escalation.safesecuremails.com Open in urlscan Pro
2606:4700:3033::ac43:8781  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response escalation.safesecuremails.com/	1 KB 1 KB	512ms 480ms	Document text/html	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://escalation.safesecuremails.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.28 Resource Hash c23e4b13f1177b45e6b8e37d6c8f4fcf78f376f56a32bdde3120eb577c850d02 Request headers :method GET :authority escalation.safesecuremails.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 04:13:09 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/7.3.28 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6UdgjuKuDK0y4jaV2uiQl9svYHP7W5lwvTIcdVloWi43HfiT4mi9%2Fvdf3939E3%2BxX8DmjiqNSCKWT5whLtjdi2199hgE10Q09pCaNKZMIKhrT5Vhyhf%2BVeDOD8fL49K3D6lWh9iX8QKAKm8ESWo54JQ3dljZK7xrjcV9RKk%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 688c24d2fafe433f-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H2	200	font-awesome.min.css stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/	30 KB 7 KB	34ms 21ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: escalation.safesecuremails.com URL: https://escalation.safesecuremails.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://escalation.safesecuremails.com Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 04:13:09 GMT content-encoding br x-content-type-options nosniff cf-cache-status MISS cdn-edgestorageid 723, 617 access-control-allow-origin * cdn-cachedat 2021-07-24 08:09:23 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:55 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 3a023807955e6936b35b3acca4caf11e cf-ray 688c24d619914dd0-FRA cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H3-29	200	bundle.js Show response escalation.safesecuremails.com/	2 MB 443 KB	829ms 814ms	Script application/javascript	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://escalation.safesecuremails.com/bundle.js Requested by Host: escalation.safesecuremails.com URL: https://escalation.safesecuremails.com/ Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 682d299c639660b2e0e216731afc0a9b19e07b21acdf59f85c8937a27c052327 Request headers :path /bundle.js pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority escalation.safesecuremails.com referer https://escalation.safesecuremails.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 04:13:10 GMT content-encoding br cf-cache-status MISS last-modified Wed, 05 Feb 2020 20:37:17 GMT server cloudflare etag W/"5e3b277d-1d9876" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1IaFY6dvzIrVcgATAAA%2FsyUFdmzF%2FZulQBLlcXxy0LXNIy%2F0KtgO8R%2FkBt9z1A338X0%2FVuCgiYT1cO8LduDfciF2gEM0U9Y14e0V7bPgT0aaAjUPwM8%2Fh0tzSo4m6HPP2i3v93d%2FoVD3%2F6cY%2Fh3TmMLwwMwEkS7phTmxHk0%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 688c24d618dd2b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
POST H3-29	200	installation-done Show response escalation.safesecuremails.com/api/system/	29 B 638 B	1212ms 1212ms	XHR application/json	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://escalation.safesecuremails.com/api/system/installation-done Requested by Host: escalation.safesecuremails.com URL: https://escalation.safesecuremails.com/bundle.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.28 Resource Hash e2eb56f33566f7cb943fc3bf17ff558e0c65fc8bdf4eaa990f1321fce0543a94 Request headers sec-fetch-mode cors origin https://escalation.safesecuremails.com accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest empty content-length 24 :path /api/system/installation-done pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 content-type application/x-www-form-urlencoded accept application/json, text/plain, */* cache-control no-cache :authority escalation.safesecuremails.com referer https://escalation.safesecuremails.com/ :scheme https sec-fetch-site same-origin :method POST Accept application/json, text/plain, */* Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Fri, 03 Sep 2021 04:13:11 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.28 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E2KuCu33IKi5%2Baa3YZDADOI6yaVPPTY3RG0cucy3o3f2mjswcA7myuK0XbmCbIg0DWCphAgofjTvA7fXE16JmTn93rSMbElrLNKJi9vne%2BPpHyPAS7aXKVBDJlkU9podAversYBghMfG4rI7O13BB8Ie27qL%2FR%2Bl1ITSys0%3D"}],"group":"cf-nel","max_age":604800} content-type application/json set-cookie PHPSESSID=v4nh9g4hc7ogo5ptpkl741b8pi; path=/ cf-ray 688c24dd18152b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
POST H3-29	200	get-settings Show response escalation.safesecuremails.com/api/system/	1 KB 1 KB	1256ms 1256ms	XHR application/json	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://escalation.safesecuremails.com/api/system/get-settings Requested by Host: escalation.safesecuremails.com URL: https://escalation.safesecuremails.com/bundle.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.28 Resource Hash c3b6887ea7bb03d42cc7ca96d2dbbb459c33199c36aef910abc3bd816a9c90d7 Request headers sec-fetch-mode cors origin https://escalation.safesecuremails.com accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest empty content-length 24 :path /api/system/get-settings pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 content-type application/x-www-form-urlencoded accept application/json, text/plain, */* cache-control no-cache :authority escalation.safesecuremails.com referer https://escalation.safesecuremails.com/ :scheme https sec-fetch-site same-origin :method POST Accept application/json, text/plain, */* Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Fri, 03 Sep 2021 04:13:11 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.28 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=boXFftGuB17LTLEYiKB6ocR4lTVxiMI4grluGmW2TvYvYCVeqGOM7qppOWJ0Qfh5tlzWrf%2B1qhlx%2BEcDYJxf4sFq3QCxkgtGuGapDw1%2F2LMt61RI6pRS9NLyonstly0EzP%2FNnb3qR5ajoJsyaW9oQzoBtMsEaE43S5fBI4g%3D"}],"group":"cf-nel","max_age":604800} content-type application/json set-cookie PHPSESSID=sfpndjvg3ihn3rvq8et6jqnar2; path=/ cf-ray 688c24dd18192b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
POST H3-29	200	check-session Show response escalation.safesecuremails.com/api/user/	51 B 655 B	1211ms 1211ms	XHR application/json	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://escalation.safesecuremails.com/api/user/check-session Requested by Host: escalation.safesecuremails.com URL: https://escalation.safesecuremails.com/bundle.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.3.28 Resource Hash 422c2bd152804ebb7509a5e2675a8c18a1f35ab0d639f3280f874ef09ccf7083 Request headers sec-fetch-mode cors origin https://escalation.safesecuremails.com accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest empty content-length 24 :path /api/user/check-session pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 content-type application/x-www-form-urlencoded accept application/json, text/plain, */* cache-control no-cache :authority escalation.safesecuremails.com referer https://escalation.safesecuremails.com/ :scheme https sec-fetch-site same-origin :method POST Accept application/json, text/plain, */* Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Fri, 03 Sep 2021 04:13:11 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.3.28 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t2xtgzBKcHwNSgoQ1Xe74BdLSFFlucGJuU8aOFs0dcpmKA3WbNN4jVXsMbCIDZ7Zj7laXSUzc05FjXouAxIPK6r8P%2BswtAc5EWWD0d%2FB5Tl8GiXvKV01exbS0wMB4zytNH6u05ru%2FT%2FcbMb2uSxo6YLcGr9EiMoyhGEoxz0%3D"}],"group":"cf-nel","max_age":604800} content-type application/json set-cookie PHPSESSID=uu4mrsmkj0nmfb88v1at43p0ll; path=/ cf-ray 688c24dd181d2b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	us.png escalation.safesecuremails.com/images/icons/	609 B 1 KB	470ms 470ms	Image image/png	2606:4700:3033::ac43:8781 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://escalation.safesecuremails.com/images/icons/us.png Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3033::ac43:8781 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585 Request headers :path /images/icons/us.png pragma no-cache cookie PHPSESSID=sfpndjvg3ihn3rvq8et6jqnar2 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority escalation.safesecuremails.com referer https://escalation.safesecuremails.com/ :scheme https sec-fetch-site same-origin :method GET Referer https://escalation.safesecuremails.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 04:13:12 GMT cf-cache-status MISS last-modified Wed, 05 Feb 2020 20:37:17 GMT server cloudflare etag "5e3b277d-261" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T3wvgPs29Tt7XdF7AgK0SOVBpXLTSoi6B8ZOMt4PYWtwir7dg3mA7cQeliW4SJdm1RAY%2BKDjGAuQQlsVnZXPUo3HMwTQNI3Wt0qqrt5hINhEOYT8EL41%2Fy1Inp1qv9o55j%2FHgJXBHNqe%2FomIiTOIP3YXha6WEOvTK%2FjyYsc%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 688c24e518ed2b1e-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 609
GET H3-29	200	fontawesome-webfont.woff2 stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/	75 KB 76 KB	25ms 17ms	Font font/woff2	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: stackpath.bootstrapcdn.com URL: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://escalation.safesecuremails.com Referer https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Fri, 03 Sep 2021 04:13:11 GMT x-content-type-options nosniff cf-cache-status MISS cdn-edgestorageid 601, 617, 718 access-control-allow-origin * cdn-cachedat 2021-08-02 20:43:32 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 77160 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:55 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type font/woff2 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 06b91726ea3505648fdc30a319926d93 accept-ranges bytes cf-ray 688c24e52aa9c2e0-FRA cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| opensupports_version string| root string| apiRoot string| globalIndexPath boolean| showLogs function| webpackHotUpdate function| _ object| i18n object| __core-js_shared__ object| store

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

escalation.safesecuremails.com
stackpath.bootstrapcdn.com
2606:4700:3033::ac43:8781
2606:4700::6812:bcf
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
422c2bd152804ebb7509a5e2675a8c18a1f35ab0d639f3280f874ef09ccf7083
682d299c639660b2e0e216731afc0a9b19e07b21acdf59f85c8937a27c052327
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
c23e4b13f1177b45e6b8e37d6c8f4fcf78f376f56a32bdde3120eb577c850d02
c3b6887ea7bb03d42cc7ca96d2dbbb459c33199c36aef910abc3bd816a9c90d7
e2eb56f33566f7cb943fc3bf17ff558e0c65fc8bdf4eaa990f1321fce0543a94