pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev Open in urlscan Pro
2606:4700::6812:323 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET
Effective URL:
https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html
Submission Tags: @phish_report
Submission: On April 08 via api (April 8th 2024, 7:03:31 am UTC) from FI — Scanned from FI

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 12 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	103.102.152.242 103.102.152.242	58404 (QWORDS-AS...) (QWORDS-AS-ID PT Qwords Company International)
1	2a02:26f0:710... 2a02:26f0:7100:8a9::523	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.0.238 151.101.0.238	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1 2	151.101.64.238 151.101.64.238	54113 (FASTLY) (FASTLY)
2	142.250.184.225 142.250.184.225	15169 (GOOGLE) (GOOGLE)
1	76.76.21.98 76.76.21.98	16509 (AMAZON-02) (AMAZON-02)
12	10

3 103.102.152.242 (Indonesia) 1 redirects

ASN58404 (QWORDS-AS-ID PT Qwords Company International, ID)
PTR: srv.upmi.ac.id

pascasarjana.upmi.ac.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100:8a9::523 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

res.cloudinary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.0.238 (United States)

ASN54113 (FASTLY, US)

static1.squarespace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.64.238 (United States) 1 redirects

ASN54113 (FASTLY, US)

static1.squarespace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.squarespace-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.225 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f1.1e100.net

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.98 (Walnut, United States)

ASN16509 (AMAZON-02, US)

www.svgrepo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 392	79 KB
3	upmi.ac.id 1 redirects pascasarjana.upmi.ac.id	11 KB
2	squarespace.com 1 redirects static1.squarespace.com — Cisco Umbrella Rank: 6285	43 KB
1	svgrepo.com www.svgrepo.com — Cisco Umbrella Rank: 94031	2 KB
1	squarespace-cdn.com images.squarespace-cdn.com — Cisco Umbrella Rank: 5424	565 KB
1	gstatic.com fonts.gstatic.com	39 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 38	1 KB
1	r2.dev pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev	24 KB
1	cloudinary.com res.cloudinary.com — Cisco Umbrella Rank: 2850	40 KB
12	9

	Domain	Requested by
3	cdn.ampproject.org	pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev cdn.ampproject.org
3	pascasarjana.upmi.ac.id	1 redirects
2	static1.squarespace.com	1 redirects pascasarjana.upmi.ac.id
1	www.svgrepo.com
1	images.squarespace-cdn.com	pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
1	pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
1	res.cloudinary.com	pascasarjana.upmi.ac.id
12	9

This site contains links to these domains. Also see Links.

Domain
pub-0f2ba1287b4f47e8976e198ddfecd495.r2.dev

Subject Issuer	Validity	Valid
pascasarjana.upmi.ac.id R3	`2024-03-02` - `2024-05-31`	3 months	crt.sh
*.cloudinary.com Go Daddy Secure Certificate Authority - G2	`2023-12-18` - `2025-01-13`	a year	crt.sh
*.squarespace.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-09` - `2025-02-28`	a year	crt.sh
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
www.svgrepo.com R3	`2024-02-24` - `2024-05-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html
Frame ID: E82FE350F84EE7E6DA555C0F02018E05
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SITUS SLOT GACOR GAMPANG MENANG MAXWIN TERPERCAYA HARI INI 2024 — SLOT GACOR

Page URL History Show full URLs

https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET Page URL
https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Lightbox (JavaScript Libraries) Expand

Page Statistics

12
Requests

83 %
HTTPS

50 %
IPv6

9
Domains

9
Subdomains

10
IPs

3
Countries

803 kB
Transfer

1192 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://pub-0f2ba1287b4f47e8976e198ddfecd495.r2.dev/cuan.html

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET Page URL
https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://pascasarjana.upmi.ac.id/favicon.ico HTTP 302
https://pascasarjana.upmi.ac.id/wp-content/uploads/2020/08/cropped-icon-32x32.png

Request Chain 7

https://static1.squarespace.com/static/660bb62706c6560a7146d1ee/t/660bba82ba209a41606a2116/1712044674558/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png HTTP 301
https://images.squarespace-cdn.com/content/660bb62706c6560a7146d1ee/1712044640452-CG1OWTA1P4BMXLEI2ALW/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png?content-type=image%2Fpng

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
pascasarjana.upmi.ac.id/wp-content/-/ 43 KB
8 KB 1766ms
437ms Document
text/html 103.102.152.242
QWORDS-AS-ID PT Q...

General

Check archive.org

Show headers Download Go to

Full URL: https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.102.152.242 , Indonesia, ASN58404 (QWORDS-AS-ID PT Qwords Company International, ID),
Reverse DNS: srv.upmi.ac.id
Software: Apache /
Resource Hash: 015d4aa11b48f1634526678c05456f62256dd74a1e041cd1d95775fbefac8d37

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: fi-FI,fi;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
content-length: 8160
content-type: text/html; charset=UTF-8
date: Mon, 08 Apr 2024 07:03:26 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 searchengine.logo_s2gulz_wka839.png
res.cloudinary.com/dytrxbfnl/image/upload/v1710900038/sliding-game/ 39 KB
40 KB 264ms
73ms Image
image/png 2a02:26f0:7100:8a9::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://res.cloudinary.com/dytrxbfnl/image/upload/v1710900038/sliding-game/searchengine.logo_s2gulz_wka839.png?format=1500w

Requested by

Host: pascasarjana.upmi.ac.id
URL: https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:7100:8a9::523 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

30ef0b70cb118f165e59f37800303a52e246d88c0eccbb922591cf20b7f3ef56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pascasarjana.upmi.ac.id/
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 07:03:26 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
last-modified: Wed, 20 Mar 2024 02:00:39 GMT
server: Cloudinary
etag: "79eab873eeda0f6d8ac48c695d00cbab"
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=2592000
server-timing: cld-akam;dur=17;start=2024-04-08T07:03:26.652Z;desc=miss,rtt;dur=54,content-info;desc="width=300,height=104,bytes=40330,o=1,ef=(17)",cloudinary;dur=49;start=2024-03-31T19:21:20.178Z
accept-ranges: bytes
timing-allow-origin: *
content-length: 40330

GET
H2 200 site-bundle.461357a181df7ddcd970264c877fd49f.js Show response
static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/ 175 KB
43 KB 177ms
55ms Script
application/javascript 151.101.0.238
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://static1.squarespace.com/static/vta/5c5a519771c10ba3470d8101/scripts/site-bundle.461357a181df7ddcd970264c877fd49f.js

Requested by

Host: pascasarjana.upmi.ac.id
URL: https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.238 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Squarespace /

Resource Hash

156cd41c8ccac71f022a825053fcadd852157095d7e4a82a11f8d7090de4f6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pascasarjana.upmi.ac.id/
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1391, 0
date: Mon, 08 Apr 2024 07:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 varnish, 1.1 varnish
age: 510946
x-cache: HIT, HIT
x-contextid: zAdjQF0E/bztnxoEW
content-length: 43561
x-served-by: cache-dfw-kdal2120025-DFW, cache-fra-eddf8230118-FRA
pragma: cache
server: Squarespace
x-timer: S1712559807.583477,VS0,VE1
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=94608000
accept-ranges: bytes
timing-allow-origin: *
tracepoint: Fastly

GET
H/1.1 200
OK Primary Request cuan.html Show response
pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/ 24 KB
24 KB 1244ms
1171ms Document
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95e9a23d1e200dbb9a57c1e83ff37828b571a818d7cae186be46711b991a3c70

Request headers

Referer: https://pascasarjana.upmi.ac.id/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: fi-FI,fi;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 871065c8ea5b8d7c-HEL
Connection: keep-alive
Content-Length: 24098
Content-Type: text/html
Date: Mon, 08 Apr 2024 07:03:28 GMT
ETag: "e577c9fb1441ef10126ac4dcb25c599f"
Last-Modified: Fri, 05 Apr 2024 16:26:54 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2

200

cropped-icon-32x32.png
pascasarjana.upmi.ac.id/wp-content/uploads/2020/08/
Redirect Chain

https://pascasarjana.upmi.ac.id/favicon.ico
https://pascasarjana.upmi.ac.id/wp-content/uploads/2020/08/cropped-icon-32x32.png

3 KB
3 KB

246ms
246ms

Other
image/png

103.102.152.242
QWORDS-AS-ID PT Q...

General

Check archive.org

Show headers Download Go to

Full URL: https://pascasarjana.upmi.ac.id/wp-content/uploads/2020/08/cropped-icon-32x32.png
Protocol: H2
Server: 103.102.152.242 , Indonesia, ASN58404 (QWORDS-AS-ID PT Qwords Company International, ID),
Reverse DNS: srv.upmi.ac.id
Software: Apache /
Resource Hash

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://pascasarjana.upmi.ac.id/wp-content/-/?tunnel=HARUMBET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Apr 2024 07:03:27 GMT
last-modified: Tue, 25 Aug 2020 08:29:42 GMT
server: Apache
accept-ranges: bytes
content-length: 2687
content-type: image/png

Redirect headers

date: Mon, 08 Apr 2024 07:03:26 GMT
content-encoding: br
server: Apache
x-redirect-by: WordPress
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
location: https://pascasarjana.upmi.ac.id/wp-content/uploads/2020/08/cropped-icon-32x32.png
link: <https://pascasarjana.upmi.ac.id/wp-json/>; rel="https://api.w.org/"
content-length: 1

GET
H2 200 v0.js Show response
cdn.ampproject.org/ 278 KB
73 KB 200ms
67ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0.js

Requested by

Host: pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
URL: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

baa9fe8d5c96fa400f26be054fe8f782a8e4748ed778782c2e1b9295b81981d3

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Mon, 08 Apr 2024 07:03:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73146
x-xss-protection: 0
server: sffe
etag: "ec6d22c4cf8283c7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 08 Apr 2024 07:03:28 GMT

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
1 KB 200ms
68ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Requested by

Host: pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
URL: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f2e1354c35d007da969fee34471427de87a2377fecc691b0b387ea2d9c1b007b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Mon, 08 Apr 2024 07:03:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 08 Apr 2024 05:14:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 08 Apr 2024 07:03:28 GMT

GET
H2 200 o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
fonts.gstatic.com/s/notosans/v36/ 38 KB
39 KB 184ms
59ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosans/v36/o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 17:14:11 GMT
x-content-type-options: nosniff
age: 568157
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39412
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:43:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 01 Apr 2025 17:14:11 GMT

GET
H2

200

slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png
images.squarespace-cdn.com/content/660bb62706c6560a7146d1ee/1712044640452-CG1OWTA1P4BMXLEI2ALW/
Redirect Chain

https://static1.squarespace.com/static/660bb62706c6560a7146d1ee/t/660bba82ba209a41606a2116/1712044674558/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png
https://images.squarespace-cdn.com/content/660bb62706c6560a7146d1ee/1712044640452-CG1OWTA1P4BMXLEI2ALW/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png?content-type=image%2Fpng

564 KB
565 KB

176ms
56ms

Image
image/png

151.101.64.238
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.squarespace-cdn.com/content/660bb62706c6560a7146d1ee/1712044640452-CG1OWTA1P4BMXLEI2ALW/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png?content-type=image%2Fpng
Requested by: Host: pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
URL: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html
Protocol: H2
Server: 151.101.64.238 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 17520ddfb55f5dbe409b89dcdbda2c5e098c57d2a711a4b707a18f3e8a2135b5

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

x-cache-hits: 477, 0
date: Mon, 08 Apr 2024 07:03:28 GMT
via: 1.1 google, 1.1 varnish, 1.1 varnish
age: 515163
x-cache: HIT, HIT
content-length: 577550
x-served-by: cache-iad-kjyo7100063-IAD, cache-ams21056-AMS
x-sqsp-accepted-scopes: EDITOR
x-timer: S1712559809.702813,VS0,VE1
etag: CKSh3aWHo4UDEAE=
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Timing-Allow-Origin
cache-control: max-age=604800,s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
x-sqsp-is-public: false
tracepoint: Fastly

Redirect headers

x-cache-hits: 8, 0
date: Mon, 08 Apr 2024 07:03:28 GMT
via: 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
age: 513160
x-cache: HIT, HIT
x-contextid: Dfgsj2nK/MJwaupUc
content-length: 0
x-served-by: cache-dfw-kdal2120032-DFW, cache-ams21061-AMS
pragma: cache
server: Squarespace
x-timer: S1712559809.526063,VS0,VE1
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
location: https://images.squarespace-cdn.com/content/660bb62706c6560a7146d1ee/1712044640452-CG1OWTA1P4BMXLEI2ALW/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png?content-type=image%2Fpng
access-control-expose-headers: Content-Length, Timing-Allow-Origin
cache-control: public, max-age=604800
accept-ranges: bytes
timing-allow-origin: *, *
tracepoint: Fastly

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012403211912000/v0/ 8 KB
3 KB 177ms
60ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012403211912000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

7b7a02597cefe4178fc58dd2b445b1770427345169183558681ca660254063ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
Origin: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 Apr 2024 19:06:38 GMT
age: 475010
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2973
x-xss-protection: 0
server: sffe
etag: "fffbb21261bf0d7f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Apr 2025 19:06:38 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012403211912000/v0/ 12 KB
4 KB 179ms
62ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012403211912000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f1.1e100.net

Software

sffe /

Resource Hash

52647286b9f90bf416b20b8dc53aed29a861535e4a093ac087391fe5c65333fa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
Origin: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 Apr 2024 19:06:38 GMT
age: 475010
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3931
x-xss-protection: 0
server: sffe
etag: "e63853037feccf4f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 02 Apr 2025 19:06:38 GMT

GET
H2 200 photograph-thunder.svg
www.svgrepo.com/show/243148/ 2 KB
2 KB 301ms
203ms Other
image/svg+xml 76.76.21.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.svgrepo.com/show/243148/photograph-thunder.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.98 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

ec3d8ab8a33d1de20f079131b5454b3029e1ade42cb3ffbbcdc46f705c5bca5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/
accept-language: fi-FI,fi;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 07:03:29 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 09 Jan 2023 00:24:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: Vercel
x-vercel-id: arn1::nbd6k-1712559809081-751ad3966792
etag: W/"63bb5eaa-7df"
strict-transport-security: max-age=63072000
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8WXBb0zgn6FkOYEwncU0f5L4Xa8Xvd8OtgZuWPRePjOUz0VXsyw6eJ0bzc5sWtcxOlkEX4RctJO%2F%2BAj%2FvVV15GiCekkRQBgsytgT1%2FdjwDoYQi51MlpYg3l%2FCr7h0s0Y8Kc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=31536000
cf-ray: 871065d6edd1b4fa-OSL
expires: Wed, 08 May 2024 07:03:29 GMT

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html Message: Mixed Content: The page at 'https://pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev/cuan.html' was loaded over HTTPS, but requested an insecure element 'http://static1.squarespace.com/static/660bb62706c6560a7146d1ee/t/660bba82ba209a41606a2116/1712044674558/slot%2Bgacor%2Bgampang%2Bmenang%2Bmaxwin.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.ampproject.org
fonts.googleapis.com
fonts.gstatic.com
images.squarespace-cdn.com
pascasarjana.upmi.ac.id
pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev
res.cloudinary.com
static1.squarespace.com
www.svgrepo.com
103.102.152.242
142.250.184.225
151.101.0.238
151.101.64.238
2606:4700::6812:323
2a00:1450:4001:800::2003
2a00:1450:4001:810::200a
2a00:1450:4001:831::2001
2a02:26f0:7100:8a9::523
76.76.21.98
015d4aa11b48f1634526678c05456f62256dd74a1e041cd1d95775fbefac8d37
156cd41c8ccac71f022a825053fcadd852157095d7e4a82a11f8d7090de4f6c2
17520ddfb55f5dbe409b89dcdbda2c5e098c57d2a711a4b707a18f3e8a2135b5
30ef0b70cb118f165e59f37800303a52e246d88c0eccbb922591cf20b7f3ef56
52647286b9f90bf416b20b8dc53aed29a861535e4a093ac087391fe5c65333fa
7b7a02597cefe4178fc58dd2b445b1770427345169183558681ca660254063ca
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
95e9a23d1e200dbb9a57c1e83ff37828b571a818d7cae186be46711b991a3c70
baa9fe8d5c96fa400f26be054fe8f782a8e4748ed778782c2e1b9295b81981d3
ec3d8ab8a33d1de20f079131b5454b3029e1ade42cb3ffbbcdc46f705c5bca5c
f2e1354c35d007da969fee34471427de87a2377fecc691b0b387ea2d9c1b007b

pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev Open in urlscan Pro 2606:4700::6812:323 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

83 %HTTPS

50 %IPv6

9 Domains

9 Subdomains

10 IPs

3 Countries

803 kBTransfer

1192 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

pub-c50390c0b3f1494e982a9b3e85bce1ba.r2.dev Open in urlscan Pro
2606:4700::6812:323 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

83 %
HTTPS

50 %
IPv6

9
Domains

9
Subdomains

10
IPs

3
Countries

803 kB
Transfer

1192 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions