drive.securegsb.cfd Open in urlscan Pro
2606:4700:3036::ac43:d891 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Effective URL:
https://drive.securegsb.cfd/shared/purchase_order.xlsb
Submission: On April 11 via manual (April 11th 2024, 10:40:57 am UTC) from GB — Scanned from GB

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::ac43:d891, located in United States and belongs to CLOUDFLARENET, US. The main domain is drive.securegsb.cfd.
TLS certificate: Issued by GTS CA 1P5 on April 8th 2024. Valid for: 3 months.

This is the only time drive.securegsb.cfd was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	34.49.238.24 34.49.238.24	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	18.173.205.79 18.173.205.79	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3036::ac43:d891	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	240d:c000:201... 240d:c000:2010:1808:0:97de:1846:937e	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
1	43.152.26.104 43.152.26.104	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
1	162.19.88.69 162.19.88.69	16276 (OVH) (OVH)
1	43.152.26.154 43.152.26.154	139341 (ACE-AS-AP...) (ACE-AS-AP ACE)
8	6

2 34.49.238.24 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 24.238.49.34.bc.googleusercontent.com

bytes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.205.79 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-173-205-79.fra56.r.cloudfront.net

docsend.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3036::ac43:d891 (United States)

ASN13335 (CLOUDFLARENET, US)

drive.securegsb.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240d:c000:2010:1808:0:97de:1846:937e (Singapore)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

ca.turing.captcha.qcloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.152.26.104 (Frankfurt am Main, Germany)

ASN139341 (ACE-AS-AP ACE, SG)

global.turing.captcha.gtimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.88.69 (France)

ASN16276 (OVH, FR)
PTR: ns3221384.ip-162-19-88.eu

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.152.26.154 (Frankfurt am Main, Germany)

ASN139341 (ACE-AS-AP ACE, SG)

global.turing.captcha.gtimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gtimg.com global.turing.captcha.gtimg.com — Cisco Umbrella Rank: 878905	65 KB
2	securegsb.cfd drive.securegsb.cfd	3 KB
2	bytes.com bytes.com — Cisco Umbrella Rank: 908876	7 KB
1	postimg.cc i.postimg.cc — Cisco Umbrella Rank: 19308	386 KB
1	qcloud.com ca.turing.captcha.qcloud.com — Cisco Umbrella Rank: 853909	33 KB
1	docsend.com 1 redirects docsend.com — Cisco Umbrella Rank: 91148	6 KB
8	6

	Domain	Requested by
2	global.turing.captcha.gtimg.com	ca.turing.captcha.qcloud.com global.turing.captcha.gtimg.com
2	drive.securegsb.cfd
2	bytes.com
1	i.postimg.cc	drive.securegsb.cfd
1	ca.turing.captcha.qcloud.com	drive.securegsb.cfd
1	docsend.com	1 redirects
8	6

This site contains no links.

Subject Issuer	Validity	Valid
bytes.com GTS CA 1D4	`2024-03-30` - `2024-06-28`	3 months	crt.sh
securegsb.cfd GTS CA 1P5	`2024-04-08` - `2024-07-07`	3 months	crt.sh
*.turing.captcha.qcloud.com DigiCert Secure Site CN CA G3	`2024-03-27` - `2025-04-27`	a year	crt.sh
*.turing.captcha.gtimg.com DigiCert Secure Site CN CA G3	`2024-02-20` - `2025-03-22`	a year	crt.sh
postimg.cc R3	`2024-02-21` - `2024-05-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Frame ID: DAA79DA84CEC3E4A4097061CDE77CFBB
Requests: 7 HTTP requests in this frame

Frame: https://global.turing.captcha.gtimg.com/template/drag_ele_global.html
Frame ID: B388E5D359D0D07CDDA9320A41A84535
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Purchase_order.xlsb

Page URL History Show full URLs

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6 Page URL
https://docsend.com/view/p487hxrdc5ukrrd6 HTTP 302
https://drive.securegsb.cfd/shared/purchase_order.xlsb Page URL

Page Statistics

8
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

494 kB
Transfer

704 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6 Page URL
https://docsend.com/view/p487hxrdc5ukrrd6 HTTP 302
https://drive.securegsb.cfd/shared/purchase_order.xlsb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
bytes.com/redirect-to/ 124 B
347 B 293ms
170ms Document
text/html 34.49.238.24
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.49.238.24 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

24.238.49.34.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

2e70eb585fef3a7bf8f2888e752d8a1ed2337015554109ae03731c65b0c9a7aa

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 106
content-type: text/html; charset=ISO-8859-1
date: Thu, 11 Apr 2024 10:40:47 GMT
etag: "9829692-1712832047;br"
server: LiteSpeed
vary: Accept-Encoding
via: 1.1 google
x-litespeed-cache: miss
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block

GET
H3

200

Primary Request purchase_order.xlsb Show response
drive.securegsb.cfd/shared/
Redirect Chain

https://docsend.com/view/p487hxrdc5ukrrd6
https://drive.securegsb.cfd/shared/purchase_order.xlsb

5 KB
2 KB

1116ms
947ms

Document
text/html

2606:4700:3036::ac43:d891
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:d891 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf3f0eb2cc3180ff598c6223b2c30db4d0ea40f9210c9cfd034312d00596a37

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 872a5c4f79ea3691-LHR
content-encoding: br
content-type: text/html
date: Thu, 11 Apr 2024 10:40:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F0MVlaFb%2BjBracIctI5fLyWWjxhWjbsSONaR8UrrBY0ZdgjecrF93wyR6fbgeJjT5w96QmlxsQrLetjGMDgwX2dB4B5MA18vLoYp3IA9tbggXLFsjpmfSpj4MY5ry9lHXX2rdfQKad84g%2F90RGJ7iAdq"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: connect-src 'self' blob: https://assets.docsend.com https://d2qvtfnm75xrxf.cloudfront.net https://*.previews.dropboxusercontent.com/*/p.m3u8 https://*.dropboxusercontent.com https://api.intercom.io https://api-iam.intercom.io https://api-ping.intercom.io https://nexus-websocket-a.intercom.io https://nexus-websocket-b.intercom.io https://nexus-long-poller-a.intercom.io https://nexus-long-poller-b.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-b.intercom.io https://*.intercomcdn.com https://uploads.intercomusercontent.com https://sessions.bugsnag.com https://notify.bugsnag.com https://browser-intake-datadoghq.com https://browser-intake-us3-datadoghq.com https://browser-intake-us5-datadoghq.com https://*.kissmetrics.com https://*.kissmetrics.io https://api.segment.io https://cdn.segment.com https://events.statsigapi.net/v1/rgstr https://statsigapi.net/v1/sdk_exception https://*.id.opendns.com https://www.google-analytics.com https://*.g.doubleclick.net https://www.facebook.com https://api.autopilothq.com https://*.filestackapi.com https://cdn.filestackcontent.com https://s3.amazonaws.com https://*.dropbox.com https://*.dropboxapi.com https://*.dropboxstatic.com https://browser.pipe.aria.microsoft.com https://checkout.stripe.com https://forms.hubspot.com https://*.pubnub.com https://docsend-prod.s3.amazonaws.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' https://assets.docsend.com https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://cdn.segment.com https://scripts.kissmetrics.com https://*.id.opendns.com https://www.youtube.com https://*.ytimg.com https://vimeo.com https://www.vimeo.com https://www.googletagmanager.com https://www.googleadservices.com https://tagmanager.google.com https://connect.facebook.net https://*.quora.com https://*.bing.com https://api.autopilothq.com https://*.capterra.com https://*.g.doubleclick.net https://js.hs-analytics.net https://js.hs-scripts.com https://js-na1.hs-scripts.com https://js.hscollectedforms.net https://js.hsleadflows.net https://js.stripe.com https://checkout.stripe.com https://ajax.aspnetcdn.com https://appsforoffice.microsoft.com https://maps.googleapis.com https://static.filestackapi.com https://zapier.com https://d2wy8f7a9ursnm.cloudfront.net https://polyfill.io/v3/polyfill.min.js 'nonce-g1WxbMm0OackxsVOfPmzqA=='; report-uri https://www.dropbox.com/csp_log?policy_name=docsend; default-src 'self'; base-uri 'self'; child-src 'self' blob:; font-src 'self' https: data: chrome-extension:; form-action 'self' https://docsend.com https://*.docsend.com https://intercom.help https://api-iam.intercom.io https://accounts.google.com https://www.linkedin.com https://*.salesforce.com https://www.dropbox.com https://accounts.logme.in https://secure.join.me https://*.okta.com https://*.oktapreview.com https://*.jumpcloud.com https://*.onelogin.com https://zapier.com https://ifttt.com https://www.facebook.com; frame-src 'self' https://assets.docsend.com https://*.previews.dropboxusercontent.com/ https://js.stripe.com https://checkout.stripe.com https://www.youtube.com https://player.vimeo.com https://*.g.doubleclick.net https://tpc.googlesyndication.com https://www.facebook.com https://telemetryservice.firstpartyapps.oaspapps.com https://consent.dropbox.com https://ifttt.com; img-src 'self' https: data: blob: chrome-extension:; media-src 'self' blob: data: https://d2qvtfnm75xrxf.cloudfront.net https://js.intercomcdn.com https://*.dropboxusercontent.com; object-src 'none'; style-src 'self' 'unsafe-inline' https://assets.docsend.com https://fonts.googleapis.com https://tagmanager.google.com https://static.filestackapi.com https://use.fontawesome.com https://vjs.zencdn.net; worker-src 'self' blob:
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Apr 2024 10:40:47 GMT
Location: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1712832047&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=Ac%2FYPCJJr8q93SidNrmt0Bu%2FVqZJwowPkn0iIZ8vMZo%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1712832047&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=Ac%2FYPCJJr8q93SidNrmt0Bu%2FVqZJwowPkn0iIZ8vMZo%3D
Server: Cowboy
Strict-Transport-Security: max-age=31556952; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: Accept-Encoding, Origin
Via: 1.1 vegur, 1.1 4966f878e5166e8661305465727dd124.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DvAxfq370OeznaC1w6vDhh0w5O5KjFsIYbgtgEIJRyeyYo3RgYlflw==
X-Amz-Cf-Pop: FRA56-P12
X-Cache: Miss from cloudfront
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Request-Id: 2e736ec8-2fc0-4af7-b526-49a402e4d66a
X-Runtime: 0.324611

GET
H2 200 favicon.ico
bytes.com/ 6 KB
7 KB 29ms
27ms Other
image/x-icon 34.49.238.24
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://bytes.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.49.238.24 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 24.238.49.34.bc.googleusercontent.com
Software: LiteSpeed /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://bytes.com/redirect-to/?redirect=https://docsend.com/view/p487hxrdc5ukrrd6
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 10:38:56 GMT
via: 1.1 google
last-modified: Wed, 24 Feb 2021 13:19:37 GMT
server: LiteSpeed
age: 111
etag: "1976-60365269-11ccbf0551a89e1b;;;"
content-type: image/x-icon
cache-control: public,max-age=3600
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6518

GET
H/1.1 200
OK TCaptcha-global.js Show response
ca.turing.captcha.qcloud.com/ 106 KB
33 KB 2565ms
837ms Script
text/javascript 240d:c000:2010:1808:0:97de:1846:937e
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ca.turing.captcha.qcloud.com/TCaptcha-global.js
Requested by: Host: drive.securegsb.cfd
URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 240d:c000:2010:1808:0:97de:1846:937e , Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software: Trpc httpd, tencent http server /
Resource Hash: d719f73463e9691d74e651e532ea55c49699e0718e9c70a1a16227afaa09f08a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 11 Apr 2024 10:40:52 GMT
Content-Encoding: gzip
Server: Trpc httpd, tencent http server
Transfer-Encoding: chunked
P3P: CP=CAO PSA OUR
Content-Type: text/javascript
Cache-Control: max-age=600
Connection: keep-alive

GET
H/1.1 200
OK tcaptcha-frame.a3b4aa9f.js Show response
global.turing.captcha.gtimg.com/ 202 KB
65 KB 1367ms
57ms Script
application/javascript 43.152.26.104
ACE-AS-AP ACE

General

Check archive.org

Show headers Download Go to

Full URL: https://global.turing.captcha.gtimg.com/tcaptcha-frame.a3b4aa9f.js
Requested by: Host: ca.turing.captcha.qcloud.com
URL: https://ca.turing.captcha.qcloud.com/TCaptcha-global.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.152.26.104 Frankfurt am Main, Germany, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: tencent-cos /
Resource Hash: d543b0cdc38d744ab2b5aa7e394c8005e8ba65baf7bf23a93374656e41259518

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 07 Mar 2024 07:50:58 GMT
Content-Encoding: gzip
x-cos-hash-crc64ecma: 4322838236147498450
Last-Modified: Thu, 07 Mar 2024 02:49:09 GMT
Server: tencent-cos
X-Cache-Lookup: Cache Hit
Etag: "903167abcdfda3f6ed3fd4acd60425c9"
Content-Type: application/javascript
x-cos-request-id: NjVlOTcxZTJfMjY1MTA2MDlfY2ViOV8xYWZkMzc3
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
X-NWS-LOG-UUID: 8175542671421594220
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 66348

GET
H2 200 Untitled-design-5.png
i.postimg.cc/DzpHM6v4/ 386 KB
386 KB 162ms
39ms Image
image/png 162.19.88.69
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/DzpHM6v4/Untitled-design-5.png
Requested by: Host: drive.securegsb.cfd
URL: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.88.69 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3221384.ip-162-19-88.eu
Software: nginx /
Resource Hash: fd683568ee95faadf8a13408b809e11ebd79b48a2a35341eed6ad6b505cf5719

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 10:40:52 GMT
last-modified: Mon, 25 Mar 2024 22:38:31 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 394831
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 404 favicon.ico
drive.securegsb.cfd/ 0
431 B 588ms
588ms Other
text/html 2606:4700:3036::ac43:d891
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://drive.securegsb.cfd/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:d891 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://drive.securegsb.cfd/shared/purchase_order.xlsb
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 10:40:54 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CUfDiVclSnR0vYl35LoxpdUKK0O49n0HIWnUCT8LYlilj0oxSEuI2YlFA%2BnakGxnHZQWsUsNDFmWxsdDcvZ6%2B2%2BkZwPQtrCWreL%2FW8qmmOn2LqmwsYOhTTps%2F2n3MA4YzQ7x1G1aXLSZ0QyJ7d9XU8jP"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 872a5c7268c03691-LHR
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK drag_ele_global.html
global.turing.captcha.gtimg.com/template/ Frame B388 0
0 184ms
57ms Document
text/html 43.152.26.154
ACE-AS-AP ACE

General

Check archive.org

Show headers Download Go to

Full URL: https://global.turing.captcha.gtimg.com/template/drag_ele_global.html
Requested by: Host: global.turing.captcha.gtimg.com
URL: https://global.turing.captcha.gtimg.com/tcaptcha-frame.a3b4aa9f.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 43.152.26.154 Frankfurt am Main, Germany, ASN139341 (ACE-AS-AP ACE, SG),
Reverse DNS
Software: Trpc httpd tencent http server /
Resource Hash

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://drive.securegsb.cfd/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 33916
Content-Type: text/html
Date: Sat, 06 Apr 2024 09:46:33 GMT
P3P: CP=CAO PSA OUR
Pragma: No-cache
Server: Trpc httpd tencent http server
X-Cache-Lookup: Cache Hit
X-NWS-LOG-UUID: 16793575528639107950

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.docsend.com/	1970-01-21 04:32:48	Name: _v_ Value: ysWa7fuicLmYwZizcK1cK4wkTGWhMmWKOlgx1cvGdeHXS%2BdzkIWFrvSgOnGfSYR5iBgJygyIWPQkzA9AllF%2BHECeRYmkhrD1q6vuOmWneYU70kPqgA%3D%3D--NUe%2BwtmCu3lNiOI2--du3h%2FuA%2FJuW9wRP%2FnC0rYg%3D%3D
.docsend.com/	1970-01-21 05:23:12	Name: _us_ Value: eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJZzkyYVdWM1pXUWdaRzlqQmpvR1JWUT0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5fdXNfIn19--0a19c6dc51d459746e8b01d901655a78795a6225
.docsend.com/	1969-12-31 23:59:59	Name: _dss_ Value: 759313b987787898ca0906929d21c275
.securegsb.cfd/	1970-01-20 19:47:15	Name: FMWV Value: 219631504f673a542271ccac4d3540804018e2289e6e76b098c501ff074d5bbf

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://drive.securegsb.cfd/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bytes.com
ca.turing.captcha.qcloud.com
docsend.com
drive.securegsb.cfd
global.turing.captcha.gtimg.com
i.postimg.cc
162.19.88.69
18.173.205.79
240d:c000:2010:1808:0:97de:1846:937e
2606:4700:3036::ac43:d891
34.49.238.24
43.152.26.104
43.152.26.154
2e70eb585fef3a7bf8f2888e752d8a1ed2337015554109ae03731c65b0c9a7aa
3cf3f0eb2cc3180ff598c6223b2c30db4d0ea40f9210c9cfd034312d00596a37
d543b0cdc38d744ab2b5aa7e394c8005e8ba65baf7bf23a93374656e41259518
d719f73463e9691d74e651e532ea55c49699e0718e9c70a1a16227afaa09f08a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd683568ee95faadf8a13408b809e11ebd79b48a2a35341eed6ad6b505cf5719

drive.securegsb.cfd Open in urlscan Pro 2606:4700:3036::ac43:d891 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

100 %HTTPS

29 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

494 kBTransfer

704 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

4 Cookies

1 Console Messages

Security Headers

Indicators

drive.securegsb.cfd Open in urlscan Pro
2606:4700:3036::ac43:d891 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

494 kB
Transfer

704 kB
Size

4
Cookies

8 HTTP transactions
0 data transactions