f002.backblazeb2.com Open in urlscan Pro
206.190.215.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source
Effective URL:
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Submission: On October 13 via manual (October 13th 2021, 4:48:33 pm UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 13 domains to perform 18 HTTP transactions. The main IP is 206.190.215.16, located in and belongs to . The main domain is f002.backblazeb2.com.
TLS certificate: Issued by R3 on September 30th 2021. Valid for: 3 months.

This is the only time f002.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 3	37.10.71.204 37.10.71.204	212228 (SERVINGA-UK) (SERVINGA-UK)
1 3	66.235.200.113 66.235.200.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	149.154.167.220 149.154.167.220	62041 (TELEGRAM) (TELEGRAM)
1 1	13.226.155.34 13.226.155.34	16509 (AMAZON-02) (AMAZON-02)
1 1	5.181.218.64 5.181.218.64	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2	206.190.215.16 206.190.215.16	() ()
2	104.18.10.207 104.18.10.207	() ()
1	142.250.186.170 142.250.186.170	() ()
2	69.16.175.42 69.16.175.42	() ()
1	104.16.19.94 104.16.19.94	() ()
1	104.18.11.207 104.18.11.207	() ()
1	142.250.186.106 142.250.186.106	() ()
1	104.16.86.20 104.16.86.20	() ()
2	5.135.83.165 5.135.83.165	() ()
1	13.226.155.101 13.226.155.101	() ()
18	13

3 37.10.71.204 (Manchester, United Kingdom) 2 redirects

ASN212228 (SERVINGA-UK, DE)

gate.xn--k1ahm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 66.235.200.113 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)
PTR: host77.ipowerweb.com

irr.ykf.mybluehostin.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 149.154.167.220 (London, United Kingdom)

ASN62041 (TELEGRAM, VG)

api.telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.34 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-34.dus51.r.cloudfront.net

walmart.onelink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.181.218.64 (Germany) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

xn--80asucf0d.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 206.190.215.16 (None, )

ASN- ()

f002.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.10.207 (None, )

ASN- ()

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.170 (None, )

ASN- ()

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.16.175.42 (None, )

ASN- ()

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.19.94 (None, )

ASN- ()

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.11.207 (None, )

ASN- ()

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.106 (None, )

ASN- ()

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.86.20 (None, )

ASN- ()

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.135.83.165 (None, )

ASN- ()

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.101 (None, )

ASN- ()

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bootstrapcdn.com stackpath.bootstrapcdn.com maxcdn.bootstrapcdn.com	53 KB
3	mybluehostin.me 1 redirects irr.ykf.mybluehostin.me	17 KB
3	xn--k1ahm.com 2 redirects gate.xn--k1ahm.com	29 KB
2	postimg.cc i.postimg.cc	7 KB
2	jquery.com code.jquery.com	53 KB
2	googleapis.com fonts.googleapis.com ajax.googleapis.com	31 KB
2	backblazeb2.com f002.backblazeb2.com	135 KB
1	sendgrid.net cdn.mcauto-images-production.sendgrid.net	17 KB
1	jsdelivr.net cdn.jsdelivr.net	1 KB
1	cloudflare.com cdnjs.cloudflare.com	7 KB
1	xn--80asucf0d.com 1 redirects xn--80asucf0d.com	516 B
1	onelink.me 1 redirects walmart.onelink.me	302 B
1	telegram.org api.telegram.org	843 B
18	13

	Domain	Requested by
3	irr.ykf.mybluehostin.me	1 redirects gate.xn--k1ahm.com irr.ykf.mybluehostin.me
3	gate.xn--k1ahm.com	2 redirects
2	i.postimg.cc	f002.backblazeb2.com
2	code.jquery.com	f002.backblazeb2.com
2	stackpath.bootstrapcdn.com	f002.backblazeb2.com
2	f002.backblazeb2.com	gate.xn--k1ahm.com f002.backblazeb2.com
1	cdn.mcauto-images-production.sendgrid.net	f002.backblazeb2.com
1	cdn.jsdelivr.net	f002.backblazeb2.com
1	ajax.googleapis.com	f002.backblazeb2.com
1	maxcdn.bootstrapcdn.com	f002.backblazeb2.com
1	cdnjs.cloudflare.com	f002.backblazeb2.com
1	fonts.googleapis.com	f002.backblazeb2.com
1	xn--80asucf0d.com	1 redirects
1	walmart.onelink.me	1 redirects
1	api.telegram.org	gate.xn--k1ahm.com
18	15

This site contains no links.

Subject Issuer	Validity	Valid
xn--k1ahm.com R3	`2021-10-11` - `2022-01-09`	3 months	crt.sh
mail.irr.ykf.mybluehostin.me R3	`2021-08-27` - `2021-11-25`	3 months	crt.sh
api.telegram.org Go Daddy Secure Certificate Authority - G2	`2020-03-24` - `2022-05-23`	2 years	crt.sh
backblazeb2.com R3	`2021-09-30` - `2021-12-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
postimg.cc R3	`2021-09-30` - `2021-12-29`	3 months	crt.sh
cdn.mcauto-images-production.sendgrid.net Amazon	`2021-06-18` - `2022-07-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Frame ID: E93B5B31F113BDE8EE2C715CA3B28316
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 301
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source Page URL
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a%26pid%3Dmy_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source Page URL
https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Br... HTTP 302
https://xn--80asucf0d.com/11/?list HTTP 302
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout... Page URL

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

13
Domains

15
Subdomains

13
IPs

3
Countries

352 kB
Transfer

789 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 301
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source Page URL
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a%26pid%3Dmy_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source Page URL
https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Broom-Dustpan-Mini-Sweeper-Real-Working-broom-Mini-Sweeper-Clicks-Dustpan-Easy-Storage-True-Montesso/803538461&af_web_dp=https://xn--80asucf0d.com/11/?list HTTP 302
https://xn--80asucf0d.com/11/?list HTTP 302
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 301
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

Request Chain 1

https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a%26pid%3Dmy_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
gate.xn--k1ahm.com/
Redirect Chain

http://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source
https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

72 KB
29 KB

269ms
201ms

Document
text/html

37.10.71.204
SERVINGA-UK

General

Check archive.org

Show headers Download Go to

Full URL

https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.10.71.204 Manchester, United Kingdom, ASN212228 (SERVINGA-UK, DE),

Reverse DNS

Software

nginx/1.17.10 /

Resource Hash

4b7038edb4682aa26e1c4c41db05123d921006996a09d6d4e20239e6e929d562

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: gate.xn--k1ahm.com
:scheme: https
:path: /?shortlink=39726f4a%26pid=my_media_source
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx/1.17.10
date: Wed, 13 Oct 2021 16:48:27 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

Redirect headers

Server: nginx/1.17.10
Date: Wed, 13 Oct 2021 16:48:27 GMT
Content-Type: text/html
Content-Length: 170
Connection: keep-alive
Location: https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

GET
H2

200

/ Show response
irr.ykf.mybluehostin.me/a/
Redirect Chain

https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a%26pid%3Dmy_media_source
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source

59 B
161 B

489ms
489ms

Document
text/html

66.235.200.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source
Requested by: Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.235.200.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS: host77.ipowerweb.com
Software: cloudflare /
Resource Hash: c285af2747ea2eb548fc622eae01a1332eee6923e682ca026f7f88fc01308e64

Request headers

:method: GET
:authority: irr.ykf.mybluehostin.me
:scheme: https
:path: /a/?shortlink=39726f4a%26pid%3Dmy_media_source
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://gate.xn--k1ahm.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

Response headers

date: Wed, 13 Oct 2021 16:48:29 GMT
content-type: text/html
last-modified: Tue, 12 Oct 2021 22:20:29 GMT
cf-cache-status: MISS
expires: Wed, 13 Oct 2021 20:48:29 GMT
cache-control: public, max-age=14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 69da0e457906c4ae-DUS
content-encoding: gzip

Redirect headers

date: Wed, 13 Oct 2021 16:48:29 GMT
content-type: text/html; charset=iso-8859-1
location: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source
cf-cache-status: MISS
expires: Wed, 13 Oct 2021 20:48:29 GMT
cache-control: public, max-age=14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 69da0e4229eec4ae-DUS

GET
H2 200 encryptx.js Show response
irr.ykf.mybluehostin.me/a/ 51 KB
17 KB 21ms
21ms Script
application/javascript 66.235.200.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://irr.ykf.mybluehostin.me/a/encryptx.js
Requested by: Host: irr.ykf.mybluehostin.me
URL: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.235.200.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS: host77.ipowerweb.com
Software: cloudflare /
Resource Hash: 3058a8b81c3de4778a2d1fb90d0e1e38d9be7103e017590725a73bbe81c0abae

Request headers

:path: /a/encryptx.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: irr.ykf.mybluehostin.me
referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:48:29 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 12 Oct 2021 22:20:26 GMT
server: cloudflare
age: 4228
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 69da0e48af5bc4ae-DUS
expires: Wed, 13 Oct 2021 20:48:29 GMT

GET
H2 200 getUpdates
api.telegram.org/bot1979842486:AAF89aRlkOwL9ElYyRXZMbl7p7AZ33IKhhg/ 596 B
843 B 49ms
13ms Fetch
application/json 149.154.167.220
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://api.telegram.org/bot1979842486:AAF89aRlkOwL9ElYyRXZMbl7p7AZ33IKhhg/getUpdates?limit=1&offset=-1

Requested by

Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

149.154.167.220 London, United Kingdom, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:48:29 GMT
server: nginx/1.18.0
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection
content-length: 596

GET
H/1.1

200

Primary Request index.html Show response
f002.backblazeb2.com/file/2a080b/
Redirect Chain

https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Broom-Dustpan-Mini-Sweeper-Real-Working-broom-Mini-Sweeper-Clicks-Dustpan-Easy-Storage-True-Mont...
https://xn--80asucf0d.com/11/?list
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv

59 B
504 B

664ms
181ms

Document
text/html

206.190.215.16

General

Check archive.org

Show headers Download Go to

Full URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Requested by: Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a%26pid=my_media_source
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 206.190.215.16 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c285af2747ea2eb548fc622eae01a1332eee6923e682ca026f7f88fc01308e64

Request headers

Host: f002.backblazeb2.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://irr.ykf.mybluehostin.me/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a%26pid%3Dmy_media_source

Response headers

x-bz-file-name: index.html
x-bz-file-id: 4_zaf3a7cddbb3d72667ec30f15_f10805eaf0fa07062_d20211012_m225151_c002_v0001163_t0049
x-bz-content-sha1: c9438ca0aa85ce6649ab0e691e460b6a5262423b
X-Bz-Upload-Timestamp: 1634079111000
Accept-Ranges: bytes
x-bz-info-src_last_modified_millis: 1633769666000
Content-Type: text/html
Content-Length: 59
Date: Wed, 13 Oct 2021 16:48:31 GMT
Keep-Alive: timeout=5
Connection: keep-alive

Redirect headers

x-powered-by: PHP/7.4.11
set-cookie: PHPSESSID=21c315494be1abf5abee2ee93396ddf5; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
content-type: text/html; charset=UTF-8
content-length: 0
date: Wed, 13 Oct 2021 16:48:31 GMT
server: LiteSpeed
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

GET
H/1.1 200 encryptx.js Show response
f002.backblazeb2.com/file/2a080b/ 134 KB
135 KB 162ms
162ms Script
text/javascript 206.190.215.16

General

Check archive.org

Show headers Download Go to

Full URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 206.190.215.16 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04ea56df942498b0ed34fe30820c2be2a7b6491310afd06811ca59cdc315bff7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 13 Oct 2021 16:48:31 GMT
X-Bz-Upload-Timestamp: 1634079098000
x-bz-file-id: 4_zaf3a7cddbb3d72667ec30f15_f111bb5cd22440c4d_d20211012_m225138_c002_v0001163_t0056
x-bz-content-sha1: af8cca174507f677654e65a58183bc81c6089002
Content-Type: text/javascript
x-bz-file-name: encryptx.js
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 137536
x-bz-info-src_last_modified_millis: 1633990460958

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ 152 KB
25 KB 52ms
22ms Stylesheet
text/css 104.18.10.207

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 756
age: 4228
cdn-cachedat: 08/11/2021 05:41:31
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: f6d56da1892274cd80a11f70e6b5029d
cf-ray: 69da0e5d69df219f-DUS
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 1 KB
1 KB 86ms
30ms Stylesheet
text/css 142.250.186.170

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow&displ%61y=swap

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

48288119bd915b95e80f8e26134cd694637508c594524f58b28d8e462fe718c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 16:48:32 GMT
server: ESF
date: Wed, 13 Oct 2021 16:48:32 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Wed, 13 Oct 2021 16:48:32 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 48ms
18ms Script
application/javascript 69.16.175.42

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-10fdd"
vary: Accept-Encoding
x-hw: 1634143712.dop015.am5.t,1634143712.cds255.am5.hn,1634143712.cds255.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 44ms
16ms Script
application/javascript 104.16.19.94

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.19.94 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 516251
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6157
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yvc6is1%2Bc4PXg6cUrrkQhgSjvu5DxPsK2cc%2F78VzV%2Fcs%2BjzDMMf5SZtT%2BlB0gONbdcu9Xa%2ByYkg4iRuXBXyMVLaRR%2BiYbssZ4PFSCrg4g5j4mKx9E6DDNQjvHnNFnbXDG7qlWP84"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69da0e5d6bed21b1-DUS
expires: Mon, 03 Oct 2022 16:48:32 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 62ms
35ms Script
application/javascript 104.18.11.207

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.11.207 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 179067
cdn-cachedat: 08/04/2021 00:04:37
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 46c8b4b0557e7305f5b68fb4a07d1353
cf-ray: 69da0e5d68b8fafa-DUS
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 48ms
19ms Script
application/javascript 69.16.175.42

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 17:24:41 GMT
server: nginx
etag: W/"573f4859-14e4a"
vary: Accept-Encoding
x-hw: 1634143712.dop015.am5.t,1634143712.cds255.am5.hn,1634143712.cds147.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 74ms
21ms Script
text/javascript 142.250.186.106

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 10:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23745
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Thu, 13 Oct 2022 10:12:47 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 64ms
38ms Script
application/javascript 104.18.10.207

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617, 617
age: 15016168
cdn-cachedat: 2021-03-10 20:26:20
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 86736845de7e9d76de7d7f8002813b03
cf-ray: 69da0e5d68c0fafa-DUS
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 jquery.session.min.js Show response
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ 2 KB
1 KB 48ms
23ms Script
application/javascript 104.16.86.20

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.86.20 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2941311
x-jsd-version: 1.0.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19163-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 69da0e5d6c962181-DUS

GET
H2 200 arrow.png
i.postimg.cc/bvRb8Ssy/ 217 B
460 B 59ms
16ms Image
image/png 5.135.83.165

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/bvRb8Ssy/arrow.png
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.135.83.165 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 9e35e16ed2d132b80b321b118f62deb3c448d76f31c834b5eea969ff3885369a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
last-modified: Tue, 28 Sep 2021 05:57:23 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 217
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1920x1080.jpg
cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/ 17 KB
17 KB 59ms
11ms Image
binary/octet-stream 13.226.155.101

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/1920x1080.jpg
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.101 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: eHVz7ZLgeDWw84BSoa4oLZl1Bdh9eOS8
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
last-modified: Wed, 11 Nov 2020 19:33:28 GMT
server: AmazonS3
age: 1744
etag: "7916a894ebde7d29c2cc29b267f1299f"
x-cache: Hit from cloudfront
content-type: binary/octet-stream
date: Wed, 13 Oct 2021 16:27:33 GMT
x-amz-replication-status: COMPLETED
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
content-length: 17453
x-amz-cf-id: GinobRL9bT_KNnE_wMwVvKkksRIrE8Cq2PsvNSN8xGlS2VQfWu2A1Q==

GET
H2 200 white.jpg
i.postimg.cc/cCBPp8TS/ 6 KB
7 KB 17ms
16ms Image
image/jpeg 5.135.83.165

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/cCBPp8TS/white.jpg
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.135.83.165 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 36bdfa8963f1f6fb300e07c16253c4cf7b9bf69aca215dd532605a77c1a82483

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 16:48:32 GMT
last-modified: Wed, 19 May 2021 00:02:35 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 6545
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.xn--k1ahm.com/	1970-01-20 06:41:19	Name: __xlmZ Value: p3O3cLdiQYGGztQa5yv-Gw==
			xn--80asucf0d.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 21c315494be1abf5abee2ee93396ddf5

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	warning	URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv# Message: Mixed Content: The page at 'https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv#' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/1920x1080.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.telegram.org
cdn.jsdelivr.net
cdn.mcauto-images-production.sendgrid.net
cdnjs.cloudflare.com
code.jquery.com
f002.backblazeb2.com
fonts.googleapis.com
gate.xn--k1ahm.com
i.postimg.cc
irr.ykf.mybluehostin.me
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
walmart.onelink.me
xn--80asucf0d.com
104.16.19.94
104.16.86.20
104.18.10.207
104.18.11.207
13.226.155.101
13.226.155.34
142.250.186.106
142.250.186.170
149.154.167.220
206.190.215.16
37.10.71.204
5.135.83.165
5.181.218.64
66.235.200.113
69.16.175.42
04ea56df942498b0ed34fe30820c2be2a7b6491310afd06811ca59cdc315bff7
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
3058a8b81c3de4778a2d1fb90d0e1e38d9be7103e017590725a73bbe81c0abae
36bdfa8963f1f6fb300e07c16253c4cf7b9bf69aca215dd532605a77c1a82483
48288119bd915b95e80f8e26134cd694637508c594524f58b28d8e462fe718c2
4b7038edb4682aa26e1c4c41db05123d921006996a09d6d4e20239e6e929d562
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9e35e16ed2d132b80b321b118f62deb3c448d76f31c834b5eea969ff3885369a
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c285af2747ea2eb548fc622eae01a1332eee6923e682ca026f7f88fc01308e64
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

f002.backblazeb2.com Open in urlscan Pro 206.190.215.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

13 Domains

15 Subdomains

13 IPs

3 Countries

352 kBTransfer

789 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

15 Console Messages

Security Headers

Indicators

f002.backblazeb2.com Open in urlscan Pro
206.190.215.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

13
Domains

15
Subdomains

13
IPs

3
Countries

352 kB
Transfer

789 kB
Size

2
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!