login.barryxxywor.com Open in urlscan Pro
167.99.44.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=https%3A%2F%2Fmdhf...
Effective URL:
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com&sso_reload=true
Submission Tags: falconsandbox
Submission: On May 25 via api (May 25th 2023, 9:46:54 pm UTC) from US — Scanned from DE

Summary HTTP 30 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 7 domains to perform 30 HTTP transactions. The main IP is 167.99.44.15, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is login.barryxxywor.com.
TLS certificate: Issued by R3 on May 25th 2023. Valid for: 3 months.

This is the only time login.barryxxywor.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.215.187.240 34.215.187.240	16509 (AMAZON-02) (AMAZON-02)
19	2606:4700::68... 2606:4700::6812:672	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	45.123.40.11 45.123.40.11	212477 (ROYALE-AS) (ROYALE-AS)
4	167.99.44.15 167.99.44.15	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
30	4

1 34.215.187.240 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-215-187-240.us-west-2.compute.amazonaws.com

rollins-mkt-prod1.campaign.adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2606:4700::6812:672 (United States)

ASN13335 (CLOUDFLARENET, US)

mdhfzk.codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
codesandbox.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.123.40.11 (Ashburn, United States)

ASN212477 (ROYALE-AS, NL)
PTR: shared.hosteaza.com

radiouri.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 167.99.44.15 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

login.barryxxywor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	codesandbox.io mdhfzk.codesandbox.io codesandbox.io — Cisco Umbrella Rank: 65676 prod-packager-packages.codesandbox.io Failed	899 KB
4	barryxxywor.com login.barryxxywor.com live.barryxxywor.com Failed	316 KB
1	radiouri.eu radiouri.eu	1 KB
1	adobe.com 1 redirects rollins-mkt-prod1.campaign.adobe.com — Cisco Umbrella Rank: 742686	468 B
0	amazonaws.com Failed aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com Failed
0	jsdelivr.com Failed data.jsdelivr.com Failed
0	cloudflareinsights.com Failed static.cloudflareinsights.com Failed
30	7

	Domain	Requested by
17	codesandbox.io	mdhfzk.codesandbox.io codesandbox.io
4	login.barryxxywor.com	login.barryxxywor.com
2	mdhfzk.codesandbox.io	mdhfzk.codesandbox.io
1	radiouri.eu	mdhfzk.codesandbox.io
1	rollins-mkt-prod1.campaign.adobe.com	1 redirects
0	live.barryxxywor.com Failed	login.barryxxywor.com
0	aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com Failed	codesandbox.io
0	prod-packager-packages.codesandbox.io Failed	codesandbox.io
0	data.jsdelivr.com Failed	codesandbox.io
0	static.cloudflareinsights.com Failed	mdhfzk.codesandbox.io
30	10

This site contains no links.

Subject Issuer	Validity	Valid
codesandbox.io Cloudflare Inc ECC CA-3	`2023-03-19` - `2024-03-18`	a year	crt.sh
barryxxywor.com R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com&sso_reload=true
Frame ID: A14054C4957ACE197C9B70FD6E70A671
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&... HTTP 302
https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com&sso_reload=true Page URL

Page Statistics

30
Requests

77 %
HTTPS

25 %
IPv6

7
Domains

10
Subdomains

4
IPs

2
Countries

1216 kB
Transfer

2726 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=https%3A%2F%2Fmdhfzk.codesandbox.io%3Fregister%3Dc2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t HTTP 302
https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com Page URL
https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=https%3A%2F%2Fmdhfzk.codesandbox.io%3Fregister%3Dc2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t HTTP 302
https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t

30 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
mdhfzk.codesandbox.io/
Redirect Chain

https://rollins-mkt-prod1.campaign.adobe.com/rln/getImage.jssp?m=ebe0a673-b585-4d5f-8b02-173d6da0ca15&e=boss&l=brandlogo&i=https%3A%2F%2Fmdhfzk.codesandbox.io%3Fregister%3Dc2lsbGluZ3dvcnRoQGJsdWVvY...
https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t

8 KB
3 KB

327ms
285ms

Document
text/html

2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e46746068f2ed5868554af24190830218d3fb1ade5c960584e4e1e7cfd1529a1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, max-age=0, no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 7cd0f91e3a042bdd-FRA
content-encoding: br
content-type: text/html
date: Thu, 25 May 2023 21:46:47 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google
x-request-id: F2KBJUUSRuIHqCECsB9H

Redirect headers

Cache-Control: no-cache
Connection: keep-alive, Keep-Alive
Content-Type: text/plain; charset=iso-8859-1
Content-length: 0
Date: Thu, 25 May 2023 21:46:46 GMT
Expires: Thu, 25 May 2023 21:46:46 GMT
Keep-Alive: timeout=5, max=100
Location: https://mdhfzk.codesandbox.io?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Pragma: no-cache
Server: Apache
X-Robots-Tag: noindex
X-UA-Compatible: IE=edge
X-XSS-Protection: 1; mode=block

GET
H2 200 vendors~app~embed~sandbox~sandbox-startup.7424373eb.chunk.js Show response
codesandbox.io/static/js/ 9 KB
4 KB 98ms
21ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/vendors~app~embed~sandbox~sandbox-startup.7424373eb.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca8f23c22709d3e885448f79507b823a149a67060eb42515092f7be2909d87a1

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9503
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-25ca"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7939d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 vendors~app~embed~sandbox-startup.b754f8b0e.chunk.js Show response
codesandbox.io/static/js/ 17 KB
5 KB 119ms
43ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/vendors~app~embed~sandbox-startup.b754f8b0e.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49882b4768f3155504bf1919726c430d358deeab783a6b5db9197b9999193ce8

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9503
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-421c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7a39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 default~app~embed~sandbox~sandbox-startup.b2134d8a8.chunk.js Show response
codesandbox.io/static/js/ 15 KB
5 KB 94ms
19ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/default~app~embed~sandbox~sandbox-startup.b2134d8a8.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ea8b89f1a62017ab374ddba6959a38f05e73611f8b0b621b34b247a0d4ba04d

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9278
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-3a15"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7b39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sandbox-startup.a6840230d.js Show response
codesandbox.io/static/js/ 10 KB
4 KB 98ms
23ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/sandbox-startup.a6840230d.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e05b0af05f3bb9e5d06c3ab2c2adf581131cd51afa004f39f303a1d2f3eb321d

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9473
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-28ab"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7c39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 browserfs.min.js Show response
codesandbox.io/static/browserfs12/ 232 KB
59 KB 74ms
53ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/browserfs12/browserfs.min.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mdhfzk.codesandbox.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 13267887
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 22 Apr 2021 14:00:04 GMT
server: cloudflare
etag: W/"60818164-39fc5"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9206c8f2bdd-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 vendors~app~codemirror-editor~monaco-editor~sandbox.ad4e6d3c4.chunk.js Show response
codesandbox.io/static/js/ 25 KB
7 KB 95ms
20ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/vendors~app~codemirror-editor~monaco-editor~sandbox.ad4e6d3c4.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12238e4ef0a070d35f498ddf8b9e594bad68b318999dfc5db289b2b26c2f529

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9503
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-641d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7e39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 common-sandbox.d3049e87f.chunk.js Show response
codesandbox.io/static/js/ 169 KB
45 KB 102ms
28ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/common-sandbox.d3049e87f.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a335f401b85be6f166de7a45b6f15d9d0684d85976d177dffa6acdd48cf2a81e

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9473
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-2a5e0"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d8139d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 vendors~app~sandbox.aca52037e.chunk.js Show response
codesandbox.io/static/js/ 64 KB
19 KB 101ms
27ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/vendors~app~sandbox.aca52037e.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfcfbff1f73b7a8f4a0a6207e31583a643ddf15c4805e8a07dfce291989025b8

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9236
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-100cd"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d8339d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 vendors~sandbox.3bd3135bd.chunk.js
codesandbox.io/static/js/ 416 KB
114 KB 117ms
43ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/vendors~sandbox.3bd3135bd.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9279
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-68087"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d8439d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 default~app~embed~sandbox.5ecd4ceea.chunk.js Show response
codesandbox.io/static/js/ 70 KB
17 KB 98ms
24ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/default~app~embed~sandbox.5ecd4ceea.chunk.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fcc1563896a5072c48a977c92617765cd7458fa5845d9f119d9bff185b54bce

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9498
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-118ef"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d8239d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sandbox.08002ba78.js
codesandbox.io/static/js/ 324 KB
73 KB 115ms
41ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/sandbox.08002ba78.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 8966
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-511a1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7d39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 banner.0b5d84a2b.js Show response
codesandbox.io/static/js/ 4 KB
2 KB 96ms
22ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/banner.0b5d84a2b.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 683fbdef88b2ebf85e44c498687952697f4093fb1ff40f884eb6a2f3c74d0bb7

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9473
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-f37"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d7f39d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 watermark-button.f4f9aed52.js Show response
codesandbox.io/static/js/ 3 KB
2 KB 92ms
18ms Script
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/watermark-button.f4f9aed52.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f74bf2cf5a8225beb66712ff4e859c5d4ba9c24123e6de2f427b4b9fde408928

Request headers

Referer: https://mdhfzk.codesandbox.io/
Origin: https://mdhfzk.codesandbox.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 9278
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-ae5"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9209d8039d9-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET v52afc6f149f6479b8c77fa569edb01181681764108816
static.cloudflareinsights.com/beacon.min.js/ 0
0

GET
H2 200 babel.7.21.8.min.js
codesandbox.io/static/js/ 0
534 KB 41ms
38ms Other
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/static/js/babel.7.21.8.min.js
Requested by: Host: codesandbox.io
URL: https://codesandbox.io/static/js/sandbox-startup.a6840230d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mdhfzk.codesandbox.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:47 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 1775048
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 05 May 2023 08:33:42 GMT
server: cloudflare
etag: W/"6454bf66-2c469c"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7cd0f9211d2f2bdd-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 babel-transpiler.0871e6c2.worker.js
mdhfzk.codesandbox.io/ 0
0 229ms
228ms Other
application/javascript 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mdhfzk.codesandbox.io/babel-transpiler.0871e6c2.worker.js
Requested by: Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:48 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 25 May 2023 16:24:36 GMT
server: cloudflare
etag: W/"646f8bc4-dedc8"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 7cd0f9211d302bdd-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H2 200 mdhfzk
codesandbox.io/api/v1/sandboxes/ 0
0 44ms
38ms Preflight 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/api/v1/sandboxes/mdhfzk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://mdhfzk.codesandbox.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: accept, origin, referer, accept-language, content-language, authorization, content-type
access-control-allow-methods: PATCH, POST, GET, DELETE, PUT, OPTIONS
access-control-allow-origin: https://mdhfzk.codesandbox.io
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7cd0f921be7339d9-FRA
content-length: 0
date: Thu, 25 May 2023 21:46:47 GMT
server: cloudflare
vary: origin
via: 1.1 google
x-request-id: F2KBJVecRac0NMAK10_B

GET
H3 200 mdhfzk
codesandbox.io/api/v1/sandboxes/ 5 KB
6 KB 50ms
47ms Fetch
application/vnd.github.v3+json 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/api/v1/sandboxes/mdhfzk
Requested by: Host: codesandbox.io
URL: https://codesandbox.io/static/js/sandbox.08002ba78.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: application/json
Referer: https://mdhfzk.codesandbox.io/
accept-language: de-DE,de;q=0.9
Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:48 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: origin
content-type: application/vnd.github.v3+json; charset=utf-8
access-control-allow-origin: https://mdhfzk.codesandbox.io
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 7cd0f921ffe71e4e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5259
x-request-id: F2KBJVolh03lWfkJfM1C

GET
H2 200 phishing
codesandbox.io/api/v1/sandboxes/mdhfzk/ 33 B
425 B 108ms
104ms Fetch
application/vnd.github.v3+json 2606:4700::6812:672
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codesandbox.io/api/v1/sandboxes/mdhfzk/phishing
Requested by: Host: codesandbox.io
URL: https://codesandbox.io/static/js/banner.0b5d84a2b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:672 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mdhfzk.codesandbox.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 21:46:48 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: origin
content-type: application/vnd.github.v3+json; charset=utf-8
access-control-allow-origin: https://mdhfzk.codesandbox.io
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
cf-ray: 7cd0f921be7e39d9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 33
x-request-id: F2KBJVgGgZkJXxsCsCKH

GET
H/1.1 200
OK c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t
radiouri.eu/demn/lobatan/hain/ 0
1 KB 133ms
85ms Document
text/html 45.123.40.11
ROYALE-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://radiouri.eu/demn/lobatan/hain/c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t

Requested by

Host: mdhfzk.codesandbox.io
URL: https://mdhfzk.codesandbox.io/?register=c2lsbGluZ3dvcnRoQGJsdWVvY2VhbnNlaXNtaWMuY29t

Protocol

HTTP/1.1

Server

45.123.40.11 Ashburn, United States, ASN212477 (ROYALE-AS, NL),

Reverse DNS

shared.hosteaza.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
access-control-allow-headers: Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: null
content-encoding: gzip
content-length: 20
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Thu, 25 May 2023 21:46:48 GMT
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=(), window-placement=()
referrer-policy: strict-origin-when-cross-origin
refresh: 0;url=https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com
strict-transport-security: max-age=63072000
vary: Accept-Encoding
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block

GET runtime
data.jsdelivr.com/v1/package/npm/@babel/ 0
0

GET 2.2.1.json
prod-packager-packages.codesandbox.io/v2/packages/node-libs-browser/ 0
0

GET runtime
data.jsdelivr.com/v1/package/npm/@babel/ 0
0

POST node-libs-browser%402.2.1
aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com/prod/packages/ 0
0

GET
H2 200 / Show response
login.barryxxywor.com/ 409 KB
160 KB 704ms
604ms Document
text/html 167.99.44.15
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

167.99.44.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

f8f51fc12c5e82465bcd7d8c4a68e291b076b46cb02b2f7429df21083a048302

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://radiouri.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 25 May 2023 21:46:48 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 / Show response
login.barryxxywor.com/ 202 B
346 B 476ms
474ms Fetch
application/json 167.99.44.15
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Requested by

Host: login.barryxxywor.com
URL: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

167.99.44.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

9fa08a416cf2362bb034695dafda8841031f8869319c7291226141c7f970588a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 25 May 2023 21:46:49 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/json

GET
H2 200 /
login.barryxxywor.com/ 457 KB
156 KB 1927ms
1926ms Document
text/html 167.99.44.15
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Requested by

Host: login.barryxxywor.com
URL: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

167.99.44.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: *
access-control-allow-origin: *
cache-control: no-store, no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 25 May 2023 21:46:51 GMT
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://0727fbe9-b248812d.barryxxywor.com/api/report?catId=GW+estsfd+ams1"}]}
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Accept-Encoding
x-ms-ests-server: 2.1.15427.11 - WEULR1 ProdSlices
x-ms-request-id: 0a415fee-ed8d-42ed-905f-0cfc40966a00

GET
H2 200 Primary Request /
login.barryxxywor.com/ 448 KB
0 2345ms
2345ms Document
text/html 167.99.44.15
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com&sso_reload=true

Requested by

Host: login.barryxxywor.com
URL: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

167.99.44.15 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: *
access-control-allow-origin: *
cache-control: no-store, no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 25 May 2023 21:46:54 GMT
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://0727fbe9-b248812d.barryxxywor.com/api/report?catId=GW+estsfd+ams1"}]}
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Accept-Encoding
x-ms-ests-server: 2.1.15427.11 - NEULR2 ProdSlices
x-ms-request-id: 4f02da96-6164-4193-91f0-fc852f202e00

GET Me.htm
live.barryxxywor.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816

Domain: data.jsdelivr.com
URL: https://data.jsdelivr.com/v1/package/npm/@babel/runtime

Domain: prod-packager-packages.codesandbox.io
URL: https://prod-packager-packages.codesandbox.io/v2/packages/node-libs-browser/2.2.1.json

Domain: data.jsdelivr.com
URL: https://data.jsdelivr.com/v1/package/npm/@babel/runtime

Domain: aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com
URL: https://aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com/prod/packages/node-libs-browser%402.2.1

Domain: live.barryxxywor.com
URL: https://live.barryxxywor.com/Me.htm?v=3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
codesandbox.io/	1969-12-31 23:59:59	Name: jf9248hHFEQIU42jf298 Value: 19c714bb-12c2-46e4-b45c-89a89f49903d
.codesandbox.io/	1969-12-31 23:59:59	Name: _cfuvid Value: ZjYTIj8MsoNDPeyPA_1_bwlIb6xJgOtzbfD6urddSso-1685051208338-0-604800000
.barryxxywor.com/	1970-01-20 12:25:47	Name: rN3QTj Value: YjI0ODgxMmQtZTI5YS00YTkwLTk5ZDUtZmJlMzU4NTNjYzNjOjI3NjQxNjg4LTVkM2EtNDgxNy1iMWZkLWZhZGU1MDg3ZmNlZQ==
.login.barryxxywor.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login.barryxxywor.com/	1970-01-20 12:04:11	Name: SSOCOOKIEPULLED Value: 1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com(Line 87) Message: WebSocket connection to 'wss://login.barryxxywor.com/websocket/hook/?rN3QTj=YjI0ODgxMmRlMjlhNGE5MDk5ZDVmYmUzNTg1M2NjM2M=' failed: Error during WebSocket handshake: Unexpected response code: 503
network	error	URL: https://login.barryxxywor.com/?username=sillingworth@blueoceanseismic.com(Line 87) Message: WebSocket connection to 'wss://login.barryxxywor.com/websocket/hook/?rN3QTj=YjI0ODgxMmRlMjlhNGE5MDk5ZDVmYmUzNTg1M2NjM2M=' failed: Error during WebSocket handshake: Unexpected response code: 503

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com
codesandbox.io
data.jsdelivr.com
live.barryxxywor.com
login.barryxxywor.com
mdhfzk.codesandbox.io
prod-packager-packages.codesandbox.io
radiouri.eu
rollins-mkt-prod1.campaign.adobe.com
static.cloudflareinsights.com
aiwi8rnkp5.execute-api.eu-west-1.amazonaws.com
data.jsdelivr.com
live.barryxxywor.com
prod-packager-packages.codesandbox.io
static.cloudflareinsights.com
167.99.44.15
2606:4700::6812:672
34.215.187.240
45.123.40.11
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
2fcc1563896a5072c48a977c92617765cd7458fa5845d9f119d9bff185b54bce
49882b4768f3155504bf1919726c430d358deeab783a6b5db9197b9999193ce8
62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
683fbdef88b2ebf85e44c498687952697f4093fb1ff40f884eb6a2f3c74d0bb7
7ea8b89f1a62017ab374ddba6959a38f05e73611f8b0b621b34b247a0d4ba04d
9fa08a416cf2362bb034695dafda8841031f8869319c7291226141c7f970588a
a335f401b85be6f166de7a45b6f15d9d0684d85976d177dffa6acdd48cf2a81e
ca8f23c22709d3e885448f79507b823a149a67060eb42515092f7be2909d87a1
cfcfbff1f73b7a8f4a0a6207e31583a643ddf15c4805e8a07dfce291989025b8
d12238e4ef0a070d35f498ddf8b9e594bad68b318999dfc5db289b2b26c2f529
e05b0af05f3bb9e5d06c3ab2c2adf581131cd51afa004f39f303a1d2f3eb321d
e46746068f2ed5868554af24190830218d3fb1ade5c960584e4e1e7cfd1529a1
f74bf2cf5a8225beb66712ff4e859c5d4ba9c24123e6de2f427b4b9fde408928
f8f51fc12c5e82465bcd7d8c4a68e291b076b46cb02b2f7429df21083a048302

login.barryxxywor.com Open in urlscan Pro 167.99.44.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

30 Requests

77 %HTTPS

25 %IPv6

7 Domains

10 Subdomains

4 IPs

2 Countries

1216 kBTransfer

2726 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

5 Cookies

login.barryxxywor.com Open in urlscan Pro
167.99.44.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

77 %
HTTPS

25 %
IPv6

7
Domains

10
Subdomains

4
IPs

2
Countries

1216 kB
Transfer

2726 kB
Size

5
Cookies

30 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!