webmail-73r3f3r.web.app Open in urlscan Pro
151.101.1.195  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response webmail-73r3f3r.web.app/	14 KB 2 KB	427ms 426ms	Document text/html	151.101.1.195 FASTLY
General Check archive.org Show headers Download Go to Full URL https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.195 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 21b19d30429f4771de603aa409026f15342d4edcc8434e671d371f59bd444b59 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers :method GET :authority webmail-73r3f3r.web.app :scheme https :path /?emailtoken=associateservices@legalshield.com&domain=legalshield.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control max-age=3600 content-encoding br content-type text/html; charset=utf-8 etag "760b7f8f35b5317de49d16fe2e3b53fb3c6f2f39ab3b1ddc8d51b75a7e405e20-br" last-modified Mon, 28 Dec 2020 01:03:37 GMT strict-transport-security max-age=31556926; includeSubDomains; preload accept-ranges bytes date Mon, 18 Jan 2021 21:31:52 GMT x-served-by cache-ams21046-AMS x-cache MISS x-cache-hits 0 x-timer S1611005512.443241,VS0,VE411 vary x-fh-requested-host, accept-encoding content-length 2097
GET H2	403	style.css scripgit.imfast.io/	0 0	70ms 53ms	Stylesheet text/html	2606:4700:7::a29f:8a51 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://scripgit.imfast.io/style.css Requested by Host: webmail-73r3f3r.web.app URL: https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:7::a29f:8a51 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 21:31:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, HEAD, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Type. cf-ray, x-fst-debug cache-control public, max-age=15 cf-ray 613b6ce78c34dfe7-FRA cf-request-id 07b90264bb0000dfe7e817c000000001 x-fst-debug errLock/wk/cw/2.4.0/live
GET H2	200	render via.hypothes.is/http://urlpdf.ssaeb.com:9000/api/ Frame 1412	0 0	773ms 754ms	Document text/html	2606:4700:10::ac43:1687 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://via.hypothes.is/http://urlpdf.ssaeb.com:9000/api/render?output=screenshot&viewport.isLandscape=true&viewport.width=1800&url=http://null Requested by Host: webmail-73r3f3r.web.app URL: https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:1687 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers :method GET :authority via.hypothes.is :scheme https :path /http://urlpdf.ssaeb.com:9000/api/render?output=screenshot&viewport.isLandscape=true&viewport.width=1800&url=http://null pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://webmail-73r3f3r.web.app/?emailtoken=associateservices@legalshield.com&domain=legalshield.com Response headers date Mon, 18 Jan 2021 21:31:53 GMT content-type text/html; charset=utf-8 set-cookie __cfduid=dec344b94b69ed4d946abe4389b8346de1611005512; expires=Wed, 17-Feb-21 21:31:52 GMT; path=/; domain=.hypothes.is; HttpOnly; SameSite=Lax cf-cache-status DYNAMIC cf-request-id 07b902650400002bb921972000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000; includeSubDomains; preload x-content-type-options nosniff server cloudflare cf-ray 613b6ce80c5a2bb9-FRA content-encoding br

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| ChangeFavicon object| str function| checkForm undefined| str1 undefined| str2 undefined| str3

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

scripgit.imfast.io
via.hypothes.is
webmail-73r3f3r.web.app
151.101.1.195
2606:4700:10::ac43:1687
2606:4700:7::a29f:8a51
21b19d30429f4771de603aa409026f15342d4edcc8434e671d371f59bd444b59