pub-549a3f7b59a34474a15313a37944ecae.r2.dev Open in urlscan Pro
2606:4700::6812:323 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Submission Tags: @phish_report
Submission: On June 01 via api (June 1st 2024, 1:04:30 am UTC) from FI — Scanned from FI

Summary HTTP 12 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-549a3f7b59a34474a15313a37944ecae.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-549a3f7b59a34474a15313a37944ecae.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
4	178.128.17.197 178.128.17.197	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:20a... 2600:9000:20ae:1400:15:c281:3500:93a1	16509 (AMAZON-02) (AMAZON-02)
2	142.250.185.161 142.250.185.161	15169 (GOOGLE) (GOOGLE)
12	7

1 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-549a3f7b59a34474a15313a37944ecae.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.128.17.197 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

178.128.17.197	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20ae:1400:15:c281:3500:93a1 (United States)

ASN16509 (AMAZON-02, US)

ik.imagekit.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.161 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f1.1e100.net

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 421	79 KB
2	imagekit.io ik.imagekit.io — Cisco Umbrella Rank: 21998	172 KB
1	gstatic.com fonts.gstatic.com	39 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	1 KB
1	r2.dev pub-549a3f7b59a34474a15313a37944ecae.r2.dev	16 KB
12	5

	Domain	Requested by
3	cdn.ampproject.org	pub-549a3f7b59a34474a15313a37944ecae.r2.dev cdn.ampproject.org
2	ik.imagekit.io	pub-549a3f7b59a34474a15313a37944ecae.r2.dev
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	pub-549a3f7b59a34474a15313a37944ecae.r2.dev
1	pub-549a3f7b59a34474a15313a37944ecae.r2.dev
12	5

This site contains links to these domains. Also see Links.

Domain
t.ly
cutt.ly
merdekabelajar.uinsgd.ac.id

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
misc-sni.google.com WR2	`2024-05-13` - `2024-08-05`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-13` - `2024-08-05`	3 months	crt.sh
178.128.17.197 ZeroSSL RSA Domain Secure Site CA	`2024-03-14` - `2024-06-12`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-13` - `2024-08-05`	3 months	crt.sh
*.imagekit.io Amazon RSA 2048 M02	`2024-01-23` - `2025-02-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Frame ID: F428C23DEEBC4D8512DCC95DEB583719
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MAWARTOTO 🌈 Agen Bandar Judi Togel Tergacor 2024

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Lightbox (JavaScript Libraries) Expand

Page Statistics

12
Requests

100 %
HTTPS

71 %
IPv6

5
Domains

5
Subdomains

7
IPs

3
Countries

335 kB
Transfer

556 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://t.ly/pastijp

Search URL Search Domain Scan URL

URL: https://cutt.ly/KwRO7ee6
Title: VPN UNTUK SLOT ANTI BLOK

Search URL Search Domain Scan URL

URL: https://merdekabelajar.uinsgd.ac.id/js/mawartoto/
Title: SEO PADI

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request amp-mawar.html Show response
pub-549a3f7b59a34474a15313a37944ecae.r2.dev/ 16 KB
16 KB 467ms
369ms Document
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e29ad87f186b3bd59b6077ac74b9b770722226b746ec335e6fd0ecfd9aa4c63d

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 88cb4a175c948db1-HEL
Connection: keep-alive
Content-Length: 16562
Content-Type: text/html
Date: Sat, 01 Jun 2024 01:04:24 GMT
ETag: "3e537bb7d92dad410b527d7f1f4d5b25"
Last-Modified: Tue, 28 May 2024 22:58:50 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 v0.js Show response
cdn.ampproject.org/ 278 KB
73 KB 295ms
69ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0.js

Requested by

Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11e66704977ef23c28031fae0b6c874e7f7d509db29c6139f1c6a52a48e60bed

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Sat, 01 Jun 2024 01:04:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73170
x-xss-protection: 0
server: sffe
etag: "315056f9c7bc2027"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 01 Jun 2024 01:04:24 GMT

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
1 KB 201ms
70ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Requested by

Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f2e1354c35d007da969fee34471427de87a2377fecc691b0b387ea2d9c1b007b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Sat, 01 Jun 2024 01:04:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 31 May 2024 23:13:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 01 Jun 2024 01:04:24 GMT

GET
H2 200 3.png
178.128.17.197/falisha/upload/ 14 KB
14 KB 1368ms
682ms Image
image/png 178.128.17.197
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://178.128.17.197/falisha/upload/3.png
Requested by: Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.128.17.197 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 3dc955cfbd10e31e9867b0956dcf8f996db4719da9f98634a98cb8afdc13fc13

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 01 Jun 2024 01:04:25 GMT
last-modified: Sun, 17 Dec 2023 12:42:09 GMT
server: LiteSpeed
etag: "3691-657eeca1-55b2;;;"
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 13969
expires: Sat, 08 Jun 2024 01:04:25 GMT

GET
H2 200 whatsapp_w2bfkm.png
178.128.17.197/falisha/upload/ 1 KB
1 KB 1369ms
683ms Image
image/png 178.128.17.197
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://178.128.17.197/falisha/upload/whatsapp_w2bfkm.png
Requested by: Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.128.17.197 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4b8829391a64a6af2d9efd6d0838cb6c7ade700cc7a44f859200e25e56e9cb10

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 01 Jun 2024 01:04:25 GMT
last-modified: Sun, 17 Dec 2023 12:42:42 GMT
server: LiteSpeed
etag: "585-657eecc2-55b3;;;"
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1413
expires: Sat, 08 Jun 2024 01:04:25 GMT

GET
H2 200 counter-icon-1.png
178.128.17.197/falisha/upload/ 3 KB
3 KB 1356ms
685ms Image
image/png 178.128.17.197
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://178.128.17.197/falisha/upload/counter-icon-1.png
Requested by: Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.128.17.197 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 73789eb477676b9095f9dd2bbfba3dd2a4b4c4c385f3f39e70e5b25e74364bfd

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 01 Jun 2024 01:04:25 GMT
last-modified: Sun, 17 Dec 2023 12:43:57 GMT
server: LiteSpeed
etag: "ce3-657eed0d-55b7;;;"
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 3299
expires: Sat, 08 Jun 2024 01:04:25 GMT

GET
H2 200 line.png
178.128.17.197/falisha/upload/ 8 KB
8 KB 1355ms
684ms Image
image/png 178.128.17.197
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://178.128.17.197/falisha/upload/line.png
Requested by: Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.128.17.197 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 083edb37053d7873fbd65a527898f28c7a7f71793a15169cbcc16300ca3d5b96

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 01 Jun 2024 01:04:25 GMT
last-modified: Sun, 17 Dec 2023 12:44:31 GMT
server: LiteSpeed
etag: "1f63-657eed2f-55b8;;;"
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 8035
expires: Sat, 08 Jun 2024 01:04:25 GMT

GET
H2 200 o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
fonts.gstatic.com/s/notosans/v36/ 38 KB
39 KB 193ms
62ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosans/v36/o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 28 May 2024 15:13:37 GMT
x-content-type-options: nosniff
age: 294647
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39412
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:43:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 May 2025 15:13:37 GMT

GET
H2 200 scatter-hita.jpg
ik.imagekit.io/seopadi/ 160 KB
161 KB 225ms
75ms Image
image/webp 2600:9000:20ae:1400:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ik.imagekit.io/seopadi/scatter-hita.jpg?updatedAt=1716890481311
Requested by: Host: pub-549a3f7b59a34474a15313a37944ecae.r2.dev
URL: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/amp-mawar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:1400:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f7a80fd4719a1b0fb5e2482ef599c7d67a017c642c324bd9cd1662aa4df82fb3

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 29 May 2024 03:06:21 GMT
via: 1.1 8af5231b014ab5e8c35000dd4cf4b68c.cloudfront.net (CloudFront), 1.1 e6ecdd688219ba98d4d4d70abc494a54.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P5
age: 251884
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 164246
x-request-id: eef7fa63-fe9c-430a-8637-9ce1e49d64f6
last-modified: Tue, 28 May 2024 10:26:08 GMT
etag: "9959c5d8846e10b6f7835a372a4939e6"
vary: Accept
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: WC3EfzycD5IP4JiSRiN20UM0QiKVoUduvEe5aH3jIEk5HmDgDtAkWg==

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012405160547000/v0/ 8 KB
3 KB 191ms
68ms Script
text/javascript 142.250.185.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012405160547000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f1.1e100.net

Software

sffe /

Resource Hash

81b4619d607fd5348931940bb7d441c89d22c6e4539bd1a7085cb241253d09e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Origin: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 28 May 2024 19:02:30 GMT
age: 280915
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2978
x-xss-protection: 0
server: sffe
etag: "a39776d601cc4efc"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 28 May 2025 19:02:30 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012405160547000/v0/ 12 KB
4 KB 185ms
62ms Script
text/javascript 142.250.185.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012405160547000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f1.1e100.net

Software

sffe /

Resource Hash

2d5188df741b04871c94ba4a944afcbb6d60dcccae13ebfe2b12c3b8797f2d7d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Origin: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 28 May 2024 19:02:30 GMT
age: 280915
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3940
x-xss-protection: 0
server: sffe
etag: "466656022f1e0202"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 28 May 2025 19:02:30 GMT

GET
H2 200 dragon-icon.png
ik.imagekit.io/seopadi/ 11 KB
11 KB 69ms
68ms Other
image/webp 2600:9000:20ae:1400:15:c281:3500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ik.imagekit.io/seopadi/dragon-icon.png?updatedAt=1716891812917
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ae:1400:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d785e33f627e99ffd0014f128c5db0f3fb6c3e54de044eb662f6d385246bc076

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://pub-549a3f7b59a34474a15313a37944ecae.r2.dev/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 29 May 2024 03:10:37 GMT
via: 1.1 bafea69ec4368ee11760779ffcfbd4fc.cloudfront.net (CloudFront), 1.1 e6ecdd688219ba98d4d4d70abc494a54.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P5
age: 251628
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 10794
x-request-id: f4093508-bfa3-4259-8b6a-77cb6cceca4d
etag: W/"2a2a-7jkcz+upCBVrgG9TJVM6BlErTi4"
vary: Accept
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, must-revalidate
x-server: ImageKit.io
timing-allow-origin: *
access-control-allow-headers: *
x-amz-cf-id: QSoNQtdRW8OHeqCB-1OopV_rfumoWb2Wm3zlOORK4y0cK8iJVl2FQQ==

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
fonts.googleapis.com
fonts.gstatic.com
ik.imagekit.io
pub-549a3f7b59a34474a15313a37944ecae.r2.dev
142.250.185.161
178.128.17.197
2600:9000:20ae:1400:15:c281:3500:93a1
2606:4700::6812:323
2a00:1450:4001:810::2003
2a00:1450:4001:811::2001
2a00:1450:4001:81c::200a
083edb37053d7873fbd65a527898f28c7a7f71793a15169cbcc16300ca3d5b96
11e66704977ef23c28031fae0b6c874e7f7d509db29c6139f1c6a52a48e60bed
2d5188df741b04871c94ba4a944afcbb6d60dcccae13ebfe2b12c3b8797f2d7d
3dc955cfbd10e31e9867b0956dcf8f996db4719da9f98634a98cb8afdc13fc13
4b8829391a64a6af2d9efd6d0838cb6c7ade700cc7a44f859200e25e56e9cb10
73789eb477676b9095f9dd2bbfba3dd2a4b4c4c385f3f39e70e5b25e74364bfd
81b4619d607fd5348931940bb7d441c89d22c6e4539bd1a7085cb241253d09e1
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
d785e33f627e99ffd0014f128c5db0f3fb6c3e54de044eb662f6d385246bc076
e29ad87f186b3bd59b6077ac74b9b770722226b746ec335e6fd0ecfd9aa4c63d
f2e1354c35d007da969fee34471427de87a2377fecc691b0b387ea2d9c1b007b
f7a80fd4719a1b0fb5e2482ef599c7d67a017c642c324bd9cd1662aa4df82fb3

pub-549a3f7b59a34474a15313a37944ecae.r2.dev Open in urlscan Pro 2606:4700::6812:323 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

71 %IPv6

5 Domains

5 Subdomains

7 IPs

3 Countries

335 kBTransfer

556 kBSize

0 Cookies

3 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

0 Cookies

Indicators

pub-549a3f7b59a34474a15313a37944ecae.r2.dev Open in urlscan Pro
2606:4700::6812:323 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

71 %
IPv6

5
Domains

5
Subdomains

7
IPs

3
Countries

335 kB
Transfer

556 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions