lootly.io Open in urlscan Pro
52.73.99.24 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdf...
Submission: On October 04 via api (October 4th 2023, 5:01:07 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 52.73.99.24, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is lootly.io. The Cisco Umbrella rank of the primary domain is 445614.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 28th 2023. Valid for: a year.

This is the only time lootly.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	52.73.99.24 52.73.99.24	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
10	3

8 52.73.99.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-99-24.compute-1.amazonaws.com

lootly.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	lootly.io lootly.io — Cisco Umbrella Rank: 445614	235 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	817 B
10	3

	Domain	Requested by
8	lootly.io	lootly.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	lootly.io
10	3

This site contains no links.

Subject Issuer	Validity	Valid
lootly.io Amazon RSA 2048 M01	`2023-02-28` - `2024-02-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
Frame ID: 47EED865D9CEC1E1B2FD1DFEA8BB07E6
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lootly - widget

Page Statistics

10
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

259 kB
Transfer

973 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request widget Show response
lootly.io/ 3 KB
3 KB 507ms
141ms Document
text/html 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 2528e7d55de2fe00fa9c1bdf8f3ed7b263e81b8f51608ea91318047d0626909d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Cache-control: no-cache="set-cookie"
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 04 Oct 2023 17:01:02 GMT
Server: Apache
Vary: Accept-Encoding
transfer-encoding: chunked

GET
H/1.1 200
OK widget.css
lootly.io/css/ 197 KB
35 KB 240ms
240ms Stylesheet
text/css 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/css/widget.css?v=2
Requested by: Host: lootly.io
URL: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 33348f69de0b54bd91177ce677e31b8c71b21dc85b5df6c7cd7ee3e8cf53090c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Wed, 04 Oct 2023 17:01:02 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Sep 2023 06:51:06 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=259200, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35308

GET
H/1.1 200
OK widget.js Show response
lootly.io/js/ 737 KB
189 KB 490ms
257ms Script
text/javascript 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/js/widget.js?v=2
Requested by: Host: lootly.io
URL: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 577e4c4087b24476ac9caa1272a4aebc1ca6ef5ee198027c1bbef14c23914973

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3a%2f%2fkbdfans.com%2fproducts%2ffbb-suspend-business&_docref=https%3a%2f%2fkbdfans.com%2f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Wed, 04 Oct 2023 17:01:02 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Sep 2023 06:51:06 GMT
Server: Apache
Vary: Accept-Encoding
transfer-encoding: chunked
Content-Type: text/javascript
Cache-Control: max-age=259200, public
Connection: keep-alive
Accept-Ranges: bytes

POST
H/1.1 200
OK authCheck Show response
lootly.io/api/widget/customer/ 2 KB
1 KB 173ms
173ms XHR
application/json 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/api/widget/customer/authCheck
Requested by: Host: lootly.io
URL: https://lootly.io/js/widget.js?v=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: b0f326de01e50d772e2240202dcbbd8d732e46d837aa85d233647c0f0563ca6e

Request headers

X-XSRF-TOKEN: eyJpdiI6Inlsang4VjZJelwvbnA1WXpvZTBwYk9BPT0iLCJ2YWx1ZSI6ImtCSmh6MXBuMElDQVpzMEhBM056cHZ2K2J1aVhSblRkWGJKQStXbmFTZXNuRmZtUlNFM1o1b2M1ZkVRbm0xZERsM1JHcDBWXC9Kb0VTZWg0VGxENHgzQT09IiwibWFjIjoiMTQwNDY0OTI1ZmMyNmRhZjdmYjM4MzFhYjNmMzBmYjQ2NjI3Yzg5MTIxYTdhOWVjMmJmYWVlNmU3MDBmN2RhNSJ9
X-CSRF-TOKEN: 1Q5H9edJcyCHSOROAN2Ph1Pgx4qxcXpNYRuivYOe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3A%2F%2Fkbdfans.com%2Fproducts%2Ffbb-suspend-business&_docref=https%3A%2F%2Fkbdfans.com%2F
X-Requested-With: XMLHttpRequest

Response headers

Date: Wed, 04 Oct 2023 17:01:03 GMT
Content-Encoding: gzip
Server: Apache
transfer-encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: *
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
X-RateLimit-Limit: 60
Connection: keep-alive
Access-Control-Allow-Headers: *
X-RateLimit-Remaining: 59

POST
H/1.1 200
OK settings Show response
lootly.io/api/widget/ 6 KB
2 KB 156ms
156ms XHR
application/json 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/api/widget/settings
Requested by: Host: lootly.io
URL: https://lootly.io/js/widget.js?v=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 5cf1bf8c074cd3293d9680f81d4617e043e583c14db228a77958c33916161cef

Request headers

X-XSRF-TOKEN: eyJpdiI6Inlsang4VjZJelwvbnA1WXpvZTBwYk9BPT0iLCJ2YWx1ZSI6ImtCSmh6MXBuMElDQVpzMEhBM056cHZ2K2J1aVhSblRkWGJKQStXbmFTZXNuRmZtUlNFM1o1b2M1ZkVRbm0xZERsM1JHcDBWXC9Kb0VTZWg0VGxENHgzQT09IiwibWFjIjoiMTQwNDY0OTI1ZmMyNmRhZjdmYjM4MzFhYjNmMzBmYjQ2NjI3Yzg5MTIxYTdhOWVjMmJmYWVlNmU3MDBmN2RhNSJ9
X-CSRF-TOKEN: 1Q5H9edJcyCHSOROAN2Ph1Pgx4qxcXpNYRuivYOe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3A%2F%2Fkbdfans.com%2Fproducts%2Ffbb-suspend-business&_docref=https%3A%2F%2Fkbdfans.com%2F
X-Requested-With: XMLHttpRequest

Response headers

Date: Wed, 04 Oct 2023 17:01:03 GMT
Content-Encoding: gzip
Server: Apache
transfer-encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: *
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
X-RateLimit-Limit: 60
Connection: keep-alive
Access-Control-Allow-Headers: *
X-RateLimit-Remaining: 59

POST
H/1.1 403
Forbidden customer Show response
lootly.io/api/widget/ 35 B
439 B 158ms
158ms XHR
application/json 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/api/widget/customer
Requested by: Host: lootly.io
URL: https://lootly.io/js/widget.js?v=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 4d6cf4f5ae9b1f87a2287bffcb0f47fee4ad406a18bd5c192955ffb68c6f7253

Request headers

X-XSRF-TOKEN: eyJpdiI6Inlsang4VjZJelwvbnA1WXpvZTBwYk9BPT0iLCJ2YWx1ZSI6ImtCSmh6MXBuMElDQVpzMEhBM056cHZ2K2J1aVhSblRkWGJKQStXbmFTZXNuRmZtUlNFM1o1b2M1ZkVRbm0xZERsM1JHcDBWXC9Kb0VTZWg0VGxENHgzQT09IiwibWFjIjoiMTQwNDY0OTI1ZmMyNmRhZjdmYjM4MzFhYjNmMzBmYjQ2NjI3Yzg5MTIxYTdhOWVjMmJmYWVlNmU3MDBmN2RhNSJ9
X-CSRF-TOKEN: 1Q5H9edJcyCHSOROAN2Ph1Pgx4qxcXpNYRuivYOe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3A%2F%2Fkbdfans.com%2Fproducts%2Ffbb-suspend-business&_docref=https%3A%2F%2Fkbdfans.com%2F
X-Requested-With: XMLHttpRequest

Response headers

Date: Wed, 04 Oct 2023 17:01:03 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Access-Control-Allow-Methods: *
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
X-RateLimit-Limit: 60
Connection: keep-alive
Access-Control-Allow-Headers: *
X-RateLimit-Remaining: 59
Content-Length: 55

GET
H/1.1 200
OK loot-widget-icons.ttf
lootly.io/fonts/icons/widget-tab/ 4 KB
4 KB 273ms
118ms Font
application/x-font-ttf 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/fonts/icons/widget-tab/loot-widget-icons.ttf?euvjet
Requested by: Host: lootly.io
URL: https://lootly.io/css/widget.css?v=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 1785b7b0e3b14d8ef60497ac1dd3bec26c4c8e780cda06c6a6361d730c17a345

Request headers

Referer: https://lootly.io/css/widget.css?v=2
Origin: https://lootly.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Wed, 04 Oct 2023 17:01:03 GMT
Last-Modified: Thu, 28 Sep 2023 06:51:06 GMT
Server: Apache
Content-Type: application/x-font-ttf
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3952

GET
H2 200 css
fonts.googleapis.com/ 1 KB
817 B 82ms
31ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700

Requested by

Host: lootly.io
URL: https://lootly.io/js/widget.js?v=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83bb47871b3895cd8f4bf5da67037710b6d9a9e1fab80d03b579cd83a448fe23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lootly.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 04 Oct 2023 17:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 04 Oct 2023 15:48:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 04 Oct 2023 17:01:03 GMT

POST
H/1.1 200
OK nudges Show response
lootly.io/api/widget/ 302 B
611 B 154ms
154ms XHR
application/json 52.73.99.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lootly.io/api/widget/nudges
Requested by: Host: lootly.io
URL: https://lootly.io/js/widget.js?v=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.99.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-99-24.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 094a783c3ef26684f96b501e43d9e7a48013b8ca19285afe9ec99c16d485acb8

Request headers

X-XSRF-TOKEN: eyJpdiI6Inlsang4VjZJelwvbnA1WXpvZTBwYk9BPT0iLCJ2YWx1ZSI6ImtCSmh6MXBuMElDQVpzMEhBM056cHZ2K2J1aVhSblRkWGJKQStXbmFTZXNuRmZtUlNFM1o1b2M1ZkVRbm0xZERsM1JHcDBWXC9Kb0VTZWg0VGxENHgzQT09IiwibWFjIjoiMTQwNDY0OTI1ZmMyNmRhZjdmYjM4MzFhYjNmMzBmYjQ2NjI3Yzg5MTIxYTdhOWVjMmJmYWVlNmU3MDBmN2RhNSJ9
X-CSRF-TOKEN: 1Q5H9edJcyCHSOROAN2Ph1Pgx4qxcXpNYRuivYOe
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: https://lootly.io/widget?_shd=kbdfans.myshopify.com&_shs=6ce22c37a2688cbc55738099993232c4&_page=https%3A%2F%2Fkbdfans.com%2Fproducts%2Ffbb-suspend-business&_docref=https%3A%2F%2Fkbdfans.com%2F
X-Requested-With: XMLHttpRequest

Response headers

Date: Wed, 04 Oct 2023 17:01:03 GMT
Content-Encoding: gzip
Server: Apache
transfer-encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: *
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
X-RateLimit-Limit: 60
Connection: keep-alive
Access-Control-Allow-Headers: *
X-RateLimit-Remaining: 59

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 86ms
22ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://lootly.io
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 21:23:50 GMT
x-content-type-options: nosniff
age: 329833
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 29 Sep 2024 21:23:50 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
lootly.io/	1970-01-20 15:14:06	Name: XSRF-TOKEN Value: eyJpdiI6Inlsang4VjZJelwvbnA1WXpvZTBwYk9BPT0iLCJ2YWx1ZSI6ImtCSmh6MXBuMElDQVpzMEhBM056cHZ2K2J1aVhSblRkWGJKQStXbmFTZXNuRmZtUlNFM1o1b2M1ZkVRbm0xZERsM1JHcDBWXC9Kb0VTZWg0VGxENHgzQT09IiwibWFjIjoiMTQwNDY0OTI1ZmMyNmRhZjdmYjM4MzFhYjNmMzBmYjQ2NjI3Yzg5MTIxYTdhOWVjMmJmYWVlNmU3MDBmN2RhNSJ9
lootly.io/	1970-01-20 15:14:06	Name: lootly_session Value: eyJpdiI6IldDUCtKMzdWK2tUN2dUSmtDaUFXc0E9PSIsInZhbHVlIjoiVjZibWhMcHFoRm1ReFpJOG9oVHB5WU50clBEV29OblYwVVZId3dPUEcxaEtpbzFaVXViWnBhTUNzcjBcL3ozc29DUU5UMHlic1NxQ2c4WHR4OEx3bjNRPT0iLCJtYWMiOiIzMTVjZDA3NzBjMmNjZDk2MGNlNGUxOWQ5NjFmYzFjYjhkNmI2MmM1OWRkNDY3NTk0NDM0NWQyY2E2MzgxNTQzIn0%3D
lootly.io/	1970-01-20 15:14:06	Name: AWSELB Value: 63D11B610802514FD1FD3965A967E5FAC25351DA4C7D01C72EC0C15BC73A857CC9A43D55E174DF3742E855DFED0E0CE1891C06A63437A89B3385034D7C5185E35474E096F1
lootly.io/	1970-01-20 15:14:06	Name: AWSELBCORS Value: 63D11B610802514FD1FD3965A967E5FAC25351DA4C7D01C72EC0C15BC73A857CC9A43D55E174DF3742E855DFED0E0CE1891C06A63437A89B3385034D7C5185E35474E096F1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lootly.io/api/widget/customer Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
lootly.io
2a00:1450:4001:82b::2003
2a00:1450:4001:830::200a
52.73.99.24
094a783c3ef26684f96b501e43d9e7a48013b8ca19285afe9ec99c16d485acb8
1785b7b0e3b14d8ef60497ac1dd3bec26c4c8e780cda06c6a6361d730c17a345
2528e7d55de2fe00fa9c1bdf8f3ed7b263e81b8f51608ea91318047d0626909d
33348f69de0b54bd91177ce677e31b8c71b21dc85b5df6c7cd7ee3e8cf53090c
4d6cf4f5ae9b1f87a2287bffcb0f47fee4ad406a18bd5c192955ffb68c6f7253
577e4c4087b24476ac9caa1272a4aebc1ca6ef5ee198027c1bbef14c23914973
5cf1bf8c074cd3293d9680f81d4617e043e583c14db228a77958c33916161cef
83bb47871b3895cd8f4bf5da67037710b6d9a9e1fab80d03b579cd83a448fe23
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
b0f326de01e50d772e2240202dcbbd8d732e46d837aa85d233647c0f0563ca6e

lootly.io Open in urlscan Pro 52.73.99.24 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

259 kBTransfer

973 kBSize

4 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

4 Cookies

1 Console Messages

Indicators

lootly.io Open in urlscan Pro
52.73.99.24 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

259 kB
Transfer

973 kB
Size

4
Cookies

10 HTTP transactions
0 data transactions