgAWS%2Flogo0aig2.png?alt=media&token=fcbcbe1a-0ff2-41c1-a513-14a4f15e9014
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4810025716ab86ad55f5050df4c0c1ab531b63ea0ecfad1e1b041191dccf6bd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.nativeforms.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 01 May 2023 20:43:13 GMT
x-guploader-uploadid
ADPycdt16A3fezSbe3G_uUqYirL2oL6230yJpgDDAk42f9S_ljwmerW7PWfFVPGsoZ4I0LR3L8n7BYkek4unjIRmBLBAPw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-disposition
inline; filename*=utf-8''logo0aig2.png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15790
last-modified
Tue, 25 Apr 2023 22:20:22 GMT
server
UploadServer
etag
"c8ca022d820266fdbbf50b65ca2961bf"
x-goog-generation
1682461222730008
content-type
image/png
x-goog-hash
crc32c=fZL16Q==, md5=yMoCLYICZv279Qtlyilhvw==
cache-control
public,max-age=31536000
x-goog-stored-content-length
15790
x-goog-meta-firebasestoragedownloadtokens
fcbcbe1a-0ff2-41c1-a513-14a4f15e9014
accept-ranges
bytes
expires
Tue, 30 Apr 2024 20:43:13 GMT
1Ptvg83HX_SGhgqk3wotYKNnBQ.woff2
fonts.gstatic.com/s/mulish/v12/
27 KB
27 KB
Font
General
Full URL
https://fonts.gstatic.com/s/mulish/v12/1Ptvg83HX_SGhgqk3wotYKNnBQ.woff2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
577db921a554af3596942d3c48b5c91feaac8c767e183d518a8de8de86e5c7d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://my.nativeforms.com/
Origin
https://my.nativeforms.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Sat, 29 Apr 2023 17:11:55 GMT
x-content-type-options
nosniff
age
185477
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
27400
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 19:04:32 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 28 Apr 2024 17:11:55 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/
2 KB
3 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.nativeforms.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Sat, 29 Apr 2023 23:52:14 GMT
x-content-type-options
nosniff
age
161458
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Sat, 06 May 2023 23:52:14 GMT

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackJsonpnative-forms-core object| regeneratorRuntime object| React object| ReactDOM object| nf_form function| nf_set_form boolean| nf_incomplete_form_listener function| nf_form_change_page function| nf_form_set_page number| nf_form_current_page function| _nf_send_form

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926