bcdsa.eu-gb.cf.appdomain.cloud Open in urlscan Pro
158.176.79.200 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://snip.ly/ow1icr
Effective URL:
https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0...
Submission: On December 29 via manual (December 29th 2022, 12:35:02 pm UTC) from IN — Scanned from DE

Summary HTTP 25 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 9 domains to perform 25 HTTP transactions. The main IP is 158.176.79.200, located in United States and belongs to SOFTLAYER, US. The main domain is bcdsa.eu-gb.cf.appdomain.cloud.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on May 20th 2022. Valid for: a year.

This is the only time bcdsa.eu-gb.cf.appdomain.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:720	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	158.176.79.200 158.176.79.200	36351 (SOFTLAYER) (SOFTLAYER)
2	2606:4700:303... 2606:4700:3037::ac43:8c0b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
1	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
9	2a04:4e42::347 2a04:4e42::347	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
25	8

1 2606:4700:20::681a:720 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

snip.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.176.79.200 (United States)

ASN36351 (SOFTLAYER, US)
PTR: c8.4f.b09e.ip4.static.sl-reverse.com

bcdsa.eu-gb.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::ac43:8c0b (United States)

ASN13335 (CLOUDFLARENET, US)

onedrive_js_loader.rukkibospa5287.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-cloud-app-php-mysql.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a04:4e42::347 (United States)

ASN54113 (FASTLY, US)

cdn.statically.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	statically.io cdn.statically.io — Cisco Umbrella Rank: 12194	156 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 356	69 KB
3	gstatic.com fonts.gstatic.com	47 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 127	3 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 488	2 KB
2	workers.dev onedrive_js_loader.rukkibospa5287.workers.dev	106 KB
2	appdomain.cloud bcdsa.eu-gb.cf.appdomain.cloud	1 KB
1	cloudfunctions.net us-central1-cloud-app-php-mysql.cloudfunctions.net	364 B
1	snip.ly 1 redirects snip.ly — Cisco Umbrella Rank: 299916	536 B
25	9

	Domain	Requested by
9	cdn.statically.io	bcdsa.eu-gb.cf.appdomain.cloud cdn.statically.io
4	cdnjs.cloudflare.com	onedrive_js_loader.rukkibospa5287.workers.dev bcdsa.eu-gb.cf.appdomain.cloud
3	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	bcdsa.eu-gb.cf.appdomain.cloud
2	cdn.jsdelivr.net	onedrive_js_loader.rukkibospa5287.workers.dev
2	onedrive_js_loader.rukkibospa5287.workers.dev	bcdsa.eu-gb.cf.appdomain.cloud
2	bcdsa.eu-gb.cf.appdomain.cloud	bcdsa.eu-gb.cf.appdomain.cloud
1	us-central1-cloud-app-php-mysql.cloudfunctions.net	bcdsa.eu-gb.cf.appdomain.cloud
1	snip.ly	1 redirects
25	9

This site contains no links.

Subject Issuer	Validity	Valid
*.eu-gb.cf.appdomain.cloud DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2022-05-20` - `2023-05-19`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-23` - `2023-03-22`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh
misc.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
statically.io GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-11-22` - `2023-12-24`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199&auth=ODQ5MTk2MTk2NTA1MTc0MzAwMDB1bmRlZmluZWQ3D&token=217120409715895240000&edge=NjEwMjc0OTA2Mzk1NDg5NjAwMDAwdW5kZWZpbmVk5f0f6b66fe22fc
Frame ID: 39E6B1262928D3AA3E4C27AE4F029FC6
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft OneDrive

Page URL History Show full URLs

https://snip.ly/ow1icr HTTP 302
https://bcdsa.eu-gb.cf.appdomain.cloud/ Page URL
https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0M... Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

Statically (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-z]*?:?//cdn\.statically\.io/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

25
Requests

100 %
HTTPS

89 %
IPv6

9
Domains

9
Subdomains

8
IPs

2
Countries

385 kB
Transfer

979 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://snip.ly/ow1icr HTTP 302
https://bcdsa.eu-gb.cf.appdomain.cloud/ Page URL
https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199&auth=ODQ5MTk2MTk2NTA1MTc0MzAwMDB1bmRlZmluZWQ3D&token=217120409715895240000&edge=NjEwMjc0OTA2Mzk1NDg5NjAwMDAwdW5kZWZpbmVk5f0f6b66fe22fc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://snip.ly/ow1icr HTTP 302
https://bcdsa.eu-gb.cf.appdomain.cloud/

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
bcdsa.eu-gb.cf.appdomain.cloud/
Redirect Chain

https://snip.ly/ow1icr
https://bcdsa.eu-gb.cf.appdomain.cloud/

374 B
581 B

145ms
43ms

Document
text/html

158.176.79.200
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://bcdsa.eu-gb.cf.appdomain.cloud/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 158.176.79.200 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: c8.4f.b09e.ip4.static.sl-reverse.com
Software: Apache /
Resource Hash: f4aac2d29b4508fcd9e6f4e6c744a73259b9fb53e7a238dad190582d5f3e58d6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Dec 2022 12:34:55 GMT
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Backside-Transport: OK OK
X-Global-Transaction-ID: 7ef7cd5d63ad896ffa90f7b7

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 781292951d49bbad-FRA
content-type: text/html; charset=utf-8
date: Thu, 29 Dec 2022 12:34:55 GMT
location: https://bcdsa.eu-gb.cf.appdomain.cloud
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3YGXqUwnLKEw3xoJMg5ot8kgW0l0p6xzvBLfndU%2BeOLkRhu2Ri9OCLQtxzPu7n%2FMuKsS4dP0lOu8WHWUXX9Mr0qGHNtBoGVnm6Jx6aNABeCBlT%2FIIBrxOwlyFolUXX9nB2SLYpQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Cookie, Origin

GET
H2 200 / Show response
onedrive_js_loader.rukkibospa5287.workers.dev/ 202 KB
53 KB 746ms
704ms Script
text/javascript 2606:4700:3037::ac43:8c0b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/
Requested by: Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8c0b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf4392e4ed452f63657be49450def21e6b2b558ad21c97ba7e0ec7ba736d4abb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tS7LBWZwTjEZm6Rz98Wd6QW6almoOfnMTSyTvot7ZIvShrWmGSO36DszN9TVm%2Bdlp8W03kkiU%2BfRYP2Okz4NeaXyBcBjjppWQiSQ6BeGyhWeJoHnxz%2FsaRVEs87SXjQXHnMRJfDTOFm1nmUxMN4GnFtSfG%2BBkN4%2BMZMkqdSJGz1XzmPq31BkDzZ2uRU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 7812929b0d319c10-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: 0

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 51ms
19ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: onedrive_js_loader.rukkibospa5287.workers.dev
URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3770172
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Al2oKCXOZP%2Fw0W6neSaCX7WpJK8byEDEzXF0ACjs8ldzjpm1WceoS2HU3Blt6ocqYhvui60%2B8hhyQmp5Hcbg65V1peHbe66ZQdIDMK4ZSO%2F3y7HglwB7tRwoHWol%2BL%2FSWR8CQw4wMlJ0wYy41aTNSGOy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7812929fbbf590a9-FRA
expires: Tue, 19 Dec 2023 12:34:56 GMT

GET
H2 200 js.cookie.min.js Show response
cdn.jsdelivr.net/npm/js-cookie@3.0.1/dist/ 2 KB
1 KB 47ms
8ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/js-cookie@3.0.1/dist/js.cookie.min.js

Requested by

Host: onedrive_js_loader.rukkibospa5287.workers.dev
URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d07dcdbb3ddaba0dda7d56d496cbb5d8fbb1bdadc23f812126d3c4c6ab39e158

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 29 Dec 2022 12:34:56 GMT
x-content-type-options: nosniff
content-encoding: gzip
age: 3851824
x-jsd-version: 3.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 823
x-served-by: cache-fra-eddf8230062-FRA
x-jsd-version-type: version
etag: W/"691-nsW9ygnrEUkpEGcvy0hZTQTrY68"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 check-real Show response
us-central1-cloud-app-php-mysql.cloudfunctions.net/ 15 B
364 B 262ms
204ms Fetch
application/json 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-cloud-app-php-mysql.cloudfunctions.net/check-real
Requested by: Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 8c155b6abea40585acce93148ee6d45319136dc6dc417aa6a9c482cb7fb848fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: f3c9ce981316917d7e95867111512ff8;o=1
cache-control: private
function-execution-id: cu63kwy6mf8r
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41

GET
H2 200 css2
fonts.googleapis.com/ 21 KB
2 KB 70ms
30ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1288911bfaabb27f0a203e3c5b91a82de48cac928f9419926df2573c5f55acf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Dec 2022 12:28:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Dec 2022 12:34:56 GMT

GET
H2 200 st.css
cdn.statically.io/gh/jmresult/ond0ve/master/ 5 KB
2 KB 230ms
163ms Stylesheet
text/css 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

adc9b1a88e203bf8f8c3939a061a1c269e99438e0ef069839912c4b178fc8d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3454
x-cache: HIT, HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1361
x-served-by: cache-sjc10068-SJC, cache-fra-eddf8230047-FRA
server: statically
etag: W/"595589510703263592faf9f47a45138932141388dbfd116d081693c26b058316"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
timing-allow-origin: *

GET
H3 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
6 KB 31ms
19ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
Origin: https://bcdsa.eu-gb.cf.appdomain.cloud
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1190410
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5884
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-9226"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gSI8WzrKQhy5NoBD5OtrA0zspEQXjJqtEzcV%2BXUA3FhpNFyJFAjPihlr6fr4HV64xVz2%2FYfPICOI8vhSlHSs5d2F4eMpXTPGeTP4gqb0WUxc3uBEIeqXMrHAWDr4ITPJAnAI8GmqB6D1L3B7rhZmpOyT"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 781292a069f95c56-FRA
expires: Tue, 19 Dec 2023 12:34:56 GMT

GET
H2 200 aStyle.css
cdn.statically.io/gh/jmresult/ond0ve/master/ 36 KB
5 KB 234ms
168ms Stylesheet
text/css 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/aStyle.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

18b81f17e7c1cd5287c9cbadada5907de6a8e0fd92b52ae3c16ae58b672a0e6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3453
x-cache: HIT, MISS
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5278
x-served-by: cache-sjc10027-SJC, cache-fra-eddf8230047-FRA
server: statically
etag: W/"7d3abfe602fc66098e86afd31d89f0b305f41ff8fd5d353020decd0bf362f654"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
timing-allow-origin: *

GET
H2 200 OneDrive_logo_and_wordmark.svg
cdn.statically.io/gh/jmresult/ond0ve/master/ 10 KB
4 KB 76ms
14ms Image
image/svg+xml 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/OneDrive_logo_and_wordmark.svg

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

93cacbb2f74c55645024c9823873891b4633146a9f6f61c8be080d72924fd0b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 681559
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 4218
x-served-by: cache-fra-eddf8230047-FRA
server: statically
etag: W/"0492cda9ba8156bf5f2b3f1d1b7a779c09982cbccb7327f1a3c81bec0740479f"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *

GET
H3 200 b.jpg
cdn.statically.io/gh/jmresult/ond0ve/master/ 47 KB
47 KB 20ms
9ms Image
image/jpeg 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/b.jpg

Requested by

Host: cdn.statically.io
URL: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

5fe991e3985f36c957bc2a0b9a212052210b988b5536059e5fe8544a5104eb19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 681559
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 47917
x-served-by: cache-fra-eddf8230050-FRA
server: statically
etag: W/"52c33ed3e4b8bfdd9b4e142b7a6b0ed0296eea773369b6fa96dfdc40edeae4c8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *

GET
H/1.1 200
OK Primary Request / Show response
bcdsa.eu-gb.cf.appdomain.cloud/ 374 B
581 B 40ms
40ms Document
text/html 158.176.79.200
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199&auth=ODQ5MTk2MTk2NTA1MTc0MzAwMDB1bmRlZmluZWQ3D&token=217120409715895240000&edge=NjEwMjc0OTA2Mzk1NDg5NjAwMDAwdW5kZWZpbmVk5f0f6b66fe22fc
Requested by: Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 158.176.79.200 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: c8.4f.b09e.ip4.static.sl-reverse.com
Software: Apache /
Resource Hash: f4aac2d29b4508fcd9e6f4e6c744a73259b9fb53e7a238dad190582d5f3e58d6

Request headers

Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 29 Dec 2022 12:34:56 GMT
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Backside-Transport: OK OK
X-Global-Transaction-ID: 7ef7cd5d63ad89709cf0ed5d

GET
H3 200 / Show response
onedrive_js_loader.rukkibospa5287.workers.dev/ 202 KB
53 KB 188ms
172ms Script
text/javascript 2606:4700:3037::ac43:8c0b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/
Requested by: Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199&auth=ODQ5MTk2MTk2NTA1MTc0MzAwMDB1bmRlZmluZWQ3D&token=217120409715895240000&edge=NjEwMjc0OTA2Mzk1NDg5NjAwMDAwdW5kZWZpbmVk5f0f6b66fe22fc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:8c0b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a35eb0af8266e086db71038735955505cf6050a3242fd36177b6be15691c0c98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AaWK0tI%2B8gzm6z85HAopLynpKfcKc%2FFv%2FpyOr3V7IoFvTrAQ7nmSCllkLDfzdVQgrss%2FjqOeofWGyOY88nj7KeClMYiU2%2FwYN5l%2BNdU3Nm5kgrhXcR9w4QUZbnQT57sdpff7RUXaZCuwTWJJrBYE3kiHkObTFMKWDYxMjq99UZtiCpm56ugqJTsoPkI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 781292a26ae19b83-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: 0

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 25ms
15ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: onedrive_js_loader.rukkibospa5287.workers.dev
URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5310030
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nOsOvxXHyPiqKMIsjXsAySnu2MAvPjizhf0KBtx60olhGXdi%2BOU%2Bo11e7p6BbB2tm6Jxkp3G2By638lJvzU7k08vykl%2FLmlBUoRF5fOYaO5urRdGx%2BZj9xHCnmxyrO6hjR2HeFUEEMsV9kXmy2H7gS2M"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 781292a3af7fbb89-FRA
expires: Tue, 19 Dec 2023 12:34:57 GMT

GET
H3 200 js.cookie.min.js Show response
cdn.jsdelivr.net/npm/js-cookie@3.0.1/dist/ 2 KB
1 KB 18ms
8ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/js-cookie@3.0.1/dist/js.cookie.min.js

Requested by

Host: onedrive_js_loader.rukkibospa5287.workers.dev
URL: https://onedrive_js_loader.rukkibospa5287.workers.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d07dcdbb3ddaba0dda7d56d496cbb5d8fbb1bdadc23f812126d3c4c6ab39e158

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 29 Dec 2022 12:34:57 GMT
x-content-type-options: nosniff
content-encoding: gzip
age: 3851825
x-jsd-version: 3.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 823
x-served-by: cache-fra-eddf8230121-FRA
x-jsd-version-type: version
etag: W/"691-nsW9ygnrEUkpEGcvy0hZTQTrY68"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 css2
fonts.googleapis.com/ 21 KB
1 KB 59ms
25ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1288911bfaabb27f0a203e3c5b91a82de48cac928f9419926df2573c5f55acf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 29 Dec 2022 12:04:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 29 Dec 2022 12:34:57 GMT

GET
H3 200 st.css
cdn.statically.io/gh/jmresult/ond0ve/master/ 5 KB
2 KB 10ms
9ms Stylesheet
text/css 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

adc9b1a88e203bf8f8c3939a061a1c269e99438e0ef069839912c4b178fc8d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3454
x-cache: HIT, HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1361
x-served-by: cache-sjc10068-SJC, cache-fra-eddf8230050-FRA
server: statically
etag: W/"595589510703263592faf9f47a45138932141388dbfd116d081693c26b058316"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
timing-allow-origin: *

GET
H3 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
6 KB 24ms
23ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
Origin: https://bcdsa.eu-gb.cf.appdomain.cloud
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1190411
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5884
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-9226"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vrhbnqureYFGJa7eQZFyfYu6cOG0L5Ceb9bKcn47d1Ce0cMR%2BfolLNCABPF1PXqNrSxR%2B0kHbwIOUguR1l9aA%2BMOcTzDr7DtFn%2B8EiHlkCssjOvgY%2BU2Rh9h9Fo%2B3gYlOFBC9XelhxVV%2BBfi%2F5ABmg2q"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 781292a409365c56-FRA
expires: Tue, 19 Dec 2023 12:34:57 GMT

GET
H3 200 aStyle.css
cdn.statically.io/gh/jmresult/ond0ve/master/ 36 KB
5 KB 8ms
8ms Stylesheet
text/css 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/aStyle.css

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

18b81f17e7c1cd5287c9cbadada5907de6a8e0fd92b52ae3c16ae58b672a0e6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 3453
x-cache: HIT, HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5278
x-served-by: cache-sjc10027-SJC, cache-fra-eddf8230050-FRA
server: statically
etag: W/"7d3abfe602fc66098e86afd31d89f0b305f41ff8fd5d353020decd0bf362f654"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
timing-allow-origin: *

GET
H3 200 OneDrive_logo_and_wordmark.svg
cdn.statically.io/gh/jmresult/ond0ve/master/ 10 KB
4 KB 8ms
8ms Image
image/svg+xml 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/OneDrive_logo_and_wordmark.svg

Requested by

Host: bcdsa.eu-gb.cf.appdomain.cloud
URL: https://bcdsa.eu-gb.cf.appdomain.cloud/?5f0f6b66fe9250=%2FbWQ1OTAzMDM2NDU2MzAzNDEzMTA3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199%2Fc2hhMzg0NDA2NTM4NzYwNDg0MTI0Ng3D3D%2F3bb8ad9ab6389a0d07246d773b1c6d0ac6eaa630a1fa2efd7d00807d3b3aa199&auth=ODQ5MTk2MTk2NTA1MTc0MzAwMDB1bmRlZmluZWQ3D&token=217120409715895240000&edge=NjEwMjc0OTA2Mzk1NDg5NjAwMDAwdW5kZWZpbmVk5f0f6b66fe22fc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

93cacbb2f74c55645024c9823873891b4633146a9f6f61c8be080d72924fd0b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bcdsa.eu-gb.cf.appdomain.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 681560
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 4218
x-served-by: cache-fra-eddf8230050-FRA
server: statically
etag: W/"0492cda9ba8156bf5f2b3f1d1b7a779c09982cbccb7327f1a3c81bec0740479f"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *

GET
H3 200 b.jpg
cdn.statically.io/gh/jmresult/ond0ve/master/ 47 KB
47 KB 8ms
7ms Image
image/jpeg 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/b.jpg

Requested by

Host: cdn.statically.io
URL: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

5fe991e3985f36c957bc2a0b9a212052210b988b5536059e5fe8544a5104eb19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 681559
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 47917
x-served-by: cache-fra-eddf8230050-FRA
server: statically
etag: W/"52c33ed3e4b8bfdd9b4e142b7a6b0ed0296eea773369b6fa96dfdc40edeae4c8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 50ms
14ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bcdsa.eu-gb.cf.appdomain.cloud
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 22 Dec 2022 19:42:15 GMT
x-content-type-options: nosniff
age: 579162
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Dec 2023 19:42:15 GMT

GET
H3 200 out.png
cdn.statically.io/gh/jmresult/ond0ve/master/ 39 KB
39 KB 9ms
9ms Image
image/png 2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.statically.io/gh/jmresult/ond0ve/master/out.png

Requested by

Host: cdn.statically.io
URL: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a04:4e42::347 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

statically /

Resource Hash

ae9cc64390a76c779bd0da29fcff4dd063438985d6f9c331c3b984534dd5e6cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.statically.io/gh/jmresult/ond0ve/master/st.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 29 Dec 2022 12:34:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
age: 681560
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 39930
x-served-by: cache-fra-eddf8230050-FRA
server: statically
etag: W/"72b2f356930e39cdf854157353ac8b886c7416bce196723a7c6c4a743b2254ba"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 53ms
18ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bcdsa.eu-gb.cf.appdomain.cloud
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Sat, 24 Dec 2022 09:07:05 GMT
x-content-type-options: nosniff
age: 444472
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Dec 2023 09:07:05 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 63ms
29ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;1,100;1,300;1,400;1,500;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://bcdsa.eu-gb.cf.appdomain.cloud
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 26 Dec 2022 16:44:52 GMT
x-content-type-options: nosniff
age: 244205
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Dec 2023 16:44:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

61 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			snip.ly/	1970-01-20 10:41:33	Name: sessionid Value: s7va1shdtp4dftcfxzw5fm7cp02n2ebc

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bcdsa.eu-gb.cf.appdomain.cloud
cdn.jsdelivr.net
cdn.statically.io
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
onedrive_js_loader.rukkibospa5287.workers.dev
snip.ly
us-central1-cloud-app-php-mysql.cloudfunctions.net
158.176.79.200
2001:4860:4802:36::36
2606:4700:20::681a:720
2606:4700:3037::ac43:8c0b
2606:4700::6811:190e
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::200a
2a04:4e42:600::485
2a04:4e42::347
1288911bfaabb27f0a203e3c5b91a82de48cac928f9419926df2573c5f55acf9
18b81f17e7c1cd5287c9cbadada5907de6a8e0fd92b52ae3c16ae58b672a0e6c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
5fe991e3985f36c957bc2a0b9a212052210b988b5536059e5fe8544a5104eb19
8c155b6abea40585acce93148ee6d45319136dc6dc417aa6a9c482cb7fb848fe
93cacbb2f74c55645024c9823873891b4633146a9f6f61c8be080d72924fd0b8
a35eb0af8266e086db71038735955505cf6050a3242fd36177b6be15691c0c98
adc9b1a88e203bf8f8c3939a061a1c269e99438e0ef069839912c4b178fc8d2f
ae9cc64390a76c779bd0da29fcff4dd063438985d6f9c331c3b984534dd5e6cf
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
bf4392e4ed452f63657be49450def21e6b2b558ad21c97ba7e0ec7ba736d4abb
d07dcdbb3ddaba0dda7d56d496cbb5d8fbb1bdadc23f812126d3c4c6ab39e158
f4aac2d29b4508fcd9e6f4e6c744a73259b9fb53e7a238dad190582d5f3e58d6
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

bcdsa.eu-gb.cf.appdomain.cloud Open in urlscan Pro 158.176.79.200 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

100 %HTTPS

89 %IPv6

9 Domains

9 Subdomains

8 IPs

2 Countries

385 kBTransfer

979 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

61 JavaScript Global Variables

1 Cookies

Indicators

bcdsa.eu-gb.cf.appdomain.cloud Open in urlscan Pro
158.176.79.200 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

100 %
HTTPS

89 %
IPv6

9
Domains

9
Subdomains

8
IPs

2
Countries

385 kB
Transfer

979 kB
Size

1
Cookies

25 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!