protected-forms.com Open in urlscan Pro
34.235.94.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4...
Effective URL:
https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZH...
Submission: On November 02 via api (November 2nd 2023, 6:09:40 am UTC) from IE — Scanned from DE

Summary HTTP 26 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 26 HTTP transactions. The main IP is 34.235.94.46, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is protected-forms.com. The Cisco Umbrella rank of the primary domain is 112711.
TLS certificate: Issued by Amazon RSA 2048 M02 on March 20th 2023. Valid for: a year.

This is the only time protected-forms.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
7	34.235.94.46 34.235.94.46	14618 (AMAZON-AES) (AMAZON-AES)
7	2a02:26f0:f70... 2a02:26f0:f700:380::25cb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:f70... 2a02:26f0:f700:695::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:f70... 2a02:26f0:f700:4af::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	193.108.153.20 193.108.153.20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a02:26f0:310... 2a02:26f0:3100::1735:2a3b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
26	7

7 34.235.94.46 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-235-94-46.compute-1.amazonaws.com

science.farenheit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
protected-forms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
https.protected-forms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:f700:380::25cb (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

keycloak.mydhli.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:f700:695::11a6 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
684dd330.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:f700:4af::11a6 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.108.153.20 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a193-108-153-20.deploy.static.akamaitechnologies.com

trial-eum-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3100::1735:2a3b (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

trial-eum-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	mydhli.com keycloak.mydhli.com — Cisco Umbrella Rank: 553847	158 KB
6	protected-forms.com protected-forms.com — Cisco Umbrella Rank: 112711 https.protected-forms.com — Cisco Umbrella Rank: 241663	783 KB
4	akamaihd.net 2 redirects trial-eum-clientnsv4-s.akamaihd.net — Cisco Umbrella Rank: 2589 wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net trial-eum-clienttons-s.akamaihd.net — Cisco Umbrella Rank: 2588 fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net	1 KB
2	go-mpulse.net s.go-mpulse.net — Cisco Umbrella Rank: 1444 c.go-mpulse.net — Cisco Umbrella Rank: 654	52 KB
1	akstat.io 684dd330.akstat.io — Cisco Umbrella Rank: 73595	204 B
1	farenheit.net science.farenheit.net	1 KB
0	knowbe4.com Failed training.knowbe4.com Failed
26	7

	Domain	Requested by
7	keycloak.mydhli.com	protected-forms.com keycloak.mydhli.com
5	protected-forms.com	science.farenheit.net
1	fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net
1	trial-eum-clienttons-s.akamaihd.net	1 redirects
1	wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net
1	trial-eum-clientnsv4-s.akamaihd.net	1 redirects
1	684dd330.akstat.io	s.go-mpulse.net
1	c.go-mpulse.net	s.go-mpulse.net
1	s.go-mpulse.net	protected-forms.com
1	https.protected-forms.com	protected-forms.com
1	science.farenheit.net
0	training.knowbe4.com Failed
26	12

This site contains links to these domains. Also see Links.

Domain
https.protected-forms.com

Subject Issuer	Validity	Valid
authentlcation.com Amazon RSA 2048 M02	`2023-03-20` - `2024-04-18`	a year	crt.sh
logistics.dhl DPDHL Global TLS CA - I5	`2023-07-04` - `2024-07-03`	a year	crt.sh
akstat.io DigiCert TLS RSA SHA256 2020 CA1	`2023-04-05` - `2024-04-04`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
Frame ID: 64DF9AF8A94776F133EE06F639695BDE
Requests: 22 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/8N65B-V34HM-7R529-35BPF-EYR2P
Frame ID: CAA5E1D67DAFA259B7A6BF122FE1061A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5... Page URL
https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4... Page URL

Detected technologies

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Page Statistics

26
Requests

65 %
HTTPS

67 %
IPv6

7
Domains

12
Subdomains

7
IPs

3
Countries

995 kB
Transfer

4097 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://https.protected-forms.com/pages/7d50991489dabcffa84b4107542a0893
Title: DHL Global Forwarding

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==?cid=1785526305/ Page URL
https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=p3yzbkdxj HTTP 302
https://wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 22

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=p3yzbkdxj HTTP 302
https://fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net/eum/results.txt

Request Chain 23

https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&modifiedSince=1697499231475&rf=https%3A%2F%2Fprotected-forms.com%2Fpages%2Fb2229a823f9cdf6065ad0708664d4cd9%2FXTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw%3D%3D&bp=3&app=81de07ed5659ab10&crc=4285541066&en=wg76cekz&end=1 HTTP 302
https://protected-forms.com/ HTTP 301
https://training.knowbe4.com/ui/login

Request Chain 24

https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&modifiedSince=1697499231475&rf=https%3A%2F%2Fprotected-forms.com%2Fpages%2Fb2229a823f9cdf6065ad0708664d4cd9%2FXTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw%3D%3D&bp=3&app=81de07ed5659ab10&crc=1390465296&en=wg76cekz&end=1 HTTP 302
https://protected-forms.com/ HTTP 301
https://training.knowbe4.com/ui/login

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFS...
science.farenheit.net/ 699 B
1 KB 431ms
195ms Document
text/html 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==?cid=1785526305/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-length: 699
content-security-policy
content-type: text/html; charset=utf-8
date: Thu, 02 Nov 2023 06:09:28 GMT
etag: W/"0286376dbbf4682d19bf01d35925ead6"
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=63113904; includeSubDomains; preload
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: f13767a9-82a5-4b61-93ea-4127541f8abd
x-runtime: 0.086273
x-xss-protection: 1; mode=block

GET
H2 200 Primary Request XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFS... Show response
protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/ 14 KB
15 KB 4827ms
4791ms Document
text/html 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==

Requested by

Host: science.farenheit.net
URL: https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==?cid=1785526305/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

9d72391364406b17c2c6620be9b7147139cc34d78f9cfe0724762cd05a994ac5

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://science.farenheit.net/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==?cid=1785526305/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-length: 14662
content-security-policy
content-type: text/html; charset=utf-8
date: Thu, 02 Nov 2023 06:09:30 GMT
etag: W/"9d72391364406b17c2c6620be9b71471"
link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-32eba8d1d470acc7319d23b321f10ae9953965421df0d218f9d63a35925345db.js>; rel=preload; as=script; nopush,</packs/js/vendor-22ab86fa99157ec8b388.js>; rel=preload; as=script; nopush,</assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js>; rel=preload; as=script; nopush
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=63113904; includeSubDomains; preload
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 65abb731-d4ac-49dc-a484-31092d1d29a4
x-runtime: 1.408327
x-xss-protection: 1; mode=block

GET
H2 200 landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
protected-forms.com/assets/ 1 KB
601 B 108ms
105ms Stylesheet
text/css 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://protected-forms.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:34 GMT
content-encoding: gzip
strict-transport-security: max-age=63113904; includeSubDomains; preload
last-modified: Thu, 02 Nov 2023 00:10:14 GMT
content-length: 415
vary: Accept-Encoding
content-type: text/css

GET
H2 200 application-32eba8d1d470acc7319d23b321f10ae9953965421df0d218f9d63a35925345db.js Show response
protected-forms.com/assets/ 3 MB
746 KB 108ms
105ms Script
application/javascript 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://protected-forms.com/assets/application-32eba8d1d470acc7319d23b321f10ae9953965421df0d218f9d63a35925345db.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

a37cc011d5d4eb4ec4ee37b3507595e48ccf788e4f56a71dd2560cdcc8ac7c76

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:34 GMT
content-encoding: gzip
strict-transport-security: max-age=63113904; includeSubDomains; preload
last-modified: Thu, 02 Nov 2023 00:10:14 GMT
content-length: 762978
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 vendor-22ab86fa99157ec8b388.js Show response
protected-forms.com/packs/js/ 18 KB
6 KB 307ms
304ms Script
application/javascript 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://protected-forms.com/packs/js/vendor-22ab86fa99157ec8b388.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

d4ecb4f4a9ab6772fe97c914cb558dee1cf9bdcb69303c1e6d030a1ae0f5a303

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:34 GMT
content-encoding: br
strict-transport-security: max-age=63113904; includeSubDomains; preload
last-modified: Thu, 02 Nov 2023 00:11:12 GMT
content-length: 6054
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js Show response
protected-forms.com/assets/ 50 KB
16 KB 307ms
304ms Script
application/javascript 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://protected-forms.com/assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-235-94-46.compute-1.amazonaws.com

Software

Resource Hash

ee94dda0af1fc5c5045741b39e54136015365eedca34095f1d3c666998bb442d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:34 GMT
content-encoding: gzip
strict-transport-security: max-age=63113904; includeSubDomains; preload
last-modified: Thu, 02 Nov 2023 00:10:14 GMT
content-length: 15720
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 ruxitagentjs_ICA27NVfjqrux_10275230919171419.js Show response
keycloak.mydhli.com/auth/ 209 KB
80 KB 636ms
460ms Script
text/javascript 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://keycloak.mydhli.com/auth/ruxitagentjs_ICA27NVfjqrux_10275230919171419.js
Requested by: Host: protected-forms.com
URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 7e8ae77504119ce993c0c852a8d3c2c17a25fc916f464bf46a5ff01cc5f786dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:34 GMT
content-encoding: gzip
last-modified: Wed, 03 Mar 2010 07:01:40 GMT
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=31536000, immutable, private
server-timing: cdn-cache; desc=MISS, edge; dur=373, origin; dur=62, ak_p; desc="1698905374487_34744754_366797647_43543_7455_18_0_219";dur=1
x_request_id: f73e2effefeb4c039749dee80b364f98
content-length: 81024
expires: Fri, 01 Nov 2024 06:09:34 GMT

GET
H2 200 patternfly.css
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/node_modules/patternfly/dist/css/ 217 KB
34 KB 592ms
416ms Stylesheet
text/css 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/node_modules/patternfly/dist/css/patternfly.css?v=2.29.0

Requested by

Host: protected-forms.com
URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6274e97588ea24e54010c6657bf49ef9f1b40858bcde5e2338afb79a7546e667

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
content-length: 34430
date: Thu, 02 Nov 2023 06:09:34 GMT
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
x-oneagent-js-injection: true
cache-control: max-age=82953
server-timing: cdn-cache; desc=HIT, edge; dur=376, origin; dur=0, dtRpid;desc="-1827985919", dtSInfo;desc="0", ak_p; desc="1698905374487_34744754_366797645_37641_7099_17_0_255";dur=1
x_request_id: b451c771d04f44b3aaff1d746fe1b456
x-xss-protection: 1; mode=block
expires: Fri, 03 Nov 2023 05:12:07 GMT

GET
H2 200 patternfly-additions.css
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/node_modules/patternfly/dist/css/ 257 KB
34 KB 573ms
397ms Stylesheet
text/css 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/node_modules/patternfly/dist/css/patternfly-additions.css?v=2.29.0

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

2d1a385e98a7ed423b016472290eed31aca521035a10452de872d5de51841559

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
content-length: 34218
date: Thu, 02 Nov 2023 06:09:34 GMT
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
x-oneagent-js-injection: true
cache-control: max-age=82901
server-timing: cdn-cache; desc=HIT, edge; dur=364, origin; dur=0, dtRpid;desc="-714030962", dtSInfo;desc="0", ak_p; desc="1698905374494_34744754_366797644_37231_8073_17_0_255";dur=1
x_request_id: 7074949a42454cb3ac539eba0dc66208
x-xss-protection: 1; mode=block
expires: Fri, 03 Nov 2023 05:11:15 GMT

GET zocial.css
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/ 0
0

GET
H2 200 styles.css
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/css/ 19 KB
5 KB 601ms
426ms Stylesheet
text/css 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/css/styles.css?v=2.29.0

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e4865ce18b13387c13ec16fa4451599fad148f48a5ff7f3e9e33eac026807674

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
content-length: 4596
date: Thu, 02 Nov 2023 06:09:34 GMT
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
x-oneagent-js-injection: true
cache-control: max-age=82921
server-timing: cdn-cache; desc=HIT, edge; dur=377, origin; dur=0, dtRpid;desc="-1812160743", dtSInfo;desc="0", ak_p; desc="1698905374486_34744754_366797643_37757_7580_17_50_255";dur=1
x_request_id: 2d2aa9024f8843ff8e3d18ec4872e803
x-xss-protection: 1; mode=block
expires: Fri, 03 Nov 2023 05:11:35 GMT

GET
H2 200 form.js Show response
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/js/ 8 KB
3 KB 631ms
456ms Script
text/javascript 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/js/form.js?v=2.29.0

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

83576e5ab7f2149f458560580ce632595b8f2908dd0a26e859d0699d24c9ed7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
date: Thu, 02 Nov 2023 06:09:34 GMT
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
x-oneagent-js-injection: true
cache-control: max-age=2592000, private
server-timing: cdn-cache; desc=MISS, edge; dur=379, origin; dur=52, dtRpid;desc="1327428626", dtSInfo;desc="0", ak_p; desc="1698905374488_34744754_366797646_43253_6181_18_0_219";dur=1
x_request_id: b2e5a6e639e14fa5ae85040c1edd87e8
x-xss-protection: 1; mode=block
content-length: 1855

GET
H2 200 7d50991489dabcffa84b4107542a0893
https.protected-forms.com/pages/ 0
0 306ms
287ms Image
text/html 34.235.94.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://https.protected-forms.com/pages/7d50991489dabcffa84b4107542a0893
Requested by: Host: protected-forms.com
URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.94.46 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-94-46.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2 200 eye-icon.svg
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/img/icons/ 359 B
673 B 29ms
29ms Image
image/svg+xml 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/img/icons/eye-icon.svg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fcd38d5a7a80e615486852d7ff39fc3e430b598c061e6ff31190ccffbd560410

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
content-length: 230
date: Thu, 02 Nov 2023 06:09:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
x-oneagent-js-injection: true
cache-control: max-age=457915
server-timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="-750030913", dtSInfo;desc="0", ak_p; desc="1698905374620_34744754_366797955_101_8696_17_0_182";dur=1
x_request_id: 7ce9459153144dcf894066eeb243f5d8
x-xss-protection: 1; mode=block
expires: Tue, 07 Nov 2023 13:21:29 GMT

GET zocial.css
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/ 0
0

GET
H2 200 8N65B-V34HM-7R529-35BPF-EYR2P Show response
s.go-mpulse.net/boomerang/ Frame CAA5 202 KB
51 KB 308ms
19ms Script
application/javascript 2a02:26f0:f700:695::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/8N65B-V34HM-7R529-35BPF-EYR2P
Requested by: Host: protected-forms.com
URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:f700:695::11a6 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 06:09:35 GMT
content-encoding: br
customappheader: mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified: Sun, 24 Sep 2023 07:10:43 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=604800
timing-allow-origin: *
content-length: 51580

GET
H2 200 dhl-logo.svg
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/img/ 4 KB
2 KB 29ms
29ms Image
image/svg+xml 2a02:26f0:f700:380::25cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/img/dhl-logo.svg

Requested by

Host: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/css/styles.css?v=2.29.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:f700:380::25cb Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

96181ee7c3977ca0effdd2540b4c6755441c1cf10d451e96fa07040ac0f78c48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
referrer-policy: no-referrer
x-content-type-options: nosniff
content-length: 1228
date: Thu, 02 Nov 2023 06:09:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
x-oneagent-js-injection: true
cache-control: max-age=457919
server-timing: cdn-cache; desc=HIT, edge; dur=1, dtRpid;desc="100516282", dtSInfo;desc="0", ak_p; desc="1698905375097_34744754_366798910_54_9745_22_0_146";dur=1
x_request_id: bca12670b75f44fdae78c2f900856422
x-xss-protection: 1; mode=block
expires: Tue, 07 Nov 2023 13:21:34 GMT

GET Delivery_W_Rg.woff
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/ 0
0

GET Delivery_W_Bd.woff
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/ 0
0

GET Delivery_W_CdBlk.woff
keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/ 0
0

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame CAA5 1 KB
934 B 106ms
51ms XHR
application/json 2a02:26f0:f700:4af::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=8N65B-V34HM-7R529-35BPF-EYR2P&d=protected-forms.com&t=5663018&v=1.632.0&if=&sl=0&si=b9j5pbdgrpe-s3hfrz&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=629645
Requested by: Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/8N65B-V34HM-7R529-35BPF-EYR2P
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:f700:4af::11a6 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 58432124809c56abedf7b34f7f3455afbd8f9e9cb6e941f30ee81a86ca1732e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 02 Nov 2023 06:09:35 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 614

POST
H2 204 /
684dd330.akstat.io/ 0
204 B 74ms
58ms Ping
image/gif 2a02:26f0:f700:695::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd330.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/8N65B-V34HM-7R529-35BPF-EYR2P

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:f700:695::11a6 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 02 Nov 2023 06:09:35 GMT
content-type: image/gif
access-control-allow-origin: https://protected-forms.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 0
expires: Thu, 02 Nov 2023 06:09:35 GMT

GET
H/1.1

200
OK

results.txt Show response
wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net/eum/ Frame CAA5
Redirect Chain

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=p3yzbkdxj
https://wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net/eum/results.txt

8 B
312 B

76ms
8ms

XHR
text/plain

193.108.153.20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Server: 193.108.153.20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a193-108-153-20.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 02 Nov 2023 06:09:35 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin: *
Date: Thu, 02 Nov 2023 06:09:35 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

results.txt Show response
fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net/eum/ Frame CAA5
Redirect Chain

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=p3yzbkdxj
https://fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net/eum/results.txt

8 B
312 B

190ms
8ms

XHR
text/plain

2a02:26f0:3100::1735:2a3b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Server: 2a02:26f0:3100::1735:2a3b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 02 Nov 2023 06:09:36 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin: *
Date: Thu, 02 Nov 2023 06:09:35 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET

https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&mo...
https://protected-forms.com/
https://training.knowbe4.com/ui/login

0
0

GET

https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&mo...
https://protected-forms.com/
https://training.knowbe4.com/ui/login

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/zocial.css?v=2.29.0

Domain: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/zocial.css?v=2.29.0

Domain: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Rg.woff

Domain: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Bd.woff

Domain: keycloak.mydhli.com
URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_CdBlk.woff

Domain: training.knowbe4.com
URL: https://training.knowbe4.com/ui/login

Domain: training.knowbe4.com
URL: https://training.knowbe4.com/ui/login

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
keycloak.mydhli.com/	1969-12-31 23:59:59	Name: 9098e0d51d5c006aa714420aaf766a52 Value: 79c74934d767eebcc01041e613ad8297
.protected-forms.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44
.protected-forms.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 16989053750092N8V4N3PPA8S37SU2URUIOGSEKQMV016
.protected-forms.com/	1969-12-31 23:59:59	Name: dtSa Value: -
.protected-forms.com/	1969-12-31 23:59:59	Name: rxvt Value: 1698907175221\|1698905375010
.protected-forms.com/	1969-12-31 23:59:59	Name: dtPC Value: -67$305375006_80h-vCORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0e0
.protected-forms.com/	1970-01-20 16:05:10	Name: RT Value: "z=1&dm=protected-forms.com&si=b9j5pbdgrpe&ss=logse92m&sl=0&tt=0"

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw==(Line 10) Message: Refused to apply style from 'https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/zocial.css?v=2.29.0' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Refused to apply style from 'https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/lib/zocial/zocial.css?v=2.29.0' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
javascript	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Access to font at 'https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Rg.woff' from origin 'https://protected-forms.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Rg.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Access to font at 'https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_CdBlk.woff' from origin 'https://protected-forms.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_CdBlk.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Access to font at 'https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Bd.woff' from origin 'https://protected-forms.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://keycloak.mydhli.com/auth/resources/qa8cs/login/mydhli-portal/fonts/Delivery_W_Bd.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Access to XMLHttpRequest at 'https://training.knowbe4.com/ui/login' (redirected from 'https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&modifiedSince=1697499231475&rf=https%3A%2F%2Fprotected-forms.com%2Fpages%2Fb2229a823f9cdf6065ad0708664d4cd9%2FXTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw%3D%3D&bp=3&app=81de07ed5659ab10&crc=4285541066&en=wg76cekz&end=1') from origin 'https://protected-forms.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://training.knowbe4.com/ui/login Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://protected-forms.com/pages/b2229a823f9cdf6065ad0708664d4cd9/XTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw== Message: Access to XMLHttpRequest at 'https://training.knowbe4.com/ui/login' (redirected from 'https://protected-forms.com/auth/rb_f4be62ab-e5f3-4754-bb9a-f2b22103e0ae?type=js3&sn=v_4_srv_-2D67_sn_L1MB73V2V01HLR3AORV2ITECE8TARK44&svrid=-67&flavor=post&vi=CORDAMMBWBJASKJBCTRJFPJOAMPJGMTQ-0&modifiedSince=1697499231475&rf=https%3A%2F%2Fprotected-forms.com%2Fpages%2Fb2229a823f9cdf6065ad0708664d4cd9%2FXTjJFdlNVdFBiM3BTVGt0aVdVWkhlR0pSWlM4dlNXaHVNVzFYZUc1UlZHWkljVTlYWVdjeVdIbE5jWHBvZDJwRFZWcFFRMU4wV1daV056UmxNV05LZERrek9Xd3JjazVDYWs1MFlXaGtObTB2UjNWS1FtcFpXVXRJVUhkVVFWbEJPRWw0VHpaUmNreDZOamhGTDFSeVN5dHpiVVZYY0VOeWRrbHBjbWN3VFVoSGNHMVVkakV4TjJWcWIxQnRja3huVXpaVVp6VTJaaXRqV2pkbE0zcEhiVVkxVGtaNlVqbFNOVVZLVDFCc2FuWmxlbk40TVhSck1saElabFpYUW1KbkszaG1jbVZoU21GaFVXTmhSelJPVmxGaWMxRXdOR2hTVW1acE5WWkpibmhWT1c1bmJXZEdlRmg0VFQwdExXeHVVemxqWW1wRWRsSjRVRUZSV2xsWE1HTXJSRkU5UFE9PS0tYzVmZTljMTgxNzM5NmQ1NjU2MTYwMDI0NzdlNTYwMTM4NTQ1MThhNw%3D%3D&bp=3&app=81de07ed5659ab10&crc=1390465296&en=wg76cekz&end=1') from origin 'https://protected-forms.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://training.knowbe4.com/ui/login Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

684dd330.akstat.io
c.go-mpulse.net
fiaazgbakcqaokqce3ydcaaaabsugpi7-p3yzbk-a1d79c9cd-clienttons-s.akamaihd.net
https.protected-forms.com
keycloak.mydhli.com
protected-forms.com
s.go-mpulse.net
science.farenheit.net
training.knowbe4.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
wkrndc6bnsmrizkdhupq-p3yzbk-41d52b18f-clientnsv4-s.akamaihd.net
keycloak.mydhli.com
training.knowbe4.com
193.108.153.20
2a02:26f0:3100::1735:2a3b
2a02:26f0:f700:380::25cb
2a02:26f0:f700:4af::11a6
2a02:26f0:f700:695::11a6
34.235.94.46
16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f
2d1a385e98a7ed423b016472290eed31aca521035a10452de872d5de51841559
58432124809c56abedf7b34f7f3455afbd8f9e9cb6e941f30ee81a86ca1732e2
6274e97588ea24e54010c6657bf49ef9f1b40858bcde5e2338afb79a7546e667
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
7e8ae77504119ce993c0c852a8d3c2c17a25fc916f464bf46a5ff01cc5f786dd
83576e5ab7f2149f458560580ce632595b8f2908dd0a26e859d0699d24c9ed7d
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
96181ee7c3977ca0effdd2540b4c6755441c1cf10d451e96fa07040ac0f78c48
9d72391364406b17c2c6620be9b7147139cc34d78f9cfe0724762cd05a994ac5
a37cc011d5d4eb4ec4ee37b3507595e48ccf788e4f56a71dd2560cdcc8ac7c76
d4ecb4f4a9ab6772fe97c914cb558dee1cf9bdcb69303c1e6d030a1ae0f5a303
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4865ce18b13387c13ec16fa4451599fad148f48a5ff7f3e9e33eac026807674
ee94dda0af1fc5c5045741b39e54136015365eedca34095f1d3c666998bb442d
fcd38d5a7a80e615486852d7ff39fc3e430b598c061e6ff31190ccffbd560410

protected-forms.com Open in urlscan Pro 34.235.94.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

26 Requests

65 %HTTPS

67 %IPv6

7 Domains

12 Subdomains

7 IPs

3 Countries

995 kBTransfer

4097 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

45 JavaScript Global Variables

7 Cookies

12 Console Messages

Security Headers

Indicators

protected-forms.com Open in urlscan Pro
34.235.94.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

65 %
HTTPS

67 %
IPv6

7
Domains

12
Subdomains

7
IPs

3
Countries

995 kB
Transfer

4097 kB
Size

7
Cookies

26 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!