ruttienmat.com Open in urlscan Pro
171.244.37.199  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://ruttienmat.com/lod/?inc Page URL
2. https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ ruttienmat.com/lod/	404 B 556 B	4433ms 3721ms	Document text/html	171.244.37.199 VIETEL-AS-AP Viet...
General Check archive.org Show headers Download Go to Full URL https://ruttienmat.com/lod/?inc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 171.244.37.199 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN), Reverse DNS Software LiteSpeed / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control max-age=0, private, no-cache, no-store, must-revalidate content-encoding gzip content-length 269 content-type text/html; charset=UTF-8 date Fri, 15 Dec 2023 21:08:00 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	Primary Request / Show response ruttienmat.com/lod/	5 KB 2 KB	2696ms 2696ms	Document text/html	171.244.37.199 VIETEL-AS-AP Viet...
General Check archive.org Show headers Download Go to Full URL https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?inc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 171.244.37.199 , Viet Nam, ASN7552 (VIETEL-AS-AP Viettel Group, VN), Reverse DNS Software LiteSpeed / Resource Hash ae07147eb32f56ce413d828dc7a2c7c136ec168269925ccb2bbb475b15382db2 Request headers Referer https://ruttienmat.com/lod/?inc Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control max-age=0, private, no-cache, no-store, must-revalidate content-encoding gzip content-length 1924 content-type text/html; charset=UTF-8 date Fri, 15 Dec 2023 21:08:03 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	css2 fonts.googleapis.com/	840 B 823 B	632ms 88ms	Stylesheet text/css	142.250.184.234 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Spline+Sans&display=swap Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.234 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f10.1e100.net Software ESF / Resource Hash bf2a8753d295cbd4efd92485b96f57d37835587d8ad0943c65e9e0fdd03545e4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Fri, 15 Dec 2023 21:08:04 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Fri, 15 Dec 2023 21:08:04 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 15 Dec 2023 21:08:04 GMT
GET H2	200	pro.min.js Show response kit-pro.fontawesome.com/releases/v6.0.0/js/	58 KB 17 KB	1117ms 573ms	Script application/javascript	104.18.40.68 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kit-pro.fontawesome.com/releases/v6.0.0/js/pro.min.js Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.40.68 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 90b51fddf71e22104c0b87ee25969aeb16271c0beff4a5cc3b00f2f2d5b1bcf6 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 15 Dec 2023 21:08:04 GMT content-encoding gzip cf-cache-status MISS last-modified Mon, 07 Feb 2022 20:25:32 GMT server cloudflare x-amz-request-id P3K63TVZ05238TES etag W/"395024b9a9244a0a827ac3f07cf52007" vary Accept-Encoding content-type application/javascript cache-control public, max-age=31556926 cf-ray 8361a8e78bef0f72-MXP x-amz-id-2 hNw/2Hw0d2ZxL7jSkY/1NXyJi9aG0sY4aZ22sx2qorGIFwf13ZF0As3JHWweMIQiHMl5QhBg650= expires Sun, 15 Dec 2024 02:56:50 GMT
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/	158 KB 25 KB	557ms 146ms	Stylesheet text/css	104.16.85.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://ruttienmat.com/ Origin https://ruttienmat.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 15 Dec 2023 21:08:04 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 3956066 x-jsd-version 4.6.0 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230111-FRA, cache-mxp6960-MXP x-jsd-version-type version server cloudflare etag W/"27681-LKxK/BIJg5IUESlr1Oj9ipS6I34" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oK31C4C8%2BBgsYPind8Soxp%2B8zBl9Vl5lUXxBceOQ3de3k%2FcNMK%2Fej4kZJfG171Z9qv0H9IxZTlvMCF3KsgWD4yKm37wT3hFXSALaIXEAAH8CpgFRJV%2BBZXlsL2AHdeZuTY0%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 8361a8e6af380e16-MXP
GET H/1.1	200 OK	jquery-3.3.1.min.js Show response strox.nl/trst_files/lib/js/	85 KB 30 KB	417ms 152ms	Script application/javascript	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Full URL https://strox.nl/trst_files/lib/js/jquery-3.3.1.min.js Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:04 GMT Content-Encoding gzip Last-Modified Sun, 10 Apr 2022 15:15:43 GMT Server nginx/1.20.1 ETag "1538f-5dc4e4d2cfe14-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 30307
GET H/1.1	200 OK	csspage2.php strox.nl/trst_files/ca/	4 KB 1 KB	333ms 83ms	Stylesheet text/css	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Full URL https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / PHP/5.6.40 Resource Hash 1f3e93c47a91bab84e1a3ba56ab9bbc1886eaff4d475b8d5451e8e98da5f6392 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:04 GMT Content-Encoding gzip Server nginx/1.20.1 X-Powered-By PHP/5.6.40 Vary Accept-Encoding,User-Agent Upgrade h2,h2c Content-Type text/css; charset: UTF-8;charset=UTF-8 Connection keep-alive Content-Length 1062
GET H/1.1	200 OK	logo.png strox.nl/trst_files/pics/	4 KB 5 KB	416ms 81ms	Image image/png	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Show image Full URL https://strox.nl/trst_files/pics/logo.png Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash d2e2e20fc9729fb0389392bde5a8fd1b4cb390dd8689ce7a1c3fe83cc91b0d52 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:04 GMT Last-Modified Wed, 13 Apr 2022 16:48:11 GMT Server nginx/1.20.1 ETag "1118-5dc8bf15508c0" Upgrade h2,h2c Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 4376
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/	21 KB 8 KB	467ms 56ms	Script application/javascript	104.16.85.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://ruttienmat.com/ Origin https://ruttienmat.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 15 Dec 2023 21:08:04 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1449842 x-jsd-version 1.16.1 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-etou8220021-FRA, cache-mxp6965-MXP x-jsd-version-type version server cloudflare etag W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lne2L1l7h9y1mCEArSYAjgAgUb04a%2F44JMm5ttCakWF%2BgHyRbJ8VRBMwKSiK%2FNVNd6SDgDboQ6CTBkSsRsxchydpvmSMIom3Oam55YdPqeOVp4cXRUN3o602tPnVCJhuKXs%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 8361a8e6af390e16-MXP
GET H2	200	bootstrap.min.js Show response cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/	62 KB 16 KB	74ms 74ms	Script application/javascript	104.16.85.20 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.85.20 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash edd03b96ae4ff7886406c59d7dfeeaa1b624a7da297bf2f92d0cb6b7f9633cba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://ruttienmat.com/ Origin https://ruttienmat.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Fri, 15 Dec 2023 21:08:04 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1532934 x-jsd-version 4.6.0 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-eddf8230032-FRA, cache-mxp6929-MXP x-jsd-version-type version server cloudflare etag W/"f7eb-O+7WjtfXU8a/T2HCY4bd15KboDA" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDczADhLfjisAczNBQwo1n%2BERX3pSeGbZnJDTohs%2F0elO7IABUTai5F5EwhjgU1kFBDUJJkrLG4mIzPJWrUwvSyxxfsDb9CohTL0f5LbZp2Uaa%2FhOz8B7bK6Hu5tGUXGK3A%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 8361a8e6af520e16-MXP
GET H2	200	element.js Show response translate.google.com/translate_a/	88 KB 31 KB	537ms 70ms	Script text/javascript	142.250.186.110 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.110 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f14.1e100.net Software ESF / Resource Hash ac052f389897d883faac4c48ecc35e29669d837bb9f20126ccd911aebd084a28 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers pragma no-cache date Fri, 15 Dec 2023 21:08:04 GMT content-encoding gzip x-content-type-options nosniff server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control no-cache, no-store, max-age=0, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	b.png strox.nl/trst_files//ca/	137 KB 137 KB	158ms 157ms	Image image/png	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Show image Full URL https://strox.nl/trst_files//ca/b.png Requested by Host: strox.nl URL: https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash 2fb0edc4309fcb422b5a0a0649b316449435e6a4f9ae2f3dc294d4c207028d25 Request headers accept-language it-IT,it;q=0.9 Referer https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:05 GMT Last-Modified Wed, 13 Apr 2022 16:42:29 GMT Server nginx/1.20.1 ETag "223cd-5dc8bdcf28740" Upgrade h2,h2c Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 140237
GET H/1.1	200 OK	eve.png strox.nl/trst_files/	2 KB 3 KB	85ms 85ms	Image image/png	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Show image Full URL https://strox.nl/trst_files/eve.png Requested by Host: strox.nl URL: https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash 109bb31431f7a765c5334f4f877670f07d0390cdce74b991f063adecee81577f Request headers accept-language it-IT,it;q=0.9 Referer https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:05 GMT Last-Modified Wed, 13 Apr 2022 16:42:26 GMT Server nginx/1.20.1 ETag "9f5-5dc8bdcc4c080" Upgrade h2,h2c Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 2549
GET H/1.1	200 OK	fu.woff strox.nl/trst_files/	47 KB 48 KB	916ms 426ms	Font application/x-font-woff	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Full URL https://strox.nl/trst_files/fu.woff Requested by Host: strox.nl URL: https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash 2574d7302123369d60192dc3ccdad6eb6399e8fb45c993ad39f52ca914ae8b92 Request headers Referer https://strox.nl/trst_files/ca/csspage2.php?page=signin&t=asjltys7wlpznaf Origin https://ruttienmat.com accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Date Fri, 15 Dec 2023 21:08:05 GMT Content-Encoding gzip Last-Modified Wed, 13 Apr 2022 16:42:28 GMT Server nginx/1.20.1 ETag "bd9a-5dc8bdce34500-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Content-Type application/x-font-woff Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 48472
GET H2	200	m=el_main_css www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/	22 KB 5 KB	620ms 79ms	Stylesheet text/css	142.250.184.195 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css Requested by Host: URL: /_/translate_http/_/js/k=translate_http.tr.it.7GE8qgEkToY.O/am=AAM/d=1/rs=AN8SPfpulFdTFnW4PGgzh0xhCcemcIn4qg/m=el_conf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f3.1e100.net Software sffe / Resource Hash 71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Wed, 13 Dec 2023 09:08:41 GMT content-encoding gzip x-content-type-options nosniff age 215964 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4144 x-xss-protection 0 last-modified Sat, 15 Jul 2023 01:09:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="rosetta" vary Accept-Encoding report-to {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]} content-type text/css; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 12 Dec 2024 09:08:41 GMT
GET H2	200	m=el_main Show response translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.it.7GE8qgEkToY.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfpMLp9QyBTPTV3iTQ9m2ryiacV2Ow/	255 KB 88 KB	97ms 96ms	Script text/javascript	142.250.184.234 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.it.7GE8qgEkToY.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfpMLp9QyBTPTV3iTQ9m2ryiacV2Ow/m=el_main Requested by Host: URL: /_/translate_http/_/js/k=translate_http.tr.it.7GE8qgEkToY.O/am=AAM/d=1/rs=AN8SPfpulFdTFnW4PGgzh0xhCcemcIn4qg/m=el_conf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.234 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f10.1e100.net Software sffe / Resource Hash e826524250716c7e17af91c57cdf9931686c4531fbe187e37cd5375886eab07c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Tue, 12 Dec 2023 06:46:07 GMT content-encoding gzip x-content-type-options nosniff age 310918 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 89479 x-xss-protection 0 last-modified Wed, 06 Dec 2023 14:12:04 GMT server sffe cross-origin-opener-policy same-origin; report-to="rosetta" vary Accept-Encoding report-to {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 11 Dec 2024 06:46:07 GMT
GET DATA	200 OK	truncated Show response / Frame CBF5	1 KB 1 KB		Document text/html
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Content-Type text/html;charset=UTF-8
GET H2	200	24px.svg fonts.gstatic.com/s/i/productlogos/translate/v14/	6 KB 4 KB	701ms 122ms	Image image/svg+xml	142.250.185.227 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.227 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f3.1e100.net Software sffe / Resource Hash ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Wed, 13 Dec 2023 11:13:05 GMT content-encoding gzip x-content-type-options nosniff age 208501 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3340 x-xss-protection 0 last-modified Wed, 20 Apr 2022 14:24:23 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" vary Accept-Encoding report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 12 Dec 2024 11:13:05 GMT
GET H2	200	googlelogo_color_42x16dp.png www.gstatic.com/images/branding/googlelogo/1x/	910 B 1 KB	366ms 118ms	Image image/png	142.250.184.195 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png Requested by Host: ruttienmat.com URL: https://ruttienmat.com/lod/?auth&apitoken=asjltys7wlpznaf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f3.1e100.net Software sffe / Resource Hash 6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://ruttienmat.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Thu, 14 Dec 2023 19:13:58 GMT x-content-type-options nosniff age 93247 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 910 x-xss-protection 0 last-modified Thu, 02 Nov 2023 22:48:00 GMT server sffe vary Origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/png cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Fri, 13 Dec 2024 19:13:58 GMT
GET H2	200	translate_24dp.png www.gstatic.com/images/branding/product/2x/	2 KB 2 KB	82ms 81ms	Image image/png	142.250.184.195 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/branding/product/2x/translate_24dp.png Requested by Host: www.gstatic.com URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.195 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f3.1e100.net Software sffe / Resource Hash 4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language it-IT,it;q=0.9 Referer https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers date Wed, 13 Dec 2023 12:20:25 GMT x-content-type-options nosniff age 204460 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1842 x-xss-protection 0 last-modified Thu, 14 Oct 2021 09:08:00 GMT server sffe vary Origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/png cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Thu, 12 Dec 2024 12:20:25 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Truist Bank (Banking)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture object| FontAwesomeConfig object| ___FONT_AWESOME___ object| FontAwesome function| $ function| jQuery function| eye function| eye2 function| googleTranslateElementInit function| Popper object| bootstrap function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| pako object| closure_lm_664593

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ruttienmat.com/lod	1969-12-31 23:59:59	Name: googtrans Value: /en/it

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
kit-pro.fontawesome.com
ruttienmat.com
strox.nl
translate.google.com
translate.googleapis.com
www.gstatic.com
104.16.85.20
104.18.40.68
142.250.184.195
142.250.184.234
142.250.185.227
142.250.186.110
171.244.37.199
212.23.222.194
109bb31431f7a765c5334f4f877670f07d0390cdce74b991f063adecee81577f
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1f3e93c47a91bab84e1a3ba56ab9bbc1886eaff4d475b8d5451e8e98da5f6392
2574d7302123369d60192dc3ccdad6eb6399e8fb45c993ad39f52ca914ae8b92
2fb0edc4309fcb422b5a0a0649b316449435e6a4f9ae2f3dc294d4c207028d25
31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
90b51fddf71e22104c0b87ee25969aeb16271c0beff4a5cc3b00f2f2d5b1bcf6
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ac052f389897d883faac4c48ecc35e29669d837bb9f20126ccd911aebd084a28
ae07147eb32f56ce413d828dc7a2c7c136ec168269925ccb2bbb475b15382db2
bf2a8753d295cbd4efd92485b96f57d37835587d8ad0943c65e9e0fdd03545e4
d2e2e20fc9729fb0389392bde5a8fd1b4cb390dd8689ce7a1c3fe83cc91b0d52
e826524250716c7e17af91c57cdf9931686c4531fbe187e37cd5375886eab07c
edd03b96ae4ff7886406c59d7dfeeaa1b624a7da297bf2f92d0cb6b7f9633cba
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f