pub-0c643638e9594769b567bb9f58854256.r2.dev

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-0c643638e9594769b567bb9f58854256.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.

This is the only time pub-0c643638e9594769b567bb9f58854256.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:20:... 2606:4700:20::681a:d3b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.23.140.12 104.23.140.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.212.88.157 23.212.88.157	16625 (AKAMAI-AS) (AKAMAI-AS)
5	4

2 2606:4700:20::681a:d3b (United States)

ASN13335 (CLOUDFLARENET, US)

www.offidocs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-0c643638e9594769b567bb9f58854256.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.23.140.12 (None, )

ASN13335 (CLOUDFLARENET, US)

img001.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.212.88.157 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-88-157.deploy.static.akamaitechnologies.com

s.uicdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	offidocs.com www.offidocs.com — Cisco Umbrella Rank: 113257	1 KB
1	uicdn.com s.uicdn.com — Cisco Umbrella Rank: 36951	36 KB
1	prntscr.com img001.prntscr.com — Cisco Umbrella Rank: 309670	1 KB
1	r2.dev pub-0c643638e9594769b567bb9f58854256.r2.dev	20 KB
5	4

	Domain	Requested by
2	www.offidocs.com
1	s.uicdn.com
1	img001.prntscr.com	pub-0c643638e9594769b567bb9f58854256.r2.dev
1	pub-0c643638e9594769b567bb9f58854256.r2.dev
5	4

This site contains no links.

Subject Issuer	Validity	Valid
offidocs.com WE1	`2024-07-14` - `2024-10-12`	3 months	crt.sh
*.r2.dev E1	`2024-06-03` - `2024-09-01`	3 months	crt.sh
prntscr.com GTS CA 1P5	`2024-05-30` - `2024-08-28`	3 months	crt.sh
img.ui-portal.de GeoTrust RSA CA 2018	`2024-04-08` - `2025-04-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/1730814-header-navlogin2-1.html
Frame ID: ABF7F8C86354A0786BE5A4070D89A28D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | GMX.COM

Page URL History Show full URLs

https://www.offidocs.com/mydata/1394248/NewDocuments/ott/referer.html Page URL
https://pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/1730814-header-navlogin2-1.html Page URL

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

59 kB
Transfer

57 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.offidocs.com/mydata/1394248/NewDocuments/ott/referer.html Page URL
https://pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/1730814-header-navlogin2-1.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 referer.html
www.offidocs.com/mydata/1394248/NewDocuments/ott/ 229 B
736 B 328ms
19ms Document
text/html 2606:4700:20::681a:d3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.offidocs.com/mydata/1394248/NewDocuments/ott/referer.html

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:d3b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

age: 173616
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 8a9a97c3ecde1ca9-FRA
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
date: Sat, 27 Jul 2024 06:32:32 GMT
last-modified: Mon, 01 Jul 2024 16:04:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TE8GW2VXvmEP7Nft2tmkQJ514LzGGI4Teae2cfz1hhQNHR0%2F6DfV0n%2B1tt0TRbylCpjIT6FEK7jiZqgNhGvVuH7049U0PZiF1%2BfegKsiR6PesPJYv%2BQPH6Ew4punbbKGykrS4KyocC2xLSPlxe4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding

GET
H/1.1 200
OK Primary Request 1730814-header-navlogin2-1.html Show response
pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/ 20 KB
20 KB 335ms
280ms Document
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/1730814-header-navlogin2-1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d0d1e304013c38b0f0cb2836e33208e9f7dc1b7f26325b603fd5583d8102746

Request headers

Referer: https://www.offidocs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Accept-Ranges: bytes
CF-RAY: 8a9a97c568b44d85-FRA
Connection: keep-alive
Content-Length: 20237
Content-Type: text/html
Date: Sat, 27 Jul 2024 06:32:33 GMT
ETag: "1c2d6975c1af0e003dcb3a0c9842c5f3"
Last-Modified: Mon, 01 Jul 2024 15:35:54 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H3 404 favicon.ico
www.offidocs.com/ 196 B
689 B 28ms
28ms Other
text/html 2606:4700:20::681a:d3b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.offidocs.com/favicon.ico

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:d3b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.offidocs.com/mydata/1394248/NewDocuments/ott/referer.html
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 27 Jul 2024 06:32:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cross-origin-opener-policy: unsafe-none
age: 1808988
cross-origin-embedder-policy: unsafe-none
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4JA0sEXMD7X9EI4nGfA6LaxFLdzx8mcax8j6IxT44wBAoXPpsYS8eQA4G6FI%2FZvFE9Ko10cdq0KaKUFjly1LAEj474RjNtFe8eReKEsc8%2FJHLALvek%2BMcrDl%2Fr%2BRb0ySeszBQVrMz8RzY3FY5lU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: public, max-age=31536000
cf-ray: 8a9a97c51e631ca9-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 Dkdp93XjQ6-qK5Z_fFrBjw.png
img001.prntscr.com/file/img001/ 928 B
1 KB 401ms
183ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img001.prntscr.com/file/img001/Dkdp93XjQ6-qK5Z_fFrBjw.png

Requested by

Host: pub-0c643638e9594769b567bb9f58854256.r2.dev
URL: https://pub-0c643638e9594769b567bb9f58854256.r2.dev/gmx/1730814-header-navlogin2-1.html

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

104.23.140.12 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83871c780806c8a2440c1d0e570d1f093a9662f6c75de70f5fff73e64ca7907b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://pub-0c643638e9594769b567bb9f58854256.r2.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 27 Jul 2024 06:32:33 GMT
strict-transport-security: max-age=63072000
cf-cache-status: HIT
x-bz-file-id: 4_z51bcbe33c7b20fe37efb0b11_f1062471862f6d896_d20230906_m024723_c004_v0402007_t0016_u01693968443325
cf-polished: origFmt=png, origSize=1932
x-bz-content-sha1: 67c798f528eb83423dfea604acc8296132172360
x-bz-file-name: Dkdp93XjQ6-qK5Z_fFrBjw.png
content-disposition: inline; filename="Dkdp93XjQ6-qK5Z_fFrBjw.webp"
alt-svc: h3=":443"; ma=86400
content-length: 928
x-bz-upload-timestamp: 1693968443325
cf-bgj: imgq:100,h2pri
last-modified: Sat, 27 Jul 2024 06:29:27 GMT
server: cloudflare
vary: Accept
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8a9a97c94bb739eb-FRA

GET
H2 200 favicon_gmxcom.ico
s.uicdn.com/mailint/9.2220.0/assets/ 36 KB
36 KB 213ms
11ms Other
image/x-icon 23.212.88.157
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.uicdn.com/mailint/9.2220.0/assets/favicon_gmxcom.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.88.157 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-88-157.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec16b4f46cfa2ee185077885a7af4e144c4442242c30f1e2f0d1234e1b67c4f4

Request headers

Referer: https://pub-0c643638e9594769b567bb9f58854256.r2.dev/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Sat, 27 Jul 2024 06:32:34 GMT
last-modified: Mon, 30 Nov 2020 10:27:02 GMT
server: Apache
etag: W/"37054-1606732022000"
content-type: image/x-icon
access-control-allow-origin: *
cache-control: max-age=1942032
accept-ranges: bytes
content-length: 37054

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.offidocs.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

img001.prntscr.com
pub-0c643638e9594769b567bb9f58854256.r2.dev
s.uicdn.com
www.offidocs.com
104.23.140.12
23.212.88.157
2606:4700:20::681a:d3b
2606:4700::6812:323
0d0d1e304013c38b0f0cb2836e33208e9f7dc1b7f26325b603fd5583d8102746
83871c780806c8a2440c1d0e570d1f093a9662f6c75de70f5fff73e64ca7907b
ec16b4f46cfa2ee185077885a7af4e144c4442242c30f1e2f0d1234e1b67c4f4

pub-0c643638e9594769b567bb9f58854256.r2.dev Open in urlscan Pro 2606:4700::6812:323 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

59 kBTransfer

57 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

pub-0c643638e9594769b567bb9f58854256.r2.dev Open in urlscan Pro
2606:4700::6812:323 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

59 kB
Transfer

57 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions