f002.backblazeb2.com Open in urlscan Pro
206.190.215.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source
Effective URL:
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Submission Tags: falconsandbox
Submission: On October 13 via api (October 13th 2021, 6:09:28 pm UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 12 IPs in 4 countries across 13 domains to perform 18 HTTP transactions. The main IP is 206.190.215.16, located in and belongs to . The main domain is f002.backblazeb2.com.
TLS certificate: Issued by R3 on September 30th 2021. Valid for: 3 months.

This is the only time f002.backblazeb2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 2	37.10.71.204 37.10.71.204	212228 (SERVINGA-UK) (SERVINGA-UK)
1 3	66.235.200.113 66.235.200.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:67c:4e8:... 2001:67c:4e8:1033:3:100:0:a	62041 (TELEGRAM) (TELEGRAM)
1 1	18.66.97.88 18.66.97.88	16509 (AMAZON-02) (AMAZON-02)
1 1	5.181.218.64 5.181.218.64	47583 (AS-HOSTINGER) (AS-HOSTINGER)
2	206.190.215.16 206.190.215.16	() ()
3	2606:4700::68... 2606:4700::6812:bcf	() ()
1	2a00:1450:400... 2a00:1450:4001:82b::200a	() ()
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	() ()
1	2606:4700::68... 2606:4700::6810:135e	() ()
1	2a00:1450:400... 2a00:1450:4001:828::200a	() ()
1	2606:4700::68... 2606:4700::6810:5614	() ()
2	51.91.224.95 51.91.224.95	() ()
1	2600:9000:223... 2600:9000:223c:c200:6:4afb:9140:93a1	() ()
18	12

2 37.10.71.204 (Manchester, United Kingdom) 1 redirects

ASN212228 (SERVINGA-UK, DE)

gate.xn--k1ahm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 66.235.200.113 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)
PTR: host77.ipowerweb.com

irr.ykf.mybluehostin.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:67c:4e8:1033:3:100:0:a (Iwkowa, Poland)

ASN62041 (TELEGRAM, VG)

api.telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.88 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

walmart.onelink.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.181.218.64 (Germany) 1 redirects

ASN47583 (AS-HOSTINGER, CY)

xn--80asucf0d.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 206.190.215.16 (None, )

ASN- ()

f002.backblazeb2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:bcf (None, )

ASN- ()

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (None, )

ASN- ()

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:3b (None, )

ASN- ()

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (None, )

ASN- ()

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (None, )

ASN- ()

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (None, )

ASN- ()

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.91.224.95 (None, )

ASN- ()

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:c200:6:4afb:9140:93a1 (None, )

ASN- ()

cdn.mcauto-images-production.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bootstrapcdn.com stackpath.bootstrapcdn.com maxcdn.bootstrapcdn.com	53 KB
3	mybluehostin.me 1 redirects irr.ykf.mybluehostin.me	17 KB
2	postimg.cc i.postimg.cc	7 KB
2	jquery.com code.jquery.com	53 KB
2	googleapis.com fonts.googleapis.com ajax.googleapis.com	31 KB
2	backblazeb2.com f002.backblazeb2.com	135 KB
2	xn--k1ahm.com 1 redirects gate.xn--k1ahm.com	29 KB
1	sendgrid.net cdn.mcauto-images-production.sendgrid.net	17 KB
1	jsdelivr.net cdn.jsdelivr.net	1 KB
1	cloudflare.com cdnjs.cloudflare.com	7 KB
1	xn--80asucf0d.com 1 redirects xn--80asucf0d.com	516 B
1	onelink.me 1 redirects walmart.onelink.me	301 B
1	telegram.org api.telegram.org	843 B
18	13

	Domain	Requested by
3	irr.ykf.mybluehostin.me	1 redirects gate.xn--k1ahm.com irr.ykf.mybluehostin.me
2	i.postimg.cc	f002.backblazeb2.com
2	code.jquery.com	f002.backblazeb2.com
2	stackpath.bootstrapcdn.com	f002.backblazeb2.com
2	f002.backblazeb2.com	gate.xn--k1ahm.com f002.backblazeb2.com
2	gate.xn--k1ahm.com	1 redirects
1	cdn.mcauto-images-production.sendgrid.net	f002.backblazeb2.com
1	cdn.jsdelivr.net	f002.backblazeb2.com
1	ajax.googleapis.com	f002.backblazeb2.com
1	maxcdn.bootstrapcdn.com	f002.backblazeb2.com
1	cdnjs.cloudflare.com	f002.backblazeb2.com
1	fonts.googleapis.com	f002.backblazeb2.com
1	xn--80asucf0d.com	1 redirects
1	walmart.onelink.me	1 redirects
1	api.telegram.org	gate.xn--k1ahm.com
18	15

This site contains no links.

Subject Issuer	Validity	Valid
xn--k1ahm.com R3	`2021-10-11` - `2022-01-09`	3 months	crt.sh
mail.irr.ykf.mybluehostin.me R3	`2021-08-27` - `2021-11-25`	3 months	crt.sh
api.telegram.org Go Daddy Secure Certificate Authority - G2	`2020-03-24` - `2022-05-23`	2 years	crt.sh
backblazeb2.com R3	`2021-09-30` - `2021-12-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
postimg.cc R3	`2021-09-30` - `2021-12-29`	3 months	crt.sh
cdn.mcauto-images-production.sendgrid.net Amazon	`2021-06-18` - `2022-07-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Frame ID: 2792B1A1DEF556376A6E795FCA278B49
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source Page URL
https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a&pid=my_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source Page URL
https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Br... HTTP 302
https://xn--80asucf0d.com/11/?list HTTP 302
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout... Page URL

Page Statistics

18
Requests

100 %
HTTPS

57 %
IPv6

13
Domains

15
Subdomains

12
IPs

4
Countries

352 kB
Transfer

789 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source Page URL
https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a&pid=my_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source Page URL
https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Broom-Dustpan-Mini-Sweeper-Real-Working-broom-Mini-Sweeper-Clicks-Dustpan-Easy-Storage-True-Montesso/803538461&af_web_dp=https://xn--80asucf0d.com/11/?list HTTP 302
https://xn--80asucf0d.com/11/?list HTTP 302
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source HTTP 302
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a&pid=my_media_source HTTP 301
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
gate.xn--k1ahm.com/ 72 KB
29 KB 291ms
206ms Document
text/html 37.10.71.204
SERVINGA-UK

General

Check archive.org

Show headers Download Go to

Full URL

https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.10.71.204 Manchester, United Kingdom, ASN212228 (SERVINGA-UK, DE),

Reverse DNS

Software

nginx/1.17.10 /

Resource Hash

03e8e61a2cda8bbaddfd7f724cb63be74b1c35314969a17837a81eec3024506f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: gate.xn--k1ahm.com
:scheme: https
:path: /?shortlink=39726f4a&pid=my_media_source
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx/1.17.10
date: Wed, 13 Oct 2021 18:09:23 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2

200

/
irr.ykf.mybluehostin.me/a/
Redirect Chain

https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source
https://irr.ykf.mybluehostin.me/a?shortlink=39726f4a&pid=my_media_source
https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source

59 B
162 B

20ms
20ms

Document
text/html

66.235.200.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source
Requested by: Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.235.200.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS: host77.ipowerweb.com
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: irr.ykf.mybluehostin.me
:scheme: https
:path: /a/?shortlink=39726f4a&pid=my_media_source
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://gate.xn--k1ahm.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source

Response headers

date: Wed, 13 Oct 2021 18:09:24 GMT
content-type: text/html
last-modified: Tue, 12 Oct 2021 22:20:29 GMT
cf-cache-status: HIT
age: 979
expires: Wed, 13 Oct 2021 22:09:24 GMT
cache-control: public, max-age=14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 69da84cecb1a0ebb-FRA
content-encoding: gzip

Redirect headers

date: Wed, 13 Oct 2021 18:09:24 GMT
content-type: text/html; charset=iso-8859-1
location: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source
cf-cache-status: HIT
age: 979
expires: Wed, 13 Oct 2021 22:09:24 GMT
cache-control: public, max-age=14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 69da84ce8a8b0ebb-FRA

GET
H2 200 encryptx.js
irr.ykf.mybluehostin.me/a/ 51 KB
17 KB 15ms
15ms Script
application/javascript 66.235.200.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://irr.ykf.mybluehostin.me/a/encryptx.js
Requested by: Host: irr.ykf.mybluehostin.me
URL: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.235.200.113 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS: host77.ipowerweb.com
Software: cloudflare /
Resource Hash

Request headers

:path: /a/encryptx.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: irr.ykf.mybluehostin.me
referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 18:09:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 12 Oct 2021 22:20:26 GMT
server: cloudflare
age: 978
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 69da84cf0b970ebb-FRA
expires: Wed, 13 Oct 2021 22:09:24 GMT

GET
H2 200 getUpdates
api.telegram.org/bot1979842486:AAF89aRlkOwL9ElYyRXZMbl7p7AZ33IKhhg/ 596 B
843 B 49ms
14ms Fetch
application/json 2001:67c:4e8:1033:3:100:0:a
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://api.telegram.org/bot1979842486:AAF89aRlkOwL9ElYyRXZMbl7p7AZ33IKhhg/getUpdates?limit=1&offset=-1

Requested by

Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:1033:3:100:0:a Iwkowa, Poland, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 18:09:24 GMT
server: nginx/1.18.0
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection
content-length: 596

GET
H/1.1

200

Primary Request index.html Show response
f002.backblazeb2.com/file/2a080b/
Redirect Chain

https://walmart.onelink.me/UIev?&af_dp=walmart://ip/Childrens-Broom-Dustpan-Set-Laughing-Lettuce-Toy-Broom-Dustpan-Mini-Sweeper-Real-Working-broom-Mini-Sweeper-Clicks-Dustpan-Easy-Storage-True-Mont...
https://xn--80asucf0d.com/11/?list
https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv

59 B
504 B

1089ms
160ms

Document
text/html

206.190.215.16

General

Check archive.org

Show headers Download Go to

Full URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Requested by: Host: gate.xn--k1ahm.com
URL: https://gate.xn--k1ahm.com/?shortlink=39726f4a&pid=my_media_source
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 206.190.215.16 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c285af2747ea2eb548fc622eae01a1332eee6923e682ca026f7f88fc01308e64

Request headers

Host: f002.backblazeb2.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://irr.ykf.mybluehostin.me/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://irr.ykf.mybluehostin.me/a/?shortlink=39726f4a&pid=my_media_source

Response headers

x-bz-file-name: index.html
x-bz-file-id: 4_zaf3a7cddbb3d72667ec30f15_f10805eaf0fa07062_d20211012_m225151_c002_v0001163_t0049
x-bz-content-sha1: c9438ca0aa85ce6649ab0e691e460b6a5262423b
X-Bz-Upload-Timestamp: 1634079111000
Accept-Ranges: bytes
x-bz-info-src_last_modified_millis: 1633769666000
Content-Type: text/html
Content-Length: 59
Date: Wed, 13 Oct 2021 18:09:26 GMT
Keep-Alive: timeout=5
Connection: keep-alive

Redirect headers

x-powered-by: PHP/7.4.11
set-cookie: PHPSESSID=250e83dbaa2c5ab18557f25099ba3704; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
content-type: text/html; charset=UTF-8
content-length: 0
date: Wed, 13 Oct 2021 18:09:25 GMT
server: LiteSpeed
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

GET
H/1.1 200 encryptx.js Show response
f002.backblazeb2.com/file/2a080b/ 134 KB
135 KB 161ms
160ms Script
text/javascript 206.190.215.16

General

Check archive.org

Show headers Download Go to

Full URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 206.190.215.16 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04ea56df942498b0ed34fe30820c2be2a7b6491310afd06811ca59cdc315bff7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 13 Oct 2021 18:09:26 GMT
X-Bz-Upload-Timestamp: 1634079098000
x-bz-file-id: 4_zaf3a7cddbb3d72667ec30f15_f111bb5cd22440c4d_d20211012_m225138_c002_v0001163_t0056
x-bz-content-sha1: af8cca174507f677654e65a58183bc81c6089002
Content-Type: text/javascript
x-bz-file-name: encryptx.js
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 137536
x-bz-info-src_last_modified_millis: 1633990460958

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ 152 KB
25 KB 36ms
19ms Stylesheet
text/css 2606:4700::6812:bcf

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 756
age: 11599
cdn-cachedat: 08/11/2021 05:41:31
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: f6d56da1892274cd80a11f70e6b5029d
cf-ray: 69da84e56fca6967-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 1 KB
1 KB 44ms
18ms Stylesheet
text/css 2a00:1450:4001:82b::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow&displ%61y=swap

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

48288119bd915b95e80f8e26134cd694637508c594524f58b28d8e462fe718c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 18:09:27 GMT
server: ESF
date: Wed, 13 Oct 2021 18:09:27 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Wed, 13 Oct 2021 18:09:27 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 31ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3b

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-10fdd"
vary: Accept-Encoding
x-hw: 1634148567.dop101.fr8.t,1634148567.cds211.fr8.hn,1634148567.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 37ms
15ms Script
application/javascript 2606:4700::6810:135e

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 516624
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6157
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AOSBbZRYeB8T%2BpBwjwKSeR%2BRINArLuxcD8EDTDGtQdaLVutjqzOyKzTtRaCUyHDeTvls2ogD90pFRS8av8t9Wv%2FQupkrT13CRVasT7Ietp3w3V2mpFYhMXtpAJpjGs6GlDEHrQIef6VxHkrWXT2hhGvK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69da84e579106928-FRA
expires: Mon, 03 Oct 2022 18:09:27 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 37ms
15ms Script
application/javascript 2606:4700::6812:bcf

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 4370286
cdn-cachedat: 08/04/2021 00:04:37
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 46c8b4b0557e7305f5b68fb4a07d1353
cf-ray: 69da84e58a084a73-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 35ms
15ms Script
application/javascript 2001:4de0:ac18::1:a:3b

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: https://f002.backblazeb2.com/
Origin: https://f002.backblazeb2.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 17:24:41 GMT
server: nginx
etag: W/"573f4859-14e4a"
vary: Accept-Encoding
x-hw: 1634148567.dop101.fr8.t,1634148567.cds211.fr8.hn,1634148567.cds130.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 51ms
7ms Script
text/javascript 2a00:1450:4001:828::200a

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 10:12:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Thu, 13 Oct 2022 10:12:47 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 36ms
21ms Script
application/javascript 2606:4700::6812:bcf

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723, 718
age: 17701284
cdn-cachedat: 2021-03-11 11:57:52
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 48f4598378fe1b699fcee6ac68d6cc25
cf-ray: 69da84e57b291752-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 jquery.session.min.js Show response
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ 2 KB
1 KB 38ms
16ms Script
application/javascript 2606:4700::6810:5614

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js

Requested by

Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://f002.backblazeb2.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2945872
x-jsd-version: 1.0.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19171-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 69da84e58a856919-FRA

GET
H2 200 arrow.png
i.postimg.cc/bvRb8Ssy/ 217 B
460 B 66ms
15ms Image
image/png 51.91.224.95

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/bvRb8Ssy/arrow.png
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.91.224.95 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 9e35e16ed2d132b80b321b118f62deb3c448d76f31c834b5eea969ff3885369a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
last-modified: Tue, 28 Sep 2021 05:57:23 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 217
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1920x1080.jpg
cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/ 17 KB
17 KB 71ms
10ms Image
binary/octet-stream 2600:9000:223c:c200:6:4afb:9140:93a1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/1920x1080.jpg
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:c200:6:4afb:9140:93a1 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: eHVz7ZLgeDWw84BSoa4oLZl1Bdh9eOS8
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
last-modified: Wed, 11 Nov 2020 19:33:28 GMT
server: AmazonS3
age: 1096
etag: "7916a894ebde7d29c2cc29b267f1299f"
x-cache: Hit from cloudfront
content-type: binary/octet-stream
date: Wed, 13 Oct 2021 17:51:13 GMT
x-amz-replication-status: COMPLETED
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 17453
x-amz-cf-id: 6BaTI6GItgA_fhhSmdwKaXf4ylkvHJmfyBd2rnD0ORELIIRP8ydnag==

GET
H2 200 white.jpg
i.postimg.cc/cCBPp8TS/ 6 KB
7 KB 21ms
15ms Image
image/jpeg 51.91.224.95

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/cCBPp8TS/white.jpg
Requested by: Host: f002.backblazeb2.com
URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.91.224.95 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 36bdfa8963f1f6fb300e07c16253c4cf7b9bf69aca215dd532605a77c1a82483

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f002.backblazeb2.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 18:09:27 GMT
last-modified: Wed, 19 May 2021 00:02:35 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 6545
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.xn--k1ahm.com/	1970-01-20 06:41:24	Name: __xlmZ Value: 8QAS-xKRTo2zXVXL7SrBaA==
			xn--80asucf0d.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 250e83dbaa2c5ab18557f25099ba3704

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://f002.backblazeb2.com/file/2a080b/encryptx.js(Line 5873) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	warning	URL: https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv# Message: Mixed Content: The page at 'https://f002.backblazeb2.com/file/2a080b/index.html?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv#' was loaded over HTTPS, but requested an insecure element 'http://cdn.mcauto-images-production.sendgrid.net/8b418634c7860892/09ccedf3-76d3-4879-8a28-23c0e273e98a/1920x1080.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.telegram.org
cdn.jsdelivr.net
cdn.mcauto-images-production.sendgrid.net
cdnjs.cloudflare.com
code.jquery.com
f002.backblazeb2.com
fonts.googleapis.com
gate.xn--k1ahm.com
i.postimg.cc
irr.ykf.mybluehostin.me
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
walmart.onelink.me
xn--80asucf0d.com
18.66.97.88
2001:4de0:ac18::1:a:3b
2001:67c:4e8:1033:3:100:0:a
206.190.215.16
2600:9000:223c:c200:6:4afb:9140:93a1
2606:4700::6810:135e
2606:4700::6810:5614
2606:4700::6812:bcf
2a00:1450:4001:828::200a
2a00:1450:4001:82b::200a
37.10.71.204
5.181.218.64
51.91.224.95
66.235.200.113
03e8e61a2cda8bbaddfd7f724cb63be74b1c35314969a17837a81eec3024506f
04ea56df942498b0ed34fe30820c2be2a7b6491310afd06811ca59cdc315bff7
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
36bdfa8963f1f6fb300e07c16253c4cf7b9bf69aca215dd532605a77c1a82483
48288119bd915b95e80f8e26134cd694637508c594524f58b28d8e462fe718c2
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9e35e16ed2d132b80b321b118f62deb3c448d76f31c834b5eea969ff3885369a
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c285af2747ea2eb548fc622eae01a1332eee6923e682ca026f7f88fc01308e64
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

f002.backblazeb2.com Open in urlscan Pro 206.190.215.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

18 Requests

100 %HTTPS

57 %IPv6

13 Domains

15 Subdomains

12 IPs

4 Countries

352 kBTransfer

789 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

15 Console Messages

Security Headers

Indicators

f002.backblazeb2.com Open in urlscan Pro
206.190.215.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

57 %
IPv6

13
Domains

15
Subdomains

12
IPs

4
Countries

352 kB
Transfer

789 kB
Size

2
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!