mail-airforce-lk.sl-airforce-lk.workers.dev Open in urlscan Pro
188.114.96.3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Submission Tags: @phish_report
Submission: On May 14 via api (May 14th 2024, 1:43:57 am UTC) from FI — Scanned from NL

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is mail-airforce-lk.sl-airforce-lk.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on May 13th 2024. Valid for: 3 months.

This is the only time mail-airforce-lk.sl-airforce-lk.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	172.67.149.56 172.67.149.56	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	3

2 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

mail-airforce-lk.sl-airforce-lk.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 172.67.149.56 (United States)

ASN13335 (CLOUDFLARENET, US)

mail.airforce.lk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	airforce.lk mail.airforce.lk	56 KB
2	workers.dev mail-airforce-lk.sl-airforce-lk.workers.dev	3 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 804	7 KB
16	3

	Domain	Requested by
13	mail.airforce.lk	mail-airforce-lk.sl-airforce-lk.workers.dev mail.airforce.lk
2	mail-airforce-lk.sl-airforce-lk.workers.dev	static.cloudflareinsights.com
1	static.cloudflareinsights.com	mail-airforce-lk.sl-airforce-lk.workers.dev
16	3

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid
sl-airforce-lk.workers.dev GTS CA 1P5	`2024-05-13` - `2024-08-11`	3 months	crt.sh
airforce.lk GTS CA 1P5	`2024-05-02` - `2024-07-31`	3 months	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-05-08` - `2024-08-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Frame ID: 509C0E7644D795B8900827F0AAB588DF
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web App

Detected technologies

Outlook Web App (Web Mail) Expand

Overall confidence: 100%
Detected patterns

<link\s[^>]*href="[^"]*?([\d.]+)/themes/resources/owafont\.css

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

16
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

66 kB
Transfer

83 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?LinkID=129362
Title: click here.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request login Show response
mail-airforce-lk.sl-airforce-lk.workers.dev/api/ 8 KB
3 KB 50ms
26ms Document
text/html 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d70ae7d016cc436d6469fea3d2b674fb5ec0efa7008d4934111f8a56baa247e

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8837332a6b456694-AMS
content-encoding: br
content-type: text/html
date: Tue, 14 May 2024 01:43:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O%2BeUZZbkw1NzyrPVNwUdVd4OVgZSexhF7%2FQrmBX%2B4wZLI2BbXsTnhAdfQn3CulYAAAbelSIn8gQB4W12N1tMXC84ZRYrC7RLDdOCfzHRfpuakBf2ZJuytwez7GSNoYC1O1Mvcs6opmlEoyoCcoSMnl5uMv%2BTiEAlKzI58%2Fen"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 logon.css
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 2 KB
1 KB 260ms
237ms Stylesheet
text/css 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 843d1de5dc833f8d30a6434264d495ced8f2274811d236d2f3db493e6d7681df

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:52 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Fri, 03 May 2013 11:41:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"fde43c29f347ce1:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2BfMZSeKntlKM6Y9tnRjMq8W%2Fy8O5nKyRRVh0rjGX7cYSQlcCP%2BRHyKBEUden3jI7ApNVzPcaHapP1%2FVaJWM20DC82x%2BdRSJrQSUOPlXCFZBIbvPK6%2FLSjfBhRrMgChHiGUe"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public,max-age=2592000
cf-ray: 8837332aba911cc6-AMS
alt-svc: h3=":443"; ma=86400
priority: u=0,i=?0

GET
H3 200 owafont.css
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 5 KB
2 KB 263ms
239ms Stylesheet
text/css 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/owafont.css
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:52 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Tue, 05 Feb 2013 17:30:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"067f987c63ce1:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkFPgsrDPnALYVFA5QdfpeLkZZeRho7x%2FABpyf8Y1RNP%2Ft1gf1birbJ7S9k1OU%2FAVAwoB%2FcZ7x3COF%2FN9QKLE%2FIIomXFFRJ8FSG2YlrWUUlgWarIcjs3PnhiwVOx6LY4XwKY"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public,max-age=2592000
cf-ray: 8837332aba921cc6-AMS
alt-svc: h3=":443"; ma=86400
priority: u=0,i=?0

GET
H3 200 flogon.js Show response
mail.airforce.lk/owa/14.3.319.2/scripts/premium/ 4 KB
2 KB 261ms
238ms Script
application/x-javascript 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.airforce.lk/owa/14.3.319.2/scripts/premium/flogon.js
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:52 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Wed, 07 Sep 2016 09:14:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"0ed6344e88d21:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O7iP666O4%2BV5cxkhfJrkOesZ1%2FUQLIG2Za5b5gasCeTN1YRVcFtsJgn7RQedWB0txFJLNYSiEJZEJaoLjcEc0aKU2n%2B7MWk%2FeSE3IrtozUDBDaUJzjxuoHidzX%2FT%2ByMvzrDb"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: public,max-age=2592000
cf-ray: 8837332aba8f1cc6-AMS
alt-svc: h3=":443"; ma=86400
priority: u=1,i=?0

GET
H3 200 lgntopl.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 12 KB
13 KB 244ms
221ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgntopl.gif
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: eeaf80e630285b8742c5d1231eb871c72cdcfc38fb759ba8a7a6a312d26eeac1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:52 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 12717
last-modified: Tue, 27 Mar 2012 10:33:28 GMT
server: cloudflare
etag: "08cac5ccd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1lp2R1r24EiFilGJcjrPdmjJQens83okUEqyxI6yquTe5w6H4XwTU94ocZK3lUVxIfQ%2FztK%2BGW%2FltU6iptcUJ6mVa7Lr8NXNWBQ23J72Nda%2B1ioM9Wt0ZF1wJiGCheNXYzXh"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332aba901cc6-AMS
priority: u=2,i

GET
H3 200 lgntopr.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 2 KB
3 KB 281ms
258ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgntopr.gif
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 77bdb749feb3b2871563093e2185bf50e10cfab8f7953e99e373dd573ecd5903

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:52 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 2380
last-modified: Fri, 23 Mar 2012 09:55:30 GMT
server: cloudflare
etag: "0559814db8cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=21KN7uCL584zrvhO4dwaemUHiiO6XFJqj7z8rHPZWzrXaW5yb4kc4LLzilUaiDmkxYcWJWgLSp7ukvV9r%2FksPmdDhpJ7Pya2qY6fuL91hBmMeK%2FHriiJX3b8tDIycBv4yEHT"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332aba8e1cc6-AMS
priority: u=2,i

GET
H3 200 lgnexlogo.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 841 B
1 KB 282ms
281ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnexlogo.gif
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 4ed581c18762d9b865e62d582979b26226bbdf56137b93005d1af6e7e73c8512

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 841
last-modified: Sat, 04 Mar 2017 10:42:13 GMT
server: cloudflare
etag: "75cc3fbd394d21:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XftN3r3YIIwZgxYf4veRXgBDMxA43XnPRLsQSErermwa8vz83cm3DKdCnfc%2B6bNjgvMeH8ZVf%2FVMxinSaGFIcqe7uj%2BFTZfHAoiTDTXY%2FhIfZfAbfZWof9GbrzV74wtFxXmj"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b1e1cc6-AMS
priority: u=2,i

GET
H3 200 lgnbotl.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 23 KB
23 KB 264ms
263ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnbotl.gif
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 732efb3f5df1ca7e12f6308e1d59eeb77af291174004c2135ff907832339b102

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 23124
last-modified: Fri, 23 Mar 2012 10:32:34 GMT
server: cloudflare
etag: "0cd3342e08cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9E7cl5uI2d9iNCxmipoRB4wrBgDjd4tr4g6UwVSDz6F6HfUHk6xPl1ZXk9mllSz7hlchEkNJwuQlsqvHiy8qNREEteUhjlvhY9xbkYO1GMJhENEHdGJfW4TMl%2BwzsQ2lnpG"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b1f1cc6-AMS
priority: u=2,i

GET
H3 200 lgnbotr.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 4 KB
4 KB 279ms
279ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnbotr.gif
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 4407859ec7901e8020b9bdf557101222ee098b34da893d6a880e4bfd7b25e157

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 3776
last-modified: Fri, 23 Mar 2012 10:31:02 GMT
server: cloudflare
etag: "0b75dbe08cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FYKNJxI3tOTdzL5dEz4zQHk31eT99jhDTe4n1sEpXGUyl%2FXXmwNOVhTxbbdZ1M4fe9Qt3UWP7tSi9PveUURzj2bL74nD2c9ds0%2F%2BOe9st7EvZxg68Y6Opp0fBYGixemMmnR2"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b201cc6-AMS
priority: u=2,i

GET
H2 200 v55bfa2fee65d44688e90c00735ed189a1713218998793 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 88ms
52ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793
Requested by: Host: mail-airforce-lk.sl-airforce-lk.workers.dev
URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17106bf803d42bcf2f2bdf778ece084d3f91c68e7ea41dae7bff61fefa573dee

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Origin: https://mail-airforce-lk.sl-airforce-lk.workers.dev
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
content-encoding: gzip
last-modified: Mon, 06 May 2024 19:01:13 GMT
server: cloudflare
etag: W/"2024.4.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8837332c7a495c3a-AMS

GET
H3 200 lgntopm.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 501 B
1 KB 280ms
279ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgntopm.gif
Requested by: Host: mail.airforce.lk
URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 69ee68e79ca0e135459cf435e243fde4558458475de9ae748493f482af66e3a9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 501
last-modified: Fri, 23 Mar 2012 09:53:20 GMT
server: cloudflare
etag: "0e81bc7da8cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V20OJZJpP23APiT3wMoKtLUWvnjfRhH%2Fgmw4BmABqZ9sioobc2HFom2EcujSEuPfucigT%2FaEs2ohdWYuMfTcFurPR6b9GPbrJ82u1fudsmiLNhAY64dLjYTQww1xw8K6bZ98"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b211cc6-AMS
priority: u=3,i

GET
H3 200 lgnleft.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 465 B
1011 B 262ms
262ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnleft.gif
Requested by: Host: mail.airforce.lk
URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f7c7299439660c248f51d73aeaa6f659edb0b4159a02260f571fa6d1c0bffe47

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 465
last-modified: Fri, 23 Mar 2012 10:01:54 GMT
server: cloudflare
etag: "0157af9db8cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=clzB%2FETL%2BoVxdwzgaTlMxFagF9c3sr5WDizFDJs%2FCMy9FZ2P6ZLGcbhO4GHy7zjRohgf5eZG3ILrABonv2VK4tFmLugtQfEfOOmCKaGTjkbUNMohH6y1eNZp8BC%2FLM65W%2F%2BP"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b221cc6-AMS
priority: u=3,i

GET
H3 200 lgnright.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 510 B
1 KB 242ms
242ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnright.gif
Requested by: Host: mail.airforce.lk
URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 667bfe91e87f17a493f17d6f0bcbcac664b66936ce61210da93c009532e97587

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 510
last-modified: Fri, 23 Mar 2012 09:56:30 GMT
server: cloudflare
etag: "09b5b38db8cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VuO6rNqsRsigS0IYsdrY%2BAyd37x99dnaC%2FqY5GKaYwEugHJmhvRPcCR13ug7gYCJSxXayv%2BBQNT6z3%2FYbk1zIlm4154lrWvLeVGel2arlh30mU%2F7GwYhf0zD01T9YvXtRgI3"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b231cc6-AMS
priority: u=3,i

GET
H3 200 lgnbotm.gif
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 521 B
1 KB 279ms
279ms Image
image/gif 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/lgnbotm.gif
Requested by: Host: mail.airforce.lk
URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e82172c3d476f5c9a7d2f5d6cb3f91046c05a342db007e89f5ec1f08d90e0a59

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/logon.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400
content-length: 521
last-modified: Fri, 23 Mar 2012 10:31:50 GMT
server: cloudflare
etag: "0eff927e08cd1:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SeK5i9GqQkdt%2Bp48lwLCoIY%2FGRk1bGo1C8yglrlL%2BKdNxxqYTf3WjqM3%2B8ee2bmidYpMKavyb%2FVRn4HoRKb%2B9pyJK7qps6IKc0ULC8AhMyOipPb0HgyKzE7UZb0by16REUBg"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: public,max-age=2592000
accept-ranges: bytes
cf-ray: 8837332c3b241cc6-AMS
priority: u=3,i

POST
H3 200 rum Show response
mail-airforce-lk.sl-airforce-lk.workers.dev/cdn-cgi/ 0
72 B 20ms
20ms XHR
text/plain 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mail-airforce-lk.sl-airforce-lk.workers.dev/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8837332e0cc36694-AMS
x-frame-options: DENY

GET
H3 200 favicon.ico
mail.airforce.lk/owa/14.3.319.2/themes/resources/ 1 KB
1 KB 224ms
224ms Other
image/x-icon 172.67.149.56
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.airforce.lk/owa/14.3.319.2/themes/resources/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.149.56 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5da848038d64010b8db534237332cf0386d601e5f538362c73aae8ae6f1cf348

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mail-airforce-lk.sl-airforce-lk.workers.dev/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 01:43:53 GMT
content-encoding: br
cf-cache-status: BYPASS
last-modified: Sat, 24 Mar 2012 09:53:11 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1253a8eca39cd1:0"
x-powered-by: ASP.NET
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xoeDOS1lYNQA2NR1djmpql7YxrYPzQcT27moD1%2FaLr1%2FVTyqpNZW0KTEKBodzyEqp7%2BH9%2BVZePfEBvYk%2F9fEqxlrKzNhMB%2BMTqoPDEtG5P%2B%2B0gRuYlyQi9bPRlhQKuLLAt%2BM"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: public,max-age=2592000
cf-ray: 8837332e0bfd1cc6-AMS
alt-svc: h3=":443"; ma=86400
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mail-airforce-lk.sl-airforce-lk.workers.dev/api	1969-12-31 23:59:59	Name: cookieTest Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://mail-airforce-lk.sl-airforce-lk.workers.dev/api/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail-airforce-lk.sl-airforce-lk.workers.dev
mail.airforce.lk
static.cloudflareinsights.com
172.67.149.56
188.114.96.3
2606:4700::6810:5049
17106bf803d42bcf2f2bdf778ece084d3f91c68e7ea41dae7bff61fefa573dee
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060
4407859ec7901e8020b9bdf557101222ee098b34da893d6a880e4bfd7b25e157
4ed581c18762d9b865e62d582979b26226bbdf56137b93005d1af6e7e73c8512
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
5da848038d64010b8db534237332cf0386d601e5f538362c73aae8ae6f1cf348
667bfe91e87f17a493f17d6f0bcbcac664b66936ce61210da93c009532e97587
69ee68e79ca0e135459cf435e243fde4558458475de9ae748493f482af66e3a9
732efb3f5df1ca7e12f6308e1d59eeb77af291174004c2135ff907832339b102
77bdb749feb3b2871563093e2185bf50e10cfab8f7953e99e373dd573ecd5903
7d70ae7d016cc436d6469fea3d2b674fb5ec0efa7008d4934111f8a56baa247e
843d1de5dc833f8d30a6434264d495ced8f2274811d236d2f3db493e6d7681df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e82172c3d476f5c9a7d2f5d6cb3f91046c05a342db007e89f5ec1f08d90e0a59
eeaf80e630285b8742c5d1231eb871c72cdcfc38fb759ba8a7a6a312d26eeac1
f7c7299439660c248f51d73aeaa6f659edb0b4159a02260f571fa6d1c0bffe47

mail-airforce-lk.sl-airforce-lk.workers.dev Open in urlscan Pro 188.114.96.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

66 kBTransfer

83 kBSize

1 Cookies

1 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

mail-airforce-lk.sl-airforce-lk.workers.dev Open in urlscan Pro
188.114.96.3 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

66 kB
Transfer

83 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions