cloudflare-ipfs.com Open in urlscan Pro
2606:4700::6811:400e  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8 Show response cloudflare-ipfs.com/ipfs/	2 KB 2 KB	76ms 47ms	Document text/html	2606:4700::6811:400e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:400e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06d3a43b529d6f559f1bb93f923f31f0b5ecf54e4b5ac02cc4dcacf81b0942b7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language de-DE,de;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers access-control-allow-headers Content-Type Range User-Agent X-Requested-With access-control-allow-methods GET access-control-allow-origin * access-control-expose-headers Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output age 19198 alt-svc h3=":443"; ma=86400 cache-control public, max-age=29030400, immutable cf-cache-status HIT cf-ray 86b7816c0c5519b1-FRA content-encoding br content-type text/html date Thu, 28 Mar 2024 12:08:26 GMT etag W/"QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8" server cloudflare vary Accept-Encoding x-cf-ipfs-cache-status hit x-ipfs-path /ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8 x-ipfs-roots QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8
GET H/1.1	200 OK	sc.php Show response 53northaviations.com/we5ijvc2/admin/js/	2 KB 1 KB	153ms 58ms	Script application/javascript	5.181.80.98 TAMATIYA-AS
General Check archive.org Show headers Download Go to Full URL https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Requested by Host: cloudflare-ipfs.com URL: https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 5.181.80.98 , Bulgaria, ASN50360 (TAMATIYA-AS, BG), Reverse DNS huertahenry.mattender.com Software nginx / PHP/8.1.27 Resource Hash 2844db1a1eaf71cc9d0b25c090b105955053fca25f075a89c8b25f987ef3b1d9 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 28 Mar 2024 12:08:26 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/8.1.27 Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Credentials true Connection keep-alive Keep-Alive timeout=60
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	30ms 7ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 28 Mar 2024 12:08:26 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3029893 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-fra-eddf8230083-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1711627706.493278,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 93, 86425
GET H3	200	crypto-js.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/	47 KB 14 KB	40ms 23ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 28 Mar 2024 12:08:26 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 761697 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 14107 last-modified Mon, 04 May 2020 16:09:17 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e2d-bb78" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bj3FXljntpNrHbVWjRfKWyoAEL61eq8urcIhpAQF0vW%2FwVbuaBQ0JrHyh0ptW2Rgh5sF%2BNgc5gj7fN8wWDh0HiB9qBJ18P7fEakDZu0Jf1bZs1BI9%2BgH56pZUrJJartpXxZy65pH"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 86b7816d8c55927a-FRA expires Tue, 18 Mar 2025 12:08:26 GMT
POST H/1.1	200 OK	e154491.php Show response 53northaviations.com/we5ijvc2/	589 KB 423 KB	1457ms 1358ms	XHR text/html	5.181.80.98 TAMATIYA-AS
General Check archive.org Show headers Download Go to Full URL https://53northaviations.com/we5ijvc2/e154491.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 5.181.80.98 , Bulgaria, ASN50360 (TAMATIYA-AS, BG), Reverse DNS huertahenry.mattender.com Software nginx / PHP/8.1.27 Resource Hash 04d1ae0ef14ac7510fa5dce61b409fc5660ebc0a4007234eea7f3f78af9cf31c Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Accept */* Referer https://cloudflare-ipfs.com/ sec-ch-ua-platform "Win32" Response headers Pragma no-cache Date Thu, 28 Mar 2024 12:08:27 GMT Content-Encoding gzip Server nginx X-Powered-By PHP/8.1.27 Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Access-Control-Allow-Methods GET, PUT, POST, DELETE, OPTIONS Cache-Control no-store, no-cache, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Keep-Alive timeout=60 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	26ms 18ms	Stylesheet text/css	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ Origin https://cloudflare-ipfs.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 28 Mar 2024 12:08:28 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 454421 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcNppZLoNwlg7d%2FW9bNvHaUlUlhaMOVSGXoLfQPdYa%2BhGwFGYYHQAyJX9MBrDfFI8sEvhJl%2FPg%2FifPffq9jdauCgeHxFZ9xTa5fbrzp3MqnlmIbUvdCyEyF4i1wKdSGtsPZL6DtS"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 86b781786a426919-FRA expires Tue, 18 Mar 2025 12:08:28 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 29 KB	7ms 6ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers date Thu, 28 Mar 2024 12:08:28 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3029895 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-fra-eddf8230083-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1711627708.222190,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 93, 86426
GET H2	200	picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	250 B 763 B	94ms 20ms	Image image/svg+xml	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 28 Mar 2024 12:08:28 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 199 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B8374CE7F93 x-azure-ref 20240328T120828Z-qwgghpkxk54bfb9kxydy8g619400000006bg00000000hrwd content-type image/svg+xml access-control-allow-origin * x-ms-request-id a03dfc1a-701e-0001-03f7-80ce9c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	3 KB 2 KB	87ms 13ms	Image image/svg+xml	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 28 Mar 2024 12:08:28 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 1173 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B83749623C9 x-azure-ref 20240328T120828Z-qwgghpkxk54bfb9kxydy8g619400000006bg00000000hrwb content-type image/svg+xml access-control-allow-origin * x-ms-request-id 47e4db16-601e-004c-72f7-80c296000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	87ms 13ms	Image image/svg+xml	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg Requested by Host: 53northaviations.com URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://cloudflare-ipfs.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 28 Mar 2024 12:08:28 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 2407 x-ms-lease-status unlocked last-modified Fri, 11 Mar 2022 11:11:29 GMT etag 0x8DA034FE445C10D x-azure-ref 20240328T120828Z-qwgghpkxk54bfb9kxydy8g619400000006bg00000000hrwc content-type image/svg+xml access-control-allow-origin * x-ms-request-id 884031da-f01e-005d-43f7-8059b6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| _0x53d963 function| _0x2130 function| _0x48db string| encodedUrl string| decodedUrl object| scriptElement object| v62a9d518 number| autograb object| v583334000a5d0b5e904ef98c6806f function| $ function| jQuery object| CryptoJS string| em string| ur

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cloudflare-ipfs.com/	1970-01-20 19:27:09	Name: __cf_bm Value: 5Eau9jVb8uNDJ7fdnDMkO9L4IMOjLKCxC3yK2ncQcfs-1711627706-1.0.1.1-BMa9Ii8PE0Vm9azV0R5piwMDLXZ1b3i7kbJqUOQP8UY_9hdxRIOqjHxZfPe8HMqQLMoOAZIRxnGopCOvxgX2HQ

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk(Line 46) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://53northaviations.com/we5ijvc2/admin/js/sc.php?r=ZW0sZW1haWwsYWRk(Line 46) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

53northaviations.com
aadcdn.msauth.net
cdnjs.cloudflare.com
cloudflare-ipfs.com
code.jquery.com
104.17.25.14
2606:4700::6811:400e
2620:1ec:46::45
2a04:4e42:400::649
5.181.80.98
04d1ae0ef14ac7510fa5dce61b409fc5660ebc0a4007234eea7f3f78af9cf31c
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
06d3a43b529d6f559f1bb93f923f31f0b5ecf54e4b5ac02cc4dcacf81b0942b7
2844db1a1eaf71cc9d0b25c090b105955053fca25f075a89c8b25f987ef3b1d9
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc