urlscan.io logo urlscan.io
SecurityTrails logo

87437872793499-hchjbxbzgecsexcf.z03.azurefd.net Open in urlscan Pro
2620:1ec:bdf::45  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://784369236437992.zlatanibile.workers.dev/
Effective URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Submission: On July 04 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 20 HTTP transactions. The main IP is 2620:1ec:bdf::45, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on May 10th 2024. Valid for: a year.
This is the only time 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sendgrid (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2620:1ec:bdf::45 8075 (MICROSOFT...)
4 142.11.212.118 54290 (HOSTWINDS)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.217.207.33 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 104.17.209.240 13335 (CLOUDFLAR...)
1 34.96.67.224 396982 (GOOGLE-CL...)
2 18.158.84.108 16509 (AMAZON-02)
20 10
1    2606:4700:3035::ac43:b8fe (United States)

ASN13335 (CLOUDFLARENET, US)
784369236437992.zlatanibile.workers.dev
1    2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
4    142.11.212.118 (United States)

ASN54290 (HOSTWINDS, US)
PTR: hwsrv-1223183.hostwindsdns.com
3829743673278976348.cfd
2    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    52.217.207.33 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
uiux.s3.amazonaws.com
2    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
3    104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)
zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com
siteintercept.qualtrics.com
1    34.96.67.224 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 224.67.96.34.bc.googleusercontent.com
cdn.siftscience.com
2    18.158.84.108 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-84-108.eu-central-1.compute.amazonaws.com
sendgrid.com
Apex Domain
Subdomains		 Transfer
4 3829743673278976348.cfd
3829743673278976348.cfd
550 KB
3 qualtrics.com
zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com
siteintercept.qualtrics.com — Cisco Umbrella Rank: 828
26 KB
2 sendgrid.com
sendgrid.com — Cisco Umbrella Rank: 42917
3 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268
34 KB
2 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 70
122 B
1 siftscience.com
cdn.siftscience.com — Cisco Umbrella Rank: 12658
21 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3406
17 KB
1 amazonaws.com
uiux.s3.amazonaws.com — Cisco Umbrella Rank: 544129
4 KB
1 azurefd.net
87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
56 KB
1 workers.dev
784369236437992.zlatanibile.workers.dev
494 B
20 10
Domain Requested by
4 3829743673278976348.cfd 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
3829743673278976348.cfd
2 siteintercept.qualtrics.com zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com
siteintercept.qualtrics.com
2 sendgrid.com
2 cdnjs.cloudflare.com 3829743673278976348.cfd
2 googleads.g.doubleclick.net 3829743673278976348.cfd
1 cdn.siftscience.com 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
1 zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
1 stackpath.bootstrapcdn.com 3829743673278976348.cfd
1 uiux.s3.amazonaws.com 3829743673278976348.cfd
1 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
1 784369236437992.zlatanibile.workers.dev 1 redirects
20 11

This site contains no links.

Subject Issuer Validity Valid
*.azurefd.net
Microsoft Azure RSA TLS Issuing CA 04		 2024-05-10 -
2025-05-05		 a year crt.sh
3829743673278976348.cfd
R10		 2024-06-20 -
2024-09-18		 3 months crt.sh
*.g.doubleclick.net
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2024-04-22 -
2025-04-07		 a year crt.sh
cdnjs.cloudflare.com
E1		 2024-06-02 -
2024-08-31		 3 months crt.sh
bootstrapcdn.com
GTS CA 1P5		 2024-05-25 -
2024-08-23		 3 months crt.sh
*.qualtrics.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-03-27 -
2025-02-19		 a year crt.sh
*.siftscience.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-02-05 -
2025-01-19		 a year crt.sh
*.sendgrid.com
Go Daddy Secure Certificate Authority - G2		 2024-01-15 -
2025-02-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Frame ID: D2826A09E54A366EE430049CEDC839EA
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://784369236437992.zlatanibile.workers.dev/ HTTP 301
    https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • cdn\.sift(?:science)?\.com/s\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

85 %
HTTPS

50 %
IPv6

10
Domains

11
Subdomains

10
IPs

3
Countries

712 kB
Transfer

2439 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://784369236437992.zlatanibile.workers.dev/ HTTP 301
    https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Redirect Chain
  • https://784369236437992.zlatanibile.workers.dev/
  • https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
56 KB
56 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
340e372c9af0055e79d47d5949a42311d621b9fb21090051f196d5940d1371e9

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
content-length
57386
content-md5
5RXhWJMdKakNUI+dAiD7TQ==
content-type
text/html
date
Thu, 04 Jul 2024 22:43:21 GMT
etag
"0x8DC9C6F9FE0AE05"
last-modified
Thu, 04 Jul 2024 21:24:01 GMT
x-azure-ref
20240704T224320Z-r195c4c79d9wspsbxp4bzcgfbc00000003600000000001cq
x-cache
CONFIG_NOCACHE
x-ms-request-id
1d35dcdd-401e-0029-1563-ceae2d000000
x-ms-version
2018-03-28

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-ray
89e2a233ac6e19ad-FRA
content-length
0
date
Thu, 04 Jul 2024 22:43:20 GMT
location
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGSdthQzzl5axXVzxBO%2BVenQdhz8tYD9a1u1hJlDVtfLNsNDBvx9d8aFTvxZSETzEGS5YwOlVIKmmRg2f3fUVnRfShp6bK5wVqSJxUzHsNOml77Zeb%2FjN%2FH3PxWviO72ff%2FzCbbiYbDwWed9Vxj29s5aKbHOTIqiXFrRdDI794e4Y5q%2B7dA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
index.js
3829743673278976348.cfd/grid/ 		2 MB
474 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://3829743673278976348.cfd/grid/index.js
Requested by
Host: 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.11.212.118 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-1223183.hostwindsdns.com
Software
nginx /
Resource Hash
d47ee8395c4bc5550fcb1601d1d21fb16d1ef47aa86071074781c52832495439

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:23 GMT
Content-Encoding
gzip
Last-Modified
Thu, 04 Jul 2024 21:04:24 GMT
Server
nginx
ETag
W/"66870e58-18f889"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
tiara.css
3829743673278976348.cfd/grid/ 		24 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://3829743673278976348.cfd/grid/tiara.css
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.11.212.118 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-1223183.hostwindsdns.com
Software
nginx /
Resource Hash
c368392f31ad57937684f9479af0d4b03c90722b77cda3ac1f8ce80a241dd813

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 23 May 2024 08:33:34 GMT
Server
nginx
ETag
W/"664eff5e-60c6"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
129.c49e0d483e4298ff24d7.css
3829743673278976348.cfd/grid/ 		65 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://3829743673278976348.cfd/grid/129.c49e0d483e4298ff24d7.css
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.11.212.118 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-1223183.hostwindsdns.com
Software
nginx /
Resource Hash
04b99c2bbeba1f680e3d402a64b317d448b6bcfabe0123ab1368cfbc1b830ab2

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 23 May 2024 08:33:05 GMT
Server
nginx
ETag
W/"664eff41-102c5"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
26.4f50d9a5c773f22e4e53.css
3829743673278976348.cfd/grid/ 		383 KB
62 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://3829743673278976348.cfd/grid/26.4f50d9a5c773f22e4e53.css
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.11.212.118 , United States, ASN54290 (HOSTWINDS, US),
Reverse DNS
hwsrv-1223183.hostwindsdns.com
Software
nginx /
Resource Hash
66217c2a943648d2112ebd44053d076fcdbb1b06414118d5dec3b50208b6fc16

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:25 GMT
Content-Encoding
gzip
Last-Modified
Thu, 23 May 2024 08:32:59 GMT
Server
nginx
ETag
W/"664eff3b-5fcfa"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
container.26013ccb977c385da82e216d1d448f4bbf39435b.css
3829743673278976348.cfd/grid/ 		0
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/ 		43 B
61 B 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/?random=1600434399728&cv=9&fst=1600434399728&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=4&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapp.sendgrid.com%2Flogin&tiba=SendGrid&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 04 Jul 2024 22:43:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/ 		43 B
61 B 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/?random=1600434399796&cv=9&fst=1600434399796&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=4&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa990&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fapp.sendgrid.com%2Flogin&tiba=SendGrid&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Thu, 04 Jul 2024 22:43:23 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sg-twilio-lockup.svg
uiux.s3.amazonaws.com/logo/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uiux.s3.amazonaws.com/logo/sg-twilio-lockup.svg
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.217.207.33 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:24 GMT
x-amz-version-id
99rRhjNxC9Rz8fzHhVjTuuxhKZ_Y7bho
Last-Modified
Fri, 18 Jan 2019 20:14:00 GMT
Server
AmazonS3
x-amz-request-id
W18G2BW2R9VD43G9
ETag
"1a6735bc2e300fa20b88a325395e5590"
Content-Type
image/svg+xml
Accept-Ranges
bytes
Content-Length
3787
x-amz-id-2
BcgaKkPojkLJEMoYtDPaGK9vq/QuO1yUlQS+kGb7s+F2NpXFS33BXWXGmUDLZILV5CH7fqc+D60=
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ 		85 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Origin
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 22:43:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
266357
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27192
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-152b5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oTTZcZ6lPLi3tzDwizcEK2npHH9Ak12iyevHpSu6lq7EQUxXia23%2FZ%2BcIyiMgpLhjj9WlSAIHKi6Yw0oGgf7niEfPPWnGs00NbRtDDqydEXI8RvEkqg5bqMTtgmRW3hMHZEDwSJExeN3HEXC8Bwt0VWo"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
89e2a247babc9762-FRA
expires
Tue, 24 Jun 2025 22:43:23 GMT
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Origin
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 22:43:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1456480
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6646
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-520c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUvWAg6crQPBlg7pAAvfXWwkkJ5D3750WDK34EEg3GU36adl%2FzZ2W8t4TW71epe7IU15upnOgvtgn%2FQJy04r65WG7fVr8qidgwqrdCciAEzTziUBjqAh0V07ch4NEDNY7KvygMcgAijAtm%2F8K6h%2BxjQp"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
89e2a247babe9762-FRA
expires
Tue, 24 Jun 2025 22:43:23 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/ 		57 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js
Requested by
Host: 3829743673278976348.cfd
URL: https://3829743673278976348.cfd/grid/index.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Origin
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 22:43:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
1078
strict-transport-security
max-age=31536000; includeSubDomains; preload
cdn-cachedat
03/18/2024 12:53:16
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:08 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"e1d98d47689e00f8ecbc5d9f61bdb42e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
6b70deadcbd54094a9713ef0c5e0891f
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
89e2a247be0d35e2-FRA
cdn-requestpullsuccess
True
colfax-regular.05f3d250.woff2
3829743673278976348.cfd/dist/static/media/ 		0
0
colfax-regular.95413010.woff
3829743673278976348.cfd/dist/static/media/ 		0
0
/
zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_73U216tZOa2xinj&t=1720133004967
Requested by
Host: 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4966ed5f1d064e8702c3c32174167644c35f79db12759ee904310d4a905c29c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 22:43:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
4649
content-security-policy-report-only
frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"268f-NYNqzeKZXuc0YetvkZ6OvW2KHYo"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-ray
89e2a251db744d54-FRA
s.js
cdn.siftscience.com/ 		62 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.siftscience.com/s.js
Requested by
Host: 87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.67.224 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
224.67.96.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
10ec464febb7b92ed105d94da994f32989ff1d0795c0013460b5e2a7769934f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 03:41:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
846108
x-guploader-uploadid
ACJd0NpNhS-kreC9G--EEipHN_rEZU-cJwuSMFpCzxTDEHX2heGQkTUWTFUyF5ILPgz-Sno1r3Q
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20557
last-modified
Mon, 18 Mar 2024 08:23:03 GMT
server
UploadServer
etag
"489c51cfaaabb9e46cdcd9805f9cb5e7"
x-goog-generation
1710750183024543
x-goog-hash
crc32c=asYZeQ==, md5=SJxRz6qrueRs3NmAX5y15w==
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
no-transform
x-goog-stored-content-length
20557
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 25 Jun 2025 03:41:37 GMT
favicon-32x32.png
sendgrid.com/content/dam/sendgrid/core-assets/social/ 		397 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://sendgrid.com/content/dam/sendgrid/core-assets/social/favicon-32x32.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.158.84.108 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-84-108.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
38153ff6c9b11d498ed6d1abd66f3d9d5175c770da8a4b87cb248c4e77203d7a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31557600, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:25 GMT
Strict-Transport-Security
max-age=31557600, max-age=31536000
x-content-type-options
nosniff
Content-Security-Policy
frame-ancestors 'self'
Via
1.1 934815569b3b6127560be81f148ef706.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P5
Age
1271
x-vhost
sendgrid
X-Cache
Miss from cloudfront
Content-Disposition
inline
Connection
keep-alive
Content-Length
397
X-Served-By
cache-fra-eddf8230088-FRA
Referrer-Policy
origin-when-cross-origin
Last-Modified
Tue, 28 Nov 2023 16:18:57 GMT
Server
nginx
X-Timer
S1720133005.085163,VS0,VS0,VE2
ETag
"0x8DBF02DB8F489FE"
x-frame-options
SAMEORIGIN, sameorigin
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600,stale-while-revalidate=3600,stale-if-error=3600,public,immutable
Accept-Ranges
bytes
X-Amz-Cf-Id
4emXA_if294YNae-sigX-lbKRJ5Kj5xaAyl0brMwHjIc_cGLKm3WMg==
favicon-96x96.png
sendgrid.com/content/dam/sendgrid/core-assets/social/ 		843 B
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://sendgrid.com/content/dam/sendgrid/core-assets/social/favicon-96x96.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.158.84.108 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-158-84-108.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5428385f6923f25178c2bf68b634d746bc5e03ef1a57bf3e17320cc1f5d5576c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31557600, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Thu, 04 Jul 2024 22:43:25 GMT
Strict-Transport-Security
max-age=31557600, max-age=31536000
x-content-type-options
nosniff
Content-Security-Policy
frame-ancestors 'self'
Via
1.1 a51af242bb87a51c6b17ed13ee788db8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P5
Age
2087
x-vhost
sendgrid
X-Cache
Miss from cloudfront
Content-Disposition
inline
Connection
keep-alive
Content-Length
843
X-Served-By
cache-fra-etou8220027-FRA
Referrer-Policy
origin-when-cross-origin
Last-Modified
Tue, 28 Nov 2023 16:18:57 GMT
Server
nginx
X-Timer
S1720133005.144875,VS0,VS0,VE2
ETag
"0x8DBF02DB8F8CAEA"
x-frame-options
SAMEORIGIN, sameorigin
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600,stale-while-revalidate=3600,stale-if-error=3600,public,immutable
Accept-Ranges
bytes
X-Amz-Cf-Id
y6kY9Ouh77v-XC4_345RTYJUCTxThLofa3VSaG-C9ueog3pwzSSuiQ==
12.f83656fbc6c9f02061b2.chunk.js
siteintercept.qualtrics.com/dxjsmodule/ 		74 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/12.f83656fbc6c9f02061b2.chunk.js?Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web&Q_BRANDID=87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
Requested by
Host: zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com
URL: https://zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_73U216tZOa2xinj&t=1720133004967
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
369a904e6a2a6cb6fef3e935c723dead810c01aa74ff7771983a06e5f3cf8f39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 22:43:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
167745
content-security-policy-report-only
frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control
max-age=604800
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 01 Jul 2024 18:09:29 GMT
server
cloudflare
etag
W/"12863-1906f7ccfa8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
permissions-policy
camera=(), geolocation=(), microphone=()
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-ray
89e2a2523bc74d54-FRA
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		127 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_73U216tZOa2xinj&Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web
Requested by
Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.f83656fbc6c9f02061b2.chunk.js?Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web&Q_BRANDID=87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6e3cac598ee80d6cb0e409a43a0ddb9e8fe75ce4250f7f285e81f2c3b2fa0f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Thu, 04 Jul 2024 22:43:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
content-security-policy-report-only
frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
permissions-policy
camera=(), geolocation=(), microphone=()
trace-id
eb6e04258c008eb2
timing-allow-origin
*
cf-ray
89e2a2529c204d54-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
3829743673278976348.cfd
URL
https://3829743673278976348.cfd/grid/container.26013ccb977c385da82e216d1d448f4bbf39435b.css
Domain
3829743673278976348.cfd
URL
https://3829743673278976348.cfd/dist/static/media/colfax-regular.05f3d250.woff2
Domain
3829743673278976348.cfd
URL
https://3829743673278976348.cfd/dist/static/media/colfax-regular.95413010.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sendgrid (Online)

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage function| _0x5f3bfd function| _0x7932fc function| _0x11d8 function| _0x653675 function| _0x4a7413 function| _0x4065a0 function| _0x4fed40 function| _0x4616e9 function| _0x50f552 function| _0x13e4fe function| _0x4294 function| _0x1b3f29 function| _0x13cac5 function| _0x1cbf65 function| _0x1134ae function| _0x1044c3 function| _0x3555 function| _0x42ea2e function| _0x45d86b function| _0x9326 function| _0xd77ebb function| _0x346c07 function| _0x58b21f function| _0x1a5116 function| _0x4d7bf2 function| _0x37c11a object| trackedEvents function| track object| analytics object| dataLayer boolean| google_noFurtherRedirects object| referrer string| hostname function| initNewRelic string| publicPath string| route boolean| inBlackList object| urlBlacklist boolean| OnlyBlacklist boolean| blackListInit undefined| HEAP_ID object| script function| $ function| jQuery function| Popper object| bootstrap string| hash string| email number| count object| _sift function| __siftFlashCB undefined| Sift object| PluginDetect object| QSI object| WAFQualtricsWebpackJsonP-cloud-2.10.0

1 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission

14 Console Messages

Source Level URL
Text
javascript warning URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://3829743673278976348.cfd/grid/index.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://3829743673278976348.cfd/grid/index.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://3829743673278976348.cfd/grid/index.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/?random=1600434399728&cv=9&fst=1600434399728&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=4&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapp.sendgrid.com%2Flogin&tiba=SendGrid&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://3829743673278976348.cfd/grid/index.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1010792098/?random=1600434399796&cv=9&fst=1600434399796&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&u_his=4&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa990&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fapp.sendgrid.com%2Flogin&tiba=SendGrid&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://3829743673278976348.cfd/grid/index.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://3829743673278976348.cfd/grid/index.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://3829743673278976348.cfd/grid/index.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript error URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
Access to CSS stylesheet at 'https://3829743673278976348.cfd/grid/container.26013ccb977c385da82e216d1d448f4bbf39435b.css' from origin 'https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://3829743673278976348.cfd/grid/container.26013ccb977c385da82e216d1d448f4bbf39435b.css
Message:
Failed to load resource: net::ERR_FAILED
recommendation verbose URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
javascript error URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
Access to font at 'https://3829743673278976348.cfd/dist/static/media/colfax-regular.05f3d250.woff2' from origin 'https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://3829743673278976348.cfd/dist/static/media/colfax-regular.05f3d250.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net/
Message:
Access to font at 'https://3829743673278976348.cfd/dist/static/media/colfax-regular.95413010.woff' from origin 'https://87437872793499-hchjbxbzgecsexcf.z03.azurefd.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://3829743673278976348.cfd/dist/static/media/colfax-regular.95413010.woff
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3829743673278976348.cfd
784369236437992.zlatanibile.workers.dev
87437872793499-hchjbxbzgecsexcf.z03.azurefd.net
cdn.siftscience.com
cdnjs.cloudflare.com
googleads.g.doubleclick.net
sendgrid.com
siteintercept.qualtrics.com
stackpath.bootstrapcdn.com
uiux.s3.amazonaws.com
zn73u216tzoa2xinj-twilio.siteintercept.qualtrics.com
3829743673278976348.cfd
104.17.209.240
142.11.212.118
18.158.84.108
2606:4700:3035::ac43:b8fe
2606:4700::6811:180e
2606:4700::6812:bcf
2620:1ec:bdf::45
2a00:1450:4001:806::2002
34.96.67.224
52.217.207.33
04b99c2bbeba1f680e3d402a64b317d448b6bcfabe0123ab1368cfbc1b830ab2
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
10ec464febb7b92ed105d94da994f32989ff1d0795c0013460b5e2a7769934f2
340e372c9af0055e79d47d5949a42311d621b9fb21090051f196d5940d1371e9
369a904e6a2a6cb6fef3e935c723dead810c01aa74ff7771983a06e5f3cf8f39
38153ff6c9b11d498ed6d1abd66f3d9d5175c770da8a4b87cb248c4e77203d7a
4966ed5f1d064e8702c3c32174167644c35f79db12759ee904310d4a905c29c8
5428385f6923f25178c2bf68b634d746bc5e03ef1a57bf3e17320cc1f5d5576c
66217c2a943648d2112ebd44053d076fcdbb1b06414118d5dec3b50208b6fc16
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd
b6e3cac598ee80d6cb0e409a43a0ddb9e8fe75ce4250f7f285e81f2c3b2fa0f1
c368392f31ad57937684f9479af0d4b03c90722b77cda3ac1f8ce80a241dd813
d47ee8395c4bc5550fcb1601d1d21fb16d1ef47aa86071074781c52832495439