urlscan.io logo urlscan.io
SecurityTrails logo

cilrcnovdr.web.app Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u21360247.ct.sendgrid.net/ls/click?upn=sgsSlonNdZHppMOQ-2F3ry5pDKCcOmSHDxiGo2c1YQI5NrBypgn4moqWnsB2gx1gFpVGjXKdKMrmhFG6OyK...
Effective URL: https://cilrcnovdr.web.app/
Submission: On January 21 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is cilrcnovdr.web.app.
TLS certificate: Issued by GTS CA 1D4 on December 2nd 2021. Valid for: 3 months.
This is the only time cilrcnovdr.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.16 11377 (SENDGRID)
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 2620:0:890::100 54113 (FASTLY)
3 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
11 7
1    167.89.123.16 (Chicago, United States)

ASN11377 (SENDGRID, US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u21360247.ct.sendgrid.net
1    2606:4700:3037::6815:570 (United States)

ASN13335 (CLOUDFLARENET, US)
kcateewlkp.mary-keen.workers.dev
3    2620:0:890::100 (United States)

ASN54113 (FASTLY, US)
cilrcnovdr.web.app
3    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
2    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
1    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
Apex Domain
Subdomains		 Transfer
4 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 680
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2427
114 KB
3 web.app
cilrcnovdr.web.app
46 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 227
14 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 293
30 KB
1 workers.dev
kcateewlkp.mary-keen.workers.dev
828 B
1 sendgrid.net
u21360247.ct.sendgrid.net
273 B
11 6
Domain Requested by
3 cilrcnovdr.web.app kcateewlkp.mary-keen.workers.dev
cilrcnovdr.web.app
2 stackpath.bootstrapcdn.com cilrcnovdr.web.app
stackpath.bootstrapcdn.com
2 cdnjs.cloudflare.com cilrcnovdr.web.app
2 maxcdn.bootstrapcdn.com cilrcnovdr.web.app
1 ajax.googleapis.com cilrcnovdr.web.app
1 kcateewlkp.mary-keen.workers.dev
1 u21360247.ct.sendgrid.net 1 redirects
11 7

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-10-10 -
2022-10-09		 a year crt.sh
web.app
GTS CA 1D4		 2021-12-02 -
2022-03-02		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://cilrcnovdr.web.app/
Frame ID: 8A7920DAEBC8A676F5E1E483852D04E8
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook Web App

Page URL History Show full URLs

  1. https://u21360247.ct.sendgrid.net/ls/click?upn=sgsSlonNdZHppMOQ-2F3ry5pDKCcOmSHDxiGo2c1YQI5NrBypgn4moqWnsB2gx1... HTTP 302
    https://kcateewlkp.mary-keen.workers.dev/ Page URL
  2. https://cilrcnovdr.web.app/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

7
IPs

2
Countries

204 kB
Transfer

550 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u21360247.ct.sendgrid.net/ls/click?upn=sgsSlonNdZHppMOQ-2F3ry5pDKCcOmSHDxiGo2c1YQI5NrBypgn4moqWnsB2gx1gFpVGjXKdKMrmhFG6OyKa97KaqgjV2uwhVgMysOu-2F-2BVRn0-3DLl9c_0jlKXhuEp5sMTnSTJ1C9s0uMSRqE2zTMFpgcjrHzRGuuy2j88FvXPGI9ioQBu9w5MjnIdcInp-2BUbYvkwyna0ks26SCSOZjxU5qRDu2xEjEWRsaRfxjSaLyqnv9Krh6AFa1-2BPJKuQJCiVcXeBty9G3txgil3tKWJwYjdomGmTQj7V-2FuVNtEx-2ByciDG9vfXVLPf0N8zw-2F1tm-2FHG9OhyAK9oQ-3D-3D HTTP 302
    https://kcateewlkp.mary-keen.workers.dev/ Page URL
  2. https://cilrcnovdr.web.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u21360247.ct.sendgrid.net/ls/click?upn=sgsSlonNdZHppMOQ-2F3ry5pDKCcOmSHDxiGo2c1YQI5NrBypgn4moqWnsB2gx1gFpVGjXKdKMrmhFG6OyKa97KaqgjV2uwhVgMysOu-2F-2BVRn0-3DLl9c_0jlKXhuEp5sMTnSTJ1C9s0uMSRqE2zTMFpgcjrHzRGuuy2j88FvXPGI9ioQBu9w5MjnIdcInp-2BUbYvkwyna0ks26SCSOZjxU5qRDu2xEjEWRsaRfxjSaLyqnv9Krh6AFa1-2BPJKuQJCiVcXeBty9G3txgil3tKWJwYjdomGmTQj7V-2FuVNtEx-2ByciDG9vfXVLPf0N8zw-2F1tm-2FHG9OhyAK9oQ-3D-3D HTTP 302
  • https://kcateewlkp.mary-keen.workers.dev/

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
kcateewlkp.mary-keen.workers.dev/
Redirect Chain
  • https://u21360247.ct.sendgrid.net/ls/click?upn=sgsSlonNdZHppMOQ-2F3ry5pDKCcOmSHDxiGo2c1YQI5NrBypgn4moqWnsB2gx1gFpVGjXKdKMrmhFG6OyKa97KaqgjV2uwhVgMysOu-2F-2BVRn0-3DLl9c_0jlKXhuEp5sMTnSTJ1C9s0uMSRqE2...
  • https://kcateewlkp.mary-keen.workers.dev/
676 B
828 B 		Document
General
Check archive.org
Download Go to
Full URL
https://kcateewlkp.mary-keen.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:570 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Fri, 21 Jan 2022 20:15:53 GMT
content-type
text/html;charset=UTF-8
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hsq6bgAotSqyey5dumxvuaULQ2s9JFxBjyiI93%2BGDmAK6%2BMx7uolnocJSpCkTVPokyJbntcbC3YrPa%2F0Ij47Mc1IZ4zH58LA%2FlEcT7%2BOuxeznYM4bliLihATkSlEgQoecKxVRoc4UR9l1pd%2BZWyz9DLrt6xpj6btoVZ50cvocQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
6d133795cc364303-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Server
nginx
Date
Fri, 21 Jan 2022 20:15:53 GMT
Content-Type
text/html; charset=utf-8
Content-Length
93
Connection
keep-alive
Location
https://kcateewlkp.mary-keen.workers.dev/#YW1pZXRAZmFpcndheW1jLmNvbQ==
X-Robots-Tag
noindex, nofollow
Primary Request /
cilrcnovdr.web.app/ 		41 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cilrcnovdr.web.app/
Requested by
Host: kcateewlkp.mary-keen.workers.dev
URL: https://kcateewlkp.mary-keen.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cbf7087a2988fdacf27759d55b69ea3808cd1fec12eae0fa9a9a212f0801fc98
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://kcateewlkp.mary-keen.workers.dev/

Response headers

cache-control
max-age=3600
content-encoding
br
content-type
text/html; charset=utf-8
etag
"e8c141a203b2b97bc124e72a0a33ff4a78be8fc049b3069dadb5a1826ddd71cd-br"
last-modified
Thu, 20 Jan 2022 10:21:46 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
accept-ranges
bytes
date
Fri, 21 Jan 2022 20:15:55 GMT
x-served-by
cache-del21744-DEL
x-cache
MISS
x-cache-hits
0
x-timer
S1642796154.472890,VS0,VE616
vary
x-fh-requested-host, accept-encoding
content-length
17044
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617, 617
age
13027373
cdn-cachedat
2021-06-08 21:21:23
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
203451c6c050184245ebe231729b4b5c
cf-ray
6d1337a21d95697b-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		37 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1262261
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5884
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iRToClDLeX1VzyTLSNIZKUraGA%2FZK0gD%2BhPq6zL4BVtGluqGsch5IdqaZXweajH0V%2BZ1a%2BD0WS3hTGj1d7vKClfFab6e5lnKyTq90QzOQCZtUpB8JzHzoifpfU8HshCiHUttIrSr5FQ1mkC8UHHLITfv"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6d1337a228812c2e-FRA
expires
Wed, 11 Jan 2023 20:15:55 GMT
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723
age
1273408
cdn-cachedat
11/15/2021 21:49:00
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver
1.0
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
0f75ada5f5f896c9164d03ecca3ce250
cf-ray
6d1337a21d0c6922-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Thu, 20 Jan 2022 14:20:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
107721
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Jan 2023 14:20:34 GMT
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cilrcnovdr.web.app/
Origin
https://cilrcnovdr.web.app
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1271770
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6458
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-500f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZLXgC2jrq5Kp2Z%2Fstk3ypLGzIjRBN6zjNmDyNA%2B9%2BzaGXc6L8KR3QeGRek4QqmB9UqHaF5lLxGFHqtjlwCj%2B2bnVgpR0v4k%2FLsFXa3h7mwOAXagpRb8wEk9LrdABym8W3vdj1ihfouwLOig%2BA6IOVWm1"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6d1337a22d304eaf-FRA
expires
Wed, 11 Jan 2023 20:15:55 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cilrcnovdr.web.app/
Origin
https://cilrcnovdr.web.app
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
755
access-control-allow-origin
*
cdn-cachedat
12/13/2021 20:18:53
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver
1.02
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
47b3ba78d7c7fa2ccf92a43bd58da8e8
cf-ray
6d1337a22a985b3e-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
jquery.min.js
cilrcnovdr.web.app/js/ 		87 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cilrcnovdr.web.app/js/jquery.min.js
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 20 Jan 2022 10:21:46 GMT
x-timer
S1642796155.279556,VS0,VE702
etag
"adf7ee27abe439a2ad8b0002c7b346ae1cff9f409dada23746c717da1e6f96d9-br"
x-served-by
cache-del21744-DEL
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 21 Jan 2022 20:15:55 GMT
accept-ranges
bytes
content-length
27955
x-cache-hits
0
script.min.js
cilrcnovdr.web.app/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cilrcnovdr.web.app/js/script.min.js
Requested by
Host: cilrcnovdr.web.app
URL: https://cilrcnovdr.web.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bb204ce2331836c2dd5b0077118a8bc7afb82e6759a8d6dad65b85f73f82f76b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cilrcnovdr.web.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
last-modified
Thu, 20 Jan 2022 10:21:46 GMT
x-timer
S1642796155.279626,VS0,VE497
etag
"7612a51036881e2ea5001abdba6ba39eb06486069bca224da44275a84b447825-br"
x-served-by
cache-del21744-DEL
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 21 Jan 2022 20:15:55 GMT
accept-ranges
bytes
content-length
1128
x-cache-hits
0
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
fontawesome-webfont.woff2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Origin
https://cilrcnovdr.web.app
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 21 Jan 2022 20:15:55 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
601, 617, 718
access-control-allow-origin
*
cdn-cachedat
2021-08-02 20:43:32
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
77160
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
font/woff2
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
8aa3717cb27dd6a66313ddab1ff86ffc
accept-ranges
bytes
cf-ray
6d1337a29b795b3e-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick function| Popper number| g_fFcs

0 Cookies