gu98fwrbbpgzgwbbxirvew.on.drv.tw Open in urlscan Pro
47.251.10.111  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/	7 KB 3 KB	5117ms 1150ms	Document text/html	47.251.10.111 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 47.251.10.111 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 92ef2966b97fb3ec0ec225c3246cd8f9c56cfd30652e918ed2a8d7ce15454902 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control public, s-maxage=43200, max-age=43200 content-encoding gzip content-type text/html date Thu, 18 Apr 2024 05:15:42 GMT last-modified Wed, 30 Aug 2023 06:52:53 GMT server nginx/1.14.0 (Ubuntu) vary Origin, Sec-Fetch-Mode, X-Requested-Wtih Accept-Encoding x-cache MISS
GET H3	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/	158 KB 25 KB	123ms 59ms	Stylesheet text/css	104.16.89.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/bootstrap.min.css Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:43 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 6845392 x-jsd-version 4.6.1 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230108-FRA, cache-lga21926-LGA x-jsd-version-type version server cloudflare etag W/"278e1-H7g/xZXPKL+TYth2EOrfo7e7vlk" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jg9DXt2977P7PNpcUPCoWZENs8ht%2B9qw0iD%2BZ1805DfN37jGi3IupbvZpejMuge5RHS95kduYMQLexE9JuVIRoi%2BdADHNvWfZYC8ijFWzCb778Z5Znn1ORv4PUYQgs9tUJw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 87622dbace7a34af-WAW
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	133ms 38ms	Script text/javascript	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 17 Apr 2024 05:38:51 GMT content-encoding gzip x-content-type-options nosniff age 85012 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 17 Apr 2025 05:38:51 GMT
GET H3	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/	21 KB 8 KB	221ms 156ms	Script application/javascript	104.16.89.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:43 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 6007681 x-jsd-version 1.16.1 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-etou8220021-FRA, cache-lga21953-LGA x-jsd-version-type version server cloudflare etag W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=01dNF5BUpWVGEQeqqHcDNVc3SCJ8zlA3O3LeOiqtUqqePr5EqRogu%2FloaluNX3X0mUq7BhAGuATpKfJiX245zpzu0BsWXnBveG3%2Bc7xHOuNpm5Lvu7tXLrPpjgUBEwvsJpc%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 87622dbace7e34af-WAW
GET H3	200	bootstrap.bundle.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/js/	81 KB 23 KB	172ms 109ms	Script application/javascript	104.16.89.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/js/bootstrap.bundle.min.js Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.89.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e02c082fedfc821a8a51fe004dab6896dd928876a21ccac8675142c2e2f7b1f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:43 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 14522115 x-jsd-version 4.6.1 content-encoding br x-cache HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230108-FRA x-jsd-version-type version server cloudflare etag W/"14535-A2PLWLentg73+/gri862MFIyUBo" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2nJ1hPWDtUWcjY80qM%2BJfxy%2BdC0zqSrZCwJr7qoid%2BSacFUSddt%2FbkJZHs0rpUDO8M6WjPmpWqJMfHqxJ2gdf%2BP4GEmDpSWcLWA5ylc%2Fi4wkYzGTZ2oeh3X9LbUlwZBBpY%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 87622dbace7c34af-WAW
GET H2	200	wd.js Show response www.drv.tw/inc/	690 B 841 B	815ms 97ms	Script text/javascript	20.50.153.39 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.drv.tw/inc/wd.js?s=gu98fwrbbpgzgwbbxirvew Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 20.50.153.39 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:43 GMT content-encoding br referrer-policy same-origin strict-transport-security max-age=10886400; includeSubDomains; preload last-modified Tue, 20 Feb 2024 14:16:48 GMT x-content-type-options nosniff etag "76615853" vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type text/javascript access-control-allow-origin * cache-control public, must-revalidate, max-age=30 x-dns-prefetch-control off x-xss-protection 1; mode=block
GET H2	200	we.png cdn.glitch.global/5c3a0ca4-2f1d-4648-a4b7-e36a7ad90152/	152 KB 152 KB	131ms 38ms	Image image/png	151.101.66.132 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.global/5c3a0ca4-2f1d-4648-a4b7-e36a7ad90152/we.png?v=1670830144657 Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.132 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 5e0f82399f23187394230ddc9e545d7377ad6e4f0065993b430478a97802d43d Security Headers Name Value Content-Security-Policy script-src 'none' Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none' via 1.1 varnish, 1.1 varnish date Thu, 18 Apr 2024 05:15:43 GMT x-amz-request-id YEC1VAD6GCSMFQK7 age 992740 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 155148 x-amz-id-2 AGtxT0+a1v00vu0bkGIi5k43OsCNg+Ur5/Mow5UQORpCzdA7wZgR2Yuf7eEHBEHjYM+Qo12LOFI= x-served-by cache-iad-kcgs7200045-IAD, cache-fra-etou8220155-FRA last-modified Mon, 12 Dec 2022 07:29:03 GMT server AmazonS3 x-timer S1713417343.463202,VS0,VE1 etag "280e99e4dda937a5c0a73f2baa046430" access-control-allow-methods GET, HEAD, POST content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-cache-hits 50, 0
GET H2	200	js Show response www.googletagmanager.com/gtag/	142 KB 54 KB	141ms 52ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Requested by Host: www.drv.tw URL: https://www.drv.tw/inc/wd.js?s=gu98fwrbbpgzgwbbxirvew Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bac2c662e52fdb7474fc5cf9111c28e16539c9c63aaf124e6a953ead7c971ad1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 55254 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Apr 2024 05:15:44 GMT
GET H2	200	to.png cdn.glitch.global/5c3a0ca4-2f1d-4648-a4b7-e36a7ad90152/	22 KB 22 KB	38ms 37ms	Image image/png	151.101.66.132 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.glitch.global/5c3a0ca4-2f1d-4648-a4b7-e36a7ad90152/to.png?v=1670830146465 Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.132 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 7c8ec4ef64a3fbcecbc42dfd589c56a07c3b32224b5ad175d80fba8fc8460a6c Security Headers Name Value Content-Security-Policy script-src 'none' Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy script-src 'none' via 1.1 varnish, 1.1 varnish date Thu, 18 Apr 2024 05:15:43 GMT x-amz-request-id TQGYHCJY1ZHAV1HA age 943247 x-amz-server-side-encryption AES256 x-cache HIT, HIT content-length 22624 x-amz-id-2 ntgQDnJSxkx2dNn02kkEJcPvDCU0UenzQHTvAfFtexWTmoDYQo/UIo5/NIpGxsGyTk3VWsdPZe0= x-served-by cache-iad-kcgs7200133-IAD, cache-fra-etou8220155-FRA last-modified Mon, 12 Dec 2022 07:29:05 GMT server AmazonS3 x-timer S1713417344.918924,VS0,VE1 etag "ea1500fd602726f63bab1effa5b90085" access-control-allow-methods GET, HEAD, POST content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-cache-hits 16, 0
GET H2	200	js Show response www.googletagmanager.com/gtag/	237 KB 86 KB	56ms 56ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-NBGQJBJMEG&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0e5c8a4bbb085c449c6c9d459c60f5e2b6113cad2733622aeaa6b1685be85ef7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 88394 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Apr 2024 05:15:44 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	307 KB 101 KB	80ms 80ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-LHL0SH0Z7S&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0b2396ea780de60fcb1ae8fe8b99b66a37e25cda8d2a8e0ecedd1a19e85866a5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 103143 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 18 Apr 2024 05:15:44 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	126ms 41ms	Script text/javascript	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 18 Apr 2024 03:39:22 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 5782 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 18 Apr 2024 05:39:22 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 268 B	134ms 44ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-NBGQJBJMEG&gtm=45je44f0za200&_p=1713417343898&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=965469232.1713417344&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1713417344&sct=1&seg=0&dl=https%3A%2F%2Fgu98fwrbbpgzgwbbxirvew.on.drv.tw%2Fwww.almarekresins.com%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=6305 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-NBGQJBJMEG&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 18 Apr 2024 05:15:44 GMT server Golfe2 content-type text/plain access-control-allow-origin https://gu98fwrbbpgzgwbbxirvew.on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 259 B	138ms 46ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-LHL0SH0Z7S&gtm=45je44f0v898224655za200&_p=1713417343898&_gaz=1&gcd=13l3lPl2l1&npa=1&dma_cps=sypham&dma=1&cid=965469232.1713417344&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.60%7CGoogle%2520Chrome%3B124.0.6367.60%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1713417344&sct=1&seg=0&dl=https%3A%2F%2Fgu98fwrbbpgzgwbbxirvew.on.drv.tw%2Fwww.almarekresins.com%2F&dt=&en=page_view&_fv=1&_ss=1&tfd=6326 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-LHL0SH0Z7S&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 18 Apr 2024 05:15:44 GMT server Golfe2 content-type text/plain access-control-allow-origin https://gu98fwrbbpgzgwbbxirvew.on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 47 B	143ms 48ms	Ping text/plain	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-LHL0SH0Z7S&cid=965469232.1713417344&gtm=45je44f0v898224655za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-LHL0SH0Z7S&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 18 Apr 2024 05:15:44 GMT server Golfe2 content-type text/plain access-control-allow-origin https://gu98fwrbbpgzgwbbxirvew.on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	104ms 52ms	Image image/gif	142.250.186.35 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-LHL0SH0Z7S&cid=965469232.1713417344&gtm=45je44f0v898224655za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3lPl2l1&npa=1&z=876163434 Requested by Host: gu98fwrbbpgzgwbbxirvew.on.drv.tw URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.35 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 18 Apr 2024 05:15:44 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 221 B	46ms 45ms	XHR text/plain	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1250109863&t=pageview&_s=1&dl=https%3A%2F%2Fgu98fwrbbpgzgwbbxirvew.on.drv.tw%2Fwww.almarekresins.com%2F&ul=de-de&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=764857492&gjid=1880711469&cid=965469232.1713417344&tid=UA-85417367-1&_gid=554614461.1713417344&_r=1&gtm=457e44f0za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&jsscut=1&npa=1&z=1194272107 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 18 Apr 2024 05:15:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://gu98fwrbbpgzgwbbxirvew.on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 360 B	88ms 47ms	XHR text/plain	2a00:1450:400c:c00::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-85417367-1&cid=965469232.1713417344&jid=764857492&gjid=1880711469&_gid=554614461.1713417344&npa=1&_u=YADAAUAAAAAAACAAI~&z=914249431 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-platform "Win32" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 18 Apr 2024 05:15:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://gu98fwrbbpgzgwbbxirvew.on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	404	favicon.ico gu98fwrbbpgzgwbbxirvew.on.drv.tw/	2 KB 1 KB	188ms 188ms	Other text/html	47.251.10.111 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 47.251.10.111 Santa Clara, United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash ab04ea00add135d1972e76d4ca04beb8e497bf72554c2ab074ec4470cf81d319 Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 18 Apr 2024 05:15:44 GMT cache-control public, s-maxage=604800, max-age=604800 content-encoding gzip server nginx/1.14.0 (Ubuntu) content-type text/html

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Popper object| bootstrap function| gtag object| dataLayer function| _0xefd5eb function| _0x36f4 function| _0x786a object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			gu98fwrbbpgzgwbbxirvew.on.drv.tw/	1969-12-31 23:59:59	Name: uid Value: rBI/+mYgrH6NzitaV+j5Ag==
			.drv.tw/	1970-01-21 05:32:57	Name: _ga Value: GA1.2.965469232.1713417344
			.drv.tw/	1970-01-20 19:58:23	Name: _gid Value: GA1.2.554614461.1713417344
			.drv.tw/	1970-01-20 19:56:57	Name: _gat_gtag_UA_85417367_1 Value: 1
			.drv.tw/	1970-01-21 05:32:57	Name: _ga_LHL0SH0Z7S Value: GS1.1.1713417344.1.0.1713417344.60.0.0
			.drv.tw/	1970-01-21 05:32:57	Name: _ga_NBGQJBJMEG Value: GS1.1.1713417344.1.0.1713417344.0.0.0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/www.almarekresins.com/#sebastiaan%40bobbink.org Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://gu98fwrbbpgzgwbbxirvew.on.drv.tw/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.glitch.global
cdn.jsdelivr.net
gu98fwrbbpgzgwbbxirvew.on.drv.tw
region1.analytics.google.com
region1.google-analytics.com
stats.g.doubleclick.net
www.drv.tw
www.google-analytics.com
www.google.de
www.googletagmanager.com
104.16.89.20
142.250.186.35
151.101.66.132
20.50.153.39
2001:4860:4802:32::36
2a00:1450:4001:808::200a
2a00:1450:4001:811::2008
2a00:1450:4001:82f::200e
2a00:1450:400c:c00::9c
47.251.10.111
0b2396ea780de60fcb1ae8fe8b99b66a37e25cda8d2a8e0ecedd1a19e85866a5
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
0e5c8a4bbb085c449c6c9d459c60f5e2b6113cad2733622aeaa6b1685be85ef7
4f33b00ff60ba75c03cfd1a1a5d0be37fb7bba6718ef54bf9898a53e1c72f87f
5e0f82399f23187394230ddc9e545d7377ad6e4f0065993b430478a97802d43d
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7c8ec4ef64a3fbcecbc42dfd589c56a07c3b32224b5ad175d80fba8fc8460a6c
7e02c082fedfc821a8a51fe004dab6896dd928876a21ccac8675142c2e2f7b1f
92ef2966b97fb3ec0ec225c3246cd8f9c56cfd30652e918ed2a8d7ce15454902
ab04ea00add135d1972e76d4ca04beb8e497bf72554c2ab074ec4470cf81d319
bac2c662e52fdb7474fc5cf9111c28e16539c9c63aaf124e6a953ead7c971ad1
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f